{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-89228dac00df5726", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails/spec/dummy/client/app/startup/CacheDisabled.tsx:5", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails/spec/dummy/client/app/startup/CacheDisabled.tsx:5"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1001dfc4ddfbb3b2", "name": "TODO/FIXME marker in shipping code \u2014 react_on_rails/spec/dummy/client/app/startup/HelloWorldHooks.tsx:12", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 react_on_rails/spec/dummy/client/app/startup/HelloWorldHooks.tsx:12"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-043115e03b0914b5", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails/spec/dummy/client/app/startup/HelloWorld.tsx:42", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails/spec/dummy/client/app/startup/HelloWorld.tsx:42"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1986f4fb51c101fe", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails/spec/dummy/client/app/startup/HelloWorldProps.tsx:13", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails/spec/dummy/client/app/startup/HelloWorldProps.tsx:13"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fc4acad56686f0f8", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails/spec/dummy/client/app/startup/HelloWorldWithLogAndThrow.tsx:4", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails/spec/dummy/client/app/startup/HelloWorldWithLogAndThrow.tsx:4"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-da2f440ad1a350c1", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails/spec/dummy/client/app/components/HelloWorldRedux.tsx:40", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails/spec/dummy/client/app/components/HelloWorldRedux.tsx:40"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c40ffbbe0c10befd", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails/spec/dummy/client/app/components/RailsContext.tsx:10", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails/spec/dummy/client/app/components/RailsContext.tsx:10"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a534fc492c325e69", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails/spec/dummy/config/webpack/webpackConfig.js:15", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails/spec/dummy/config/webpack/webpackConfig.js:15"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fc2d8ddcf9af61d7", "name": "TODO/FIXME marker in shipping code \u2014 react_on_rails/spec/dummy/config/webpack/alias.js:7", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 react_on_rails/spec/dummy/config/webpack/alias.js:7"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d9b7f476cc93b0da", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails/spec/dummy/config/webpack/webpack.config.js:9", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails/spec/dummy/config/webpack/webpack.config.js:9"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5df4b76439ad01c9", "name": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails/tests/jest.setup.js:43", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails/tests/jest.setup.js:43"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7757be4d1fe597f2", "name": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails/src/serverRenderReactComponent.ts:38", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails/src/serverRenderReactComponent.ts:38"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4dbb2de89fffe047", "name": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails/src/createReactOutput.ts:68", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails/src/createReactOutput.ts:68"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ba9c78e03fa3cd28", "name": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails/src/ClientRenderer.ts:118", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails/src/ClientRenderer.ts:118"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aeae4186c0439921", "name": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails/src/StoreRegistry.ts:59", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails/src/StoreRegistry.ts:59"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f446610218e8acc0", "name": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails/src/turbolinksUtils.ts:20", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails/src/turbolinksUtils.ts:20"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd0aaad3e16736d7", "name": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails/src/base/client.ts:170", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails/src/base/client.ts:170"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-50d7557c3ed9485c", "name": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails/src/capabilities/core.ts:96", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails/src/capabilities/core.ts:96"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-185dba6ae3750260", "name": "Stray `console.log` in TS/JS \u2014 packages/create-react-on-rails-app/src/create-app.ts:443", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/create-react-on-rails-app/src/create-app.ts:443"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e157c6246a1542f", "name": "Stray `console.log` in TS/JS \u2014 packages/create-react-on-rails-app/src/index.ts:51", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/create-react-on-rails-app/src/index.ts:51"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a586b7bb0d0c0430", "name": "Stray `console.log` in TS/JS \u2014 packages/create-react-on-rails-app/src/prompt.ts:69", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/create-react-on-rails-app/src/prompt.ts:69"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b510417ee2270921", "name": "Stray `console.log` in TS/JS \u2014 packages/create-react-on-rails-app/src/utils.ts:85", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/create-react-on-rails-app/src/utils.ts:85"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-88e4581e99fce0bc", "name": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro/tests/serverRenderRSCReactComponent.rsc.test.tsx:32", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro/tests/serverRenderRSCReactComponent.rsc.test.tsx:32"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d62906f761bd0b21", "name": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro/tests/jest.setup.js:85", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro/tests/jest.setup.js:85"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5432b9c1be6fafe9", "name": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro/tests/utils.test.js:67", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro/tests/utils.test.js:67"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bc4e2ed4a6aada8b", "name": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro/tests/createRscPayloadNode.client.test.ts:360", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro/tests/createRscPayloadNode.client.test.ts:360"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a4da6b97dd396c4", "name": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro/tests/injectRSCPayload.test.ts:154", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro/tests/injectRSCPayload.test.ts:154"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f329cad1001c173", "name": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro/src/ClientSideRenderer.ts:92", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro/src/ClientSideRenderer.ts:92"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-85d31e61a68b2fa6", "name": "TODO/FIXME marker in shipping code \u2014 packages/react-on-rails-pro/src/RSCProvider.tsx:74", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/react-on-rails-pro/src/RSCProvider.tsx:74"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9e7dc0144b0478c6", "name": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro-node-renderer/tests/handleRenderRequest.test.ts:175", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro-node-renderer/tests/handleRenderRequest.test.ts:175"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c3dd9b599269f214", "name": "TODO/FIXME marker in shipping code \u2014 packages/react-on-rails-pro-node-renderer/tests/concurrentHtmlStreaming.test.ts:57", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/react-on-rails-pro-node-renderer/tests/concurrentHtmlStreaming.test.ts:57"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2e58c685ff19224e", "name": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro-node-renderer/tests/vm.test.ts:256", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro-node-renderer/tests/vm.test.ts:256"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-29cb92ed8feef8c5", "name": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro-node-renderer/src/default-node-renderer.ts:19", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro-node-renderer/src/default-node-renderer.ts:19"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f7dced9cb56377ee", "name": "TODO/FIXME marker in shipping code \u2014 packages/react-on-rails-pro-node-renderer/src/master.ts:308", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/react-on-rails-pro-node-renderer/src/master.ts:308"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d21c89c4e19fcf60", "name": "TODO/FIXME marker in shipping code \u2014 packages/react-on-rails-pro-node-renderer/src/worker.ts:97", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/react-on-rails-pro-node-renderer/src/worker.ts:97"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8b7498a1cdfdd989", "name": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro-node-renderer/src/worker.ts:540", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro-node-renderer/src/worker.ts:540"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c7b651fd1bd03f73", "name": "TODO/FIXME marker in shipping code \u2014 packages/react-on-rails-pro-node-renderer/src/shared/log.ts:55", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/react-on-rails-pro-node-renderer/src/shared/log.ts:55"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9afb20f0cd024a5f", "name": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro-node-renderer/src/shared/log.ts:27", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro-node-renderer/src/shared/log.ts:27"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a50629deb6dfedd4", "name": "TODO/FIXME marker in shipping code \u2014 packages/react-on-rails-pro-node-renderer/src/shared/sharedConsoleHistory.ts:89", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/react-on-rails-pro-node-renderer/src/shared/sharedConsoleHistory.ts:89"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c4a64dbc89d97f3b", "name": "TODO/FIXME marker in shipping code \u2014 packages/react-on-rails-pro-node-renderer/src/shared/tracing.ts:51", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/react-on-rails-pro-node-renderer/src/shared/tracing.ts:51"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4ecbdf0cb62ab67b", "name": "TODO/FIXME marker in shipping code \u2014 packages/react-on-rails-pro-node-renderer/src/worker/authHandler.ts:22", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 packages/react-on-rails-pro-node-renderer/src/worker/authHandler.ts:22"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5ebc5e3e8b50e8ee", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/packs/client-bundle.js:28", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/packs/client-bundle.js:28"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-32997987792b5baf", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/components/HelloWorldRedux.jsx:54", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/components/HelloWorldRedux.jsx:54"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8dac3f69ab23ab1b", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/components/RailsContext.jsx:21", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/components/RailsContext.jsx:21"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-66ed01eecace8819", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/components/SimpleClientComponent.jsx:24", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/components/SimpleClientComponent.jsx:24"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2fda04baa445f550", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/components/AsyncOnServerSyncOnClient.tsx:40", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/components/AsyncOnServerSyncOnClient.tsx:40"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b460174fef4ce773", "name": "TODO/FIXME marker in shipping code \u2014 react_on_rails_pro/spec/dummy/client/app/components/HelloWorldHooks.jsx:18", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 react_on_rails_pro/spec/dummy/client/app/components/HelloWorldHooks.jsx:18"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-00d33bffac76c9fd", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/components/HydrationStatus.jsx:36", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/components/HydrationStatus.jsx:36"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-098e1f65869283b0", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/components/RouterLayout.jsx:20", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/components/RouterLayout.jsx:20"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-907851c01eb202fa", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/components/HelloWorldRedux/index.jsx:53", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/components/HelloWorldRedux/index.jsx:53"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9a1b6ebf70ffe418", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/components/RSCPostsPage/ToggleContainer.jsx:23", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/components/RSCPostsPage/ToggleContainer.jsx:23"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7eec3ff32b257d5d", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/routes/routes.jsx:23", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/routes/routes.jsx:23"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d1fa215bcca5cf78", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/ssr-computations/userQuery.ssr-computation.ts:45", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/ssr-computations/userQuery.ssr-computation.ts:45"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d5ca6e5e8e4c7f5", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/SetTimeoutLoggingApp.se", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/SetTimeoutLoggingApp.server.jsx:27"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ecef0a438be76937", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/AsyncComponentsTreeForT", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/AsyncComponentsTreeForTesting.jsx:22"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0fe9e983288dc82b", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/ApolloGraphQLApp.server.jsx:60"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2baeae5eebfae8bb", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/HelloWorld.jsx:52", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/HelloWorld.jsx:52"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-25e7846e49ae34b7", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/CacheDisabled.jsx:22", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/CacheDisabled.jsx:22"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a845d46a43093174", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/LazyApolloGraphQLApp.server.tsx:68"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f147af9a0560c46e", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/HelloWorldWithLogAndThr", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/HelloWorldWithLogAndThrow.jsx:21"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-183b30ef4a5baefe", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/ConsoleLogsInAsyncServe", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/ConsoleLogsInAsyncServer.server.jsx:23"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-917028fd1296af39", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/StreamAsyncComponents.j", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/StreamAsyncComponents.jsx:29"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-71f5db20b3083d11", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/config/webpack/ServerClientOrBoth.js:32", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/config/webpack/ServerClientOrBoth.js:32"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a106263ac6fb54cc", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/config/webpack/webpack.config.js:23", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/config/webpack/webpack.config.js:23"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-48742963478fa927", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/e2e-tests/fixture.ts:45", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/e2e-tests/fixture.ts:45"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d06ecd692c7a5110", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/execjs-compatible-dummy/config/webpack/webpackConfig.js:33", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/execjs-compatible-dummy/config/webpack/webpackConfig.js:33"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-78f55f612bf87189", "name": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/execjs-compatible-dummy/config/webpack/webpack.config.js:23", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/execjs-compatible-dummy/config/webpack/webpack.config.js:23"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-708a6bceead06938", "name": "Docker base image is tag-pinned but not digest-pinned: node:${NODE_VERSION}-bookworm", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:${NODE_VERSION}-bookworm"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b1cdfa4952c01078", "name": "Docker base image is tag-pinned but not digest-pinned: ruby:${RUBY_VERSION}-bookworm", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: ruby:${RUBY_VERSION}-bookworm"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-88a16446b7a52f4a", "name": "Docker base image is tag-pinned but not digest-pinned: registry.docker.com/library/ruby:$RUBY_VERSION-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: registry.docker.com/library/ruby:$RUBY_VERSION-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a2f3d280e72e02a9", "name": "Insecure pattern 'eval_used' in react_on_rails/spec/dummy/spec/packs_generator_spec.rb:1099", "shortDescription": {"text": "Insecure pattern 'eval_used' in react_on_rails/spec/dummy/spec/packs_generator_spec.rb:1099"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bc72af01d8273c63", "name": "Insecure pattern 'eval_used' in react_on_rails/spec/dummy/spec/helpers/react_on_rails_helper_spec.rb:787", "shortDescription": {"text": "Insecure pattern 'eval_used' in react_on_rails/spec/dummy/spec/helpers/react_on_rails_helper_spec.rb:787"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f514e7f357f5003d", "name": "Insecure pattern 'cors_wildcard' in react_on_rails/spec/dummy/config/shakapacker.yml:62", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in react_on_rails/spec/dummy/config/shakapacker.yml:62"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-59f56cd775c04bf7", "name": "Insecure pattern 'exec_used' in react_on_rails/lib/react_on_rails/dev/server_manager.rb:409", "shortDescription": {"text": "Insecure pattern 'exec_used' in react_on_rails/lib/react_on_rails/dev/server_manager.rb:409"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6a65a5f5decfa473", "name": "Insecure pattern 'node_child_process' in packages/create-react-on-rails-app/src/utils.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in packages/create-react-on-rails-app/src/utils.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8ad6b549aec2176f", "name": "Possible secret in packages/react-on-rails-pro-node-renderer/src/shared/configBuilder.ts", "shortDescription": {"text": "Possible secret in packages/react-on-rails-pro-node-renderer/src/shared/configBuilder.ts"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-3399d3365112ef98", "name": "Insecure pattern 'dangerous_innerhtml' in analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-old-vs-current/self-", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-old-vs-current/self-contained-performance-report.html:55"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-71c6f8f159c18173", "name": "Insecure pattern 'direct_innerhtml_assignment' in analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-old-vs-curre", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-old-vs-current/self-contained-performance-report.html:54"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-04632b7e21182745", "name": "Insecure pattern 'dangerous_innerhtml' in analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-old-vs-current/full-", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-old-vs-current/full-report.html:55"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c9dbb1be307f0b87", "name": "Insecure pattern 'direct_innerhtml_assignment' in analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-old-vs-curre", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-old-vs-current/full-report.html:54"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a55b7bfc4e2332d1", "name": "Insecure pattern 'dangerous_innerhtml' in analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-current-vs-current/s", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-current-vs-current/self-contained-performance-report.html:55"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-675fc6f116ec1387", "name": "Insecure pattern 'direct_innerhtml_assignment' in analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-current-vs-c", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-current-vs-current/self-contained-performance-report.html:54"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-95949f57a5a4d791", "name": "Insecure pattern 'dangerous_innerhtml' in analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-current-vs-current/f", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-current-vs-current/full-report.html:55"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-02f1d213b2dab77e", "name": "Insecure pattern 'direct_innerhtml_assignment' in analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-current-vs-c", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-current-vs-current/full-report.html:54"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8a42a866a9f76328", "name": "Insecure pattern 'dangerous_innerhtml' in analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-current-vs", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-current-vs-current/self-contained-performance-report.html:55"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d74b4cca58a723dd", "name": "Insecure pattern 'direct_innerhtml_assignment' in analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-cu", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-current-vs-current/self-contained-performance-report.html:54"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-db1173177b3f60ed", "name": "Insecure pattern 'dangerous_innerhtml' in analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-current-vs", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-current-vs-current/full-report.html:55"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-788945b4853e229f", "name": "Insecure pattern 'direct_innerhtml_assignment' in analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-cu", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-current-vs-current/full-report.html:54"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5e82afda29a3e701", "name": "Insecure pattern 'dangerous_innerhtml' in analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-old-vs-cur", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-old-vs-current/self-contained-performance-report.html:55"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dc0d6a0d499e1fcc", "name": "Insecure pattern 'direct_innerhtml_assignment' in analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-ol", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-old-vs-current/self-contained-performance-report.html:54"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f6f349cf8d307dfe", "name": "Insecure pattern 'dangerous_innerhtml' in analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-old-vs-cur", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-old-vs-current/full-report.html:55"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a4c4a86899c391ff", "name": "Insecure pattern 'direct_innerhtml_assignment' in analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-ol", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-old-vs-current/full-report.html:54"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fc5cf2b768554385", "name": "Possible secret in react_on_rails_pro/spec/dummy/renderer/node-renderer.js", "shortDescription": {"text": "Possible secret in react_on_rails_pro/spec/dummy/renderer/node-renderer.js"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-0c95e63466db0762", "name": "Insecure pattern 'dangerous_innerhtml' in react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/ApolloGraphQ", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/ApolloGraphQLApp.server.jsx:60"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-082c3ff2f8247ebe", "name": "Insecure pattern 'dangerous_innerhtml' in react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/LazyApolloGr", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/LazyApolloGraphQLApp.server.tsx:68"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b18bad7058b8c0dc", "name": "Possible secret in react_on_rails_pro/spec/dummy/spec/pre_seed_renderer_cache_spec.rb", "shortDescription": {"text": "Possible secret in react_on_rails_pro/spec/dummy/spec/pre_seed_renderer_cache_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-87dc21d15b92fd14", "name": "Possible secret in react_on_rails_pro/spec/dummy/spec/prepare_node_renderer_bundles_spec.rb", "shortDescription": {"text": "Possible secret in react_on_rails_pro/spec/dummy/spec/prepare_node_renderer_bundles_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-0150eab11e80479e", "name": "Insecure pattern 'weak_hash' in react_on_rails_pro/spec/dummy/spec/requests/incremental_rendering_integration_spec.rb:13", "shortDescription": {"text": "Insecure pattern 'weak_hash' in react_on_rails_pro/spec/dummy/spec/requests/incremental_rendering_integration_spec.rb:138"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5e9545d9a1ebe438", "name": "Possible secret in react_on_rails_pro/spec/dummy/spec/requests/upload_asset_spec.rb", "shortDescription": {"text": "Possible secret in react_on_rails_pro/spec/dummy/spec/requests/upload_asset_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-27e363717484fec5", "name": "Insecure pattern 'document_write' in react_on_rails_pro/spec/dummy/spec/support/custom_navigation.rb:114", "shortDescription": {"text": "Insecure pattern 'document_write' in react_on_rails_pro/spec/dummy/spec/support/custom_navigation.rb:114"}, "fullDescription": {"text": "Found a known-risky pattern (document_write). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5a26e02a4b73d985", "name": "Insecure pattern 'cors_wildcard' in react_on_rails_pro/spec/dummy/config/shakapacker.yml:79", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in react_on_rails_pro/spec/dummy/config/shakapacker.yml:79"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0ac66d322b99ad35", "name": "Possible secret in react_on_rails_pro/spec/dummy/config/initializers/react_on_rails_pro.rb", "shortDescription": {"text": "Possible secret in react_on_rails_pro/spec/dummy/config/initializers/react_on_rails_pro.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-e3f310f8aae2b559", "name": "Insecure pattern 'direct_innerhtml_assignment' in react_on_rails_pro/spec/dummy/app/controllers/application_controller.r", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in react_on_rails_pro/spec/dummy/app/controllers/application_controller.rb:63"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fa7851ae2e2a35b0", "name": "Insecure pattern 'cors_wildcard' in react_on_rails_pro/spec/execjs-compatible-dummy/config/shakapacker.yml:57", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in react_on_rails_pro/spec/execjs-compatible-dummy/config/shakapacker.yml:57"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b75e95e816805725", "name": "Possible secret in react_on_rails_pro/spec/execjs-compatible-dummy/config/initializers/react_on_rails_pro.rb", "shortDescription": {"text": "Possible secret in react_on_rails_pro/spec/execjs-compatible-dummy/config/initializers/react_on_rails_pro.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-356854f2d6803051", "name": "Insecure pattern 'weak_hash' in react_on_rails_pro/spec/react_on_rails_pro/assets_precompile_spec.rb:79", "shortDescription": {"text": "Insecure pattern 'weak_hash' in react_on_rails_pro/spec/react_on_rails_pro/assets_precompile_spec.rb:79"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b66dc685082ac079", "name": "Possible secret in react_on_rails_pro/spec/react_on_rails_pro/configuration_spec.rb", "shortDescription": {"text": "Possible secret in react_on_rails_pro/spec/react_on_rails_pro/configuration_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-37c0fcfc12f70767", "name": "Insecure pattern 'weak_hash' in react_on_rails_pro/spec/react_on_rails_pro/cache_spec.rb:409", "shortDescription": {"text": "Insecure pattern 'weak_hash' in react_on_rails_pro/spec/react_on_rails_pro/cache_spec.rb:409"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8c99fd4c349ea7c8", "name": "Insecure pattern 'weak_hash' in react_on_rails_pro/spec/react_on_rails_pro/utils_spec.rb:72", "shortDescription": {"text": "Insecure pattern 'weak_hash' in react_on_rails_pro/spec/react_on_rails_pro/utils_spec.rb:72"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-178e946b2bcc7898", "name": "Insecure pattern 'weak_hash' in react_on_rails_pro/spec/react_on_rails_pro/server_rendering_pool/pro_rendering_spec.rb:1", "shortDescription": {"text": "Insecure pattern 'weak_hash' in react_on_rails_pro/spec/react_on_rails_pro/server_rendering_pool/pro_rendering_spec.rb:126"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e301ec297de9b6b3", "name": "Insecure pattern 'weak_hash' in react_on_rails_pro/scripts/load/lib/scenarios/standard_render.rb:29", "shortDescription": {"text": "Insecure pattern 'weak_hash' in react_on_rails_pro/scripts/load/lib/scenarios/standard_render.rb:29"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9beadfd8072ff5ff", "name": "Insecure pattern 'weak_hash' in react_on_rails_pro/scripts/load/lib/scenarios/streaming_render.rb:37", "shortDescription": {"text": "Insecure pattern 'weak_hash' in react_on_rails_pro/scripts/load/lib/scenarios/streaming_render.rb:37"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-feef334337f655b9", "name": "Insecure pattern 'weak_hash' in react_on_rails_pro/lib/react_on_rails_pro/utils.rb:89", "shortDescription": {"text": "Insecure pattern 'weak_hash' in react_on_rails_pro/lib/react_on_rails_pro/utils.rb:89"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-778023715ec2d9b3", "name": "Possible secret in react_on_rails_pro/lib/react_on_rails_pro/configuration.rb", "shortDescription": {"text": "Possible secret in react_on_rails_pro/lib/react_on_rails_pro/configuration.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-f75a2c2c9ecff921", "name": "Insecure pattern 'weak_hash' in react_on_rails_pro/lib/react_on_rails_pro/server_rendering_pool/pro_rendering.rb:59", "shortDescription": {"text": "Insecure pattern 'weak_hash' in react_on_rails_pro/lib/react_on_rails_pro/server_rendering_pool/pro_rendering.rb:59"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-83d8d8667be67d39", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-65aa740cba4a4a73", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6628dee3f22bf9ab", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0887f70794cc964b", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8f4c232b4aa78fc9", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-77166cbd46fcd8e4", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4bf368337f4e2dab", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f8cdfffd70600cb1", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "pnpm/action-setup@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f8ec16cead2a0ec0", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "pnpm/action-setup@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8003d00ad7fb5cbc", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/github-script@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-83a0e55c3271e33c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/github-script@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fa3f609e55ea1295", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0fd94799c7b32b8c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f82e2b1d375e9e60", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de53ac274e5b4ecf", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-37716d9c0a33ad5c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-44b904e162b5f982", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de89249e3f6b5134", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-67753a21236f3f54", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3042c1ef8d032d3c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/github-script@v9 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6e737343dd91046d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52b666f63e540a62", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/github-script@v7 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-66a08680f6e9e8c7", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c3f66725c1919230", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d9aed5f9484c3b14", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/cache@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb639d9a10a47b23", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f2cdfffa669fe62", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-64053cd3b0eafb48", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1734d394e6ae2d5f", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4e91c3c8d54a8ee3", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-34731177af9b5e16", "name": "Very large file: packages/react-on-rails-pro/tests/tanstackRouter.test.ts (2249 lines)", "shortDescription": {"text": "Very large file: packages/react-on-rails-pro/tests/tanstackRouter.test.ts (2249 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8a6637ab91cc6242", "name": "Node manifest has dependencies but no lockfile: react_on_rails/spec/dummy/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: react_on_rails/spec/dummy/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d6daea6428a9d3f6", "name": "Node manifest has dependencies but no lockfile: packages/react-on-rails/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/react-on-rails/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a5c2e67876ef71bb", "name": "Node manifest has dependencies but no lockfile: packages/create-react-on-rails-app/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/create-react-on-rails-app/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-98287ef87df3d887", "name": "Node manifest has dependencies but no lockfile: packages/react-on-rails-pro/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/react-on-rails-pro/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4ea612e649d1d649", "name": "Node manifest has dependencies but no lockfile: packages/react-on-rails-pro-node-renderer/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/react-on-rails-pro-node-renderer/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-431bf06562d29302", "name": "Node manifest has dependencies but no lockfile: react_on_rails_pro/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: react_on_rails_pro/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-23fce35e310c4a41", "name": "Node manifest has dependencies but no lockfile: react_on_rails_pro/spec/dummy/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: react_on_rails_pro/spec/dummy/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-07cb9333a92fe294", "name": "Node manifest has dependencies but no lockfile: react_on_rails_pro/spec/execjs-compatible-dummy/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: react_on_rails_pro/spec/execjs-compatible-dummy/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-53a874631345e644", "name": "Node manifest has dependencies but no lockfile: react_on_rails_pro/scripts/load/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: react_on_rails_pro/scripts/load/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 101 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 105 placeholder/mock markers across 32 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3e244ac093278384", "name": "Agent instruction/config may expose a secret: analysis/rsc-fouc-shakaperf-artifacts/setup/generated-shakaperf-skills/set", "shortDescription": {"text": "Agent instruction/config may expose a secret: analysis/rsc-fouc-shakaperf-artifacts/setup/generated-shakaperf-skills/setup-docker-servers-for-ab-tests/SKILL.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-122f91b7f2906dc4", "name": "Agent authority lacks a verifier contract: .claude/settings.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5e43af45b3199f6a", "name": "Agent authority lacks a verifier contract: .claude/docs/changelog-guidelines.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/docs/changelog-guidelines.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9afb25db299f0e9d", "name": "Agent authority lacks a verifier contract: .claude/docs/conductor-compatibility.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/docs/conductor-compatibility.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c30e76934d7708fa", "name": "Agent authority lacks a verifier contract: .claude/prompts/address-review.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/prompts/address-review.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0f0c5de788ec58e3", "name": "Agent authority lacks a verifier contract: .claude/prompts/adversarial-pr-review.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/prompts/adversarial-pr-review.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1b9547b2e5ecb105", "name": "Agent authority lacks a verifier contract: .cursor/BUGBOT.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .cursor/BUGBOT.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-85191462c77b20c5", "name": "Commented-code block (5 lines) in react_on_rails/spec/dummy/babel.config.js:29", "shortDescription": {"text": "Commented-code block (5 lines) in react_on_rails/spec/dummy/babel.config.js:29"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1fdc234c25672625", "name": "Commented-code block (5 lines) in react_on_rails/spec/dummy/client/app/strictModeSupport.tsx:94", "shortDescription": {"text": "Commented-code block (5 lines) in react_on_rails/spec/dummy/client/app/strictModeSupport.tsx:94"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-384cc6372dc0cc25", "name": "Commented-code block (5 lines) in react_on_rails/spec/dummy/client/app/startup/ReactCompilerExample.tsx:8", "shortDescription": {"text": "Commented-code block (5 lines) in react_on_rails/spec/dummy/client/app/startup/ReactCompilerExample.tsx:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-babe9cb5e4ef2589", "name": "Commented-code block (5 lines) in react_on_rails/spec/dummy/client/app/startup/ViewTransitionsDemo.client.tsx:3", "shortDescription": {"text": "Commented-code block (5 lines) in react_on_rails/spec/dummy/client/app/startup/ViewTransitionsDemo.client.tsx:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-98234f361017bcdd", "name": "Commented-code block (9 lines) in react_on_rails/spec/dummy/client/app/packs/client-bundle.ts:22", "shortDescription": {"text": "Commented-code block (9 lines) in react_on_rails/spec/dummy/client/app/packs/client-bundle.ts:22"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-173c129822e0d906", "name": "Commented-code block (6 lines) in react_on_rails/spec/dummy/config/webpack/alias.js:3", "shortDescription": {"text": "Commented-code block (6 lines) in react_on_rails/spec/dummy/config/webpack/alias.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4cd12c8a6854fe51", "name": "Commented-code block (5 lines) in react_on_rails/lib/generators/react_on_rails/templates/rsc/base/app/javascript/src/Hel", "shortDescription": {"text": "Commented-code block (5 lines) in react_on_rails/lib/generators/react_on_rails/templates/rsc/base/app/javascript/src/HelloServer/components/HelloServer.jsx:19"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5cec0f066bad6174", "name": "`fetch()` without try/.catch or AbortSignal \u2014 react_on_rails/lib/generators/react_on_rails/templates/rsc/base/app/javasc", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 react_on_rails/lib/generators/react_on_rails/templates/rsc/base/app/javascript/src/HelloServer/components/HelloServer.jsx:17"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3bed45527ec86768", "name": "Commented-code block (5 lines) in react_on_rails/lib/generators/react_on_rails/templates/rsc/base/app/javascript/src/Hel", "shortDescription": {"text": "Commented-code block (5 lines) in react_on_rails/lib/generators/react_on_rails/templates/rsc/base/app/javascript/src/HelloServer/components/HelloServer.tsx:29"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8c769e4bab4c87cf", "name": "`fetch()` without try/.catch or AbortSignal \u2014 react_on_rails/lib/generators/react_on_rails/templates/rsc/base/app/javasc", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 react_on_rails/lib/generators/react_on_rails/templates/rsc/base/app/javascript/src/HelloServer/components/HelloServer.tsx:27"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-220f8584c70738f6", "name": "Commented-code block (5 lines) in docs/sidebars.ts:3", "shortDescription": {"text": "Commented-code block (5 lines) in docs/sidebars.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-356f673f8cf329c0", "name": "Commented-code block (8 lines) in packages/react-on-rails/tests/pageLifecycle.test.js:265", "shortDescription": {"text": "Commented-code block (8 lines) in packages/react-on-rails/tests/pageLifecycle.test.js:265"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-551328c2621f85c9", "name": "Commented-code block (5 lines) in packages/react-on-rails/tests/ClientRenderer.test.ts:535", "shortDescription": {"text": "Commented-code block (5 lines) in packages/react-on-rails/tests/ClientRenderer.test.ts:535"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4b459161b080a4b4", "name": "Commented-code block (9 lines) in packages/react-on-rails/tests/serverRenderReactComponent.test.ts:208", "shortDescription": {"text": "Commented-code block (9 lines) in packages/react-on-rails/tests/serverRenderReactComponent.test.ts:208"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cb96b8e483d89ea9", "name": "Commented-code block (7 lines) in packages/react-on-rails/src/serverRenderReactComponent.ts:167", "shortDescription": {"text": "Commented-code block (7 lines) in packages/react-on-rails/src/serverRenderReactComponent.ts:167"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-56dc5d48c5821fb6", "name": "Commented-code block (8 lines) in packages/react-on-rails/src/createReactOutput.ts:89", "shortDescription": {"text": "Commented-code block (8 lines) in packages/react-on-rails/src/createReactOutput.ts:89"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-20be909f34bb4e77", "name": "Commented-code block (8 lines) in packages/react-on-rails/src/ClientRenderer.ts:27", "shortDescription": {"text": "Commented-code block (8 lines) in packages/react-on-rails/src/ClientRenderer.ts:27"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e75d8035372ff68a", "name": "Commented-code block (5 lines) in packages/react-on-rails/src/rootErrorHandlers.ts:129", "shortDescription": {"text": "Commented-code block (5 lines) in packages/react-on-rails/src/rootErrorHandlers.ts:129"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a0545d8879f0613f", "name": "Commented-code block (8 lines) in packages/react-on-rails/src/createReactOnRails.ts:46", "shortDescription": {"text": "Commented-code block (8 lines) in packages/react-on-rails/src/createReactOnRails.ts:46"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d3c22e53b83abad4", "name": "Commented-code block (6 lines) in packages/react-on-rails/src/types/index.ts:49", "shortDescription": {"text": "Commented-code block (6 lines) in packages/react-on-rails/src/types/index.ts:49"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-81212473defcd4b6", "name": "Commented-code block (6 lines) in packages/react-on-rails/src/base/full.ts:70", "shortDescription": {"text": "Commented-code block (6 lines) in packages/react-on-rails/src/base/full.ts:70"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fbeb7163baebac30", "name": "Commented-code block (6 lines) in packages/react-on-rails/src/base/full.rsc.ts:34", "shortDescription": {"text": "Commented-code block (6 lines) in packages/react-on-rails/src/base/full.rsc.ts:34"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-16e58e2fc29237d9", "name": "Commented-code block (8 lines) in packages/create-react-on-rails-app/src/index.ts:84", "shortDescription": {"text": "Commented-code block (8 lines) in packages/create-react-on-rails-app/src/index.ts:84"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-31593c2088d76067", "name": "Commented-code block (6 lines) in packages/react-on-rails-pro/tests/RSCRequestTracker.test.ts:146", "shortDescription": {"text": "Commented-code block (6 lines) in packages/react-on-rails-pro/tests/RSCRequestTracker.test.ts:146"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3bb34d5fb698e3d1", "name": "Commented-code block (5 lines) in packages/react-on-rails-pro/tests/ClientSideRenderer.test.ts:657", "shortDescription": {"text": "Commented-code block (5 lines) in packages/react-on-rails-pro/tests/ClientSideRenderer.test.ts:657"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8814e7c52de4c6c7", "name": "Commented-code block (10 lines) in packages/react-on-rails-pro/tests/wrapServerComponentRenderer.client.imports.test.ts:", "shortDescription": {"text": "Commented-code block (10 lines) in packages/react-on-rails-pro/tests/wrapServerComponentRenderer.client.imports.test.ts:21"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c0036f997d9e0df3", "name": "Commented-code block (5 lines) in packages/react-on-rails-pro/tests/tanstackRouter.test.ts:1821", "shortDescription": {"text": "Commented-code block (5 lines) in packages/react-on-rails-pro/tests/tanstackRouter.test.ts:1821"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0c9cd2dffc151eaa", "name": "Commented-code block (5 lines) in packages/react-on-rails-pro/tests/jest.setup.js:39", "shortDescription": {"text": "Commented-code block (5 lines) in packages/react-on-rails-pro/tests/jest.setup.js:39"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ff592667bede23ce", "name": "Commented-code block (5 lines) in packages/react-on-rails-pro/tests/streamBackpressure.e2e.test.tsx:145", "shortDescription": {"text": "Commented-code block (5 lines) in packages/react-on-rails-pro/tests/streamBackpressure.e2e.test.tsx:145"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1e047afa6f90ae39", "name": "Commented-code block (12 lines) in packages/react-on-rails-pro/tests/SuspenseHydration.test.tsx:73", "shortDescription": {"text": "Commented-code block (12 lines) in packages/react-on-rails-pro/tests/SuspenseHydration.test.tsx:73"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c9f65db1bce362ef", "name": "Commented-code block (7 lines) in packages/react-on-rails-pro/src/getReactServerComponent.server.ts:59", "shortDescription": {"text": "Commented-code block (7 lines) in packages/react-on-rails-pro/src/getReactServerComponent.server.ts:59"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-075cae19385c32fe", "name": "Commented-code block (7 lines) in packages/react-on-rails-pro/src/RSCRequestTracker.ts:131", "shortDescription": {"text": "Commented-code block (7 lines) in packages/react-on-rails-pro/src/RSCRequestTracker.ts:131"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-36cd426a93023222", "name": "Commented-code block (6 lines) in packages/react-on-rails-pro/src/rscDiagnostics.ts:60", "shortDescription": {"text": "Commented-code block (6 lines) in packages/react-on-rails-pro/src/rscDiagnostics.ts:60"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-28f2d630d3588fe6", "name": "Commented-code block (5 lines) in packages/react-on-rails-pro/src/ClientSideRenderer.ts:99", "shortDescription": {"text": "Commented-code block (5 lines) in packages/react-on-rails-pro/src/ClientSideRenderer.ts:99"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-53ed947ddfd4ae80", "name": "`fetch()` without try/.catch or AbortSignal \u2014 packages/react-on-rails-pro/src/utils.ts:22", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/react-on-rails-pro/src/utils.ts:22"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9ba8160e6895c952", "name": "Commented-code block (5 lines) in packages/react-on-rails-pro/src/getReactServerComponent.client.ts:149", "shortDescription": {"text": "Commented-code block (5 lines) in packages/react-on-rails-pro/src/getReactServerComponent.client.ts:149"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d59b2bc1eaed00d4", "name": "Commented-code block (5 lines) in packages/react-on-rails-pro/src/streamingUtils.ts:143", "shortDescription": {"text": "Commented-code block (5 lines) in packages/react-on-rails-pro/src/streamingUtils.ts:143"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-af3d2e17aa1136f3", "name": "Commented-code block (8 lines) in packages/react-on-rails-pro/src/injectRSCPayload.ts:24", "shortDescription": {"text": "Commented-code block (8 lines) in packages/react-on-rails-pro/src/injectRSCPayload.ts:24"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e6cb7be8517ecff5", "name": "Legacy-named symbol `didWarnRouterClientDeprecated` in packages/react-on-rails-pro/src/tanstack-router/index.ts:100", "shortDescription": {"text": "Legacy-named symbol `didWarnRouterClientDeprecated` in packages/react-on-rails-pro/src/tanstack-router/index.ts:100"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11ac41ec8d9fe598", "name": "Commented-code block (6 lines) in packages/react-on-rails-pro/src/tanstack-router/clientHydrate.ts:50", "shortDescription": {"text": "Commented-code block (6 lines) in packages/react-on-rails-pro/src/tanstack-router/clientHydrate.ts:50"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a94f335259eef6ce", "name": "Commented-code block (5 lines) in packages/react-on-rails-pro/src/tanstack-router/types.ts:38", "shortDescription": {"text": "Commented-code block (5 lines) in packages/react-on-rails-pro/src/tanstack-router/types.ts:38"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-54b5b65eaa8bb972", "name": "Commented-code block (9 lines) in packages/react-on-rails-pro/src/wrapServerComponentRenderer/client.tsx:16", "shortDescription": {"text": "Commented-code block (9 lines) in packages/react-on-rails-pro/src/wrapServerComponentRenderer/client.tsx:16"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7c5db44c07b16e63", "name": "Commented-code block (6 lines) in packages/react-on-rails-pro-node-renderer/tests/handleRenderRequest.test.ts:410", "shortDescription": {"text": "Commented-code block (6 lines) in packages/react-on-rails-pro-node-renderer/tests/handleRenderRequest.test.ts:410"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-84682242f1d4985f", "name": "Commented-code block (6 lines) in packages/react-on-rails-pro-node-renderer/tests/htmlStreaming.test.js:73", "shortDescription": {"text": "Commented-code block (6 lines) in packages/react-on-rails-pro-node-renderer/tests/htmlStreaming.test.js:73"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6d6e6baf36d6a3dd", "name": "Commented-code block (7 lines) in packages/react-on-rails-pro-node-renderer/tests/uploadRaceCondition.test.ts:240", "shortDescription": {"text": "Commented-code block (7 lines) in packages/react-on-rails-pro-node-renderer/tests/uploadRaceCondition.test.ts:240"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d4ac5ede6ee85dfe", "name": "Commented-code block (6 lines) in packages/react-on-rails-pro-node-renderer/tests/vm.test.ts:635", "shortDescription": {"text": "Commented-code block (6 lines) in packages/react-on-rails-pro-node-renderer/tests/vm.test.ts:635"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cbc6f0f9137403e9", "name": "Commented-code block (5 lines) in packages/react-on-rails-pro-node-renderer/tests/vmSourceMapSupport.test.ts:703", "shortDescription": {"text": "Commented-code block (5 lines) in packages/react-on-rails-pro-node-renderer/tests/vmSourceMapSupport.test.ts:703"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e99b06247940d7a6", "name": "Commented-code block (5 lines) in packages/react-on-rails-pro-node-renderer/tests/integrations/opentelemetry.test.ts:280", "shortDescription": {"text": "Commented-code block (5 lines) in packages/react-on-rails-pro-node-renderer/tests/integrations/opentelemetry.test.ts:280"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c0eb992256ce9a1e", "name": "Commented-code block (7 lines) in packages/react-on-rails-pro-node-renderer/src/master.ts:49", "shortDescription": {"text": "Commented-code block (7 lines) in packages/react-on-rails-pro-node-renderer/src/master.ts:49"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0ed1fcc2c2b5231d", "name": "Commented-code block (5 lines) in packages/react-on-rails-pro-node-renderer/src/worker.ts:464", "shortDescription": {"text": "Commented-code block (5 lines) in packages/react-on-rails-pro-node-renderer/src/worker.ts:464"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8103b947242b6ecb", "name": "Commented-code block (6 lines) in packages/react-on-rails-pro-node-renderer/src/integrations/opentelemetry.ts:263", "shortDescription": {"text": "Commented-code block (6 lines) in packages/react-on-rails-pro-node-renderer/src/integrations/opentelemetry.ts:263"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-157dad63fe43f988", "name": "Commented-code block (6 lines) in packages/react-on-rails-pro-node-renderer/src/shared/rscPeerSupport.ts:19", "shortDescription": {"text": "Commented-code block (6 lines) in packages/react-on-rails-pro-node-renderer/src/shared/rscPeerSupport.ts:19"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ad74ff8068b43764", "name": "Commented-code block (11 lines) in packages/react-on-rails-pro-node-renderer/src/shared/configBuilder.ts:60", "shortDescription": {"text": "Commented-code block (11 lines) in packages/react-on-rails-pro-node-renderer/src/shared/configBuilder.ts:60"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a04708c5ea86ce57", "name": "Commented-code block (5 lines) in packages/react-on-rails-pro-node-renderer/src/shared/tracing.ts:226", "shortDescription": {"text": "Commented-code block (5 lines) in packages/react-on-rails-pro-node-renderer/src/shared/tracing.ts:226"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-18d0bedf3d9d7ffa", "name": "Commented-code block (7 lines) in packages/react-on-rails-pro-node-renderer/src/worker/vm.ts:236", "shortDescription": {"text": "Commented-code block (7 lines) in packages/react-on-rails-pro-node-renderer/src/worker/vm.ts:236"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9e6a1be8aefdf9ce", "name": "Commented-code block (8 lines) in packages/react-on-rails-pro-node-renderer/src/worker/handleIncrementalRenderStream.ts:", "shortDescription": {"text": "Commented-code block (8 lines) in packages/react-on-rails-pro-node-renderer/src/worker/handleIncrementalRenderStream.ts:190"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e0c04519d8b0505c", "name": "Commented-code block (5 lines) in packages/react-on-rails-pro-node-renderer/src/worker/vmSourceMapSupport.ts:412", "shortDescription": {"text": "Commented-code block (5 lines) in packages/react-on-rails-pro-node-renderer/src/worker/vmSourceMapSupport.ts:412"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4b74807b5ed6e57b", "name": "Commented-code block (6 lines) in analysis/rsc-fouc-shakaperf-artifacts/setup/config/abtests.config.ts:5", "shortDescription": {"text": "Commented-code block (6 lines) in analysis/rsc-fouc-shakaperf-artifacts/setup/config/abtests.config.ts:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-efdd3839341a75b8", "name": "Commented-code block (6 lines) in script/check-single-react-resolution.mjs:12", "shortDescription": {"text": "Commented-code block (6 lines) in script/check-single-react-resolution.mjs:12"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-084994d77e9e8cda", "name": "Commented-code block (5 lines) in react_on_rails_pro/spec/dummy/playwright.config.ts:101", "shortDescription": {"text": "Commented-code block (5 lines) in react_on_rails_pro/spec/dummy/playwright.config.ts:101"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d1b0c3196f7a14f1", "name": "Commented-code block (5 lines) in react_on_rails_pro/spec/dummy/client/app/strictModeSupport.tsx:107", "shortDescription": {"text": "Commented-code block (5 lines) in react_on_rails_pro/spec/dummy/client/app/strictModeSupport.tsx:107"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-57b6bbd5b271199b", "name": "Commented-code block (7 lines) in react_on_rails_pro/spec/dummy/client/app/strictModeReactOnRailsProNode.js:16", "shortDescription": {"text": "Commented-code block (7 lines) in react_on_rails_pro/spec/dummy/client/app/strictModeReactOnRailsProNode.js:16"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7b0851bcfc342a0a", "name": "Commented-code block (6 lines) in react_on_rails_pro/spec/dummy/client/app/components/HelloWorldHooksForServerComponents", "shortDescription": {"text": "Commented-code block (6 lines) in react_on_rails_pro/spec/dummy/client/app/components/HelloWorldHooksForServerComponents.jsx:18"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1db2957ba33e1a17", "name": "Commented-code block (5 lines) in react_on_rails_pro/spec/dummy/client/app/components/RefetchStressPage.client.tsx:173", "shortDescription": {"text": "Commented-code block (5 lines) in react_on_rails_pro/spec/dummy/client/app/components/RefetchStressPage.client.tsx:173"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a235d425db16c7bc", "name": "Commented-code block (10 lines) in react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/TanStackStarterApp.", "shortDescription": {"text": "Commented-code block (10 lines) in react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/TanStackStarterApp.jsx:92"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-69b91b8ee81cedfb", "name": "`fetch()` without try/.catch or AbortSignal \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/StreamAs", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/StreamAsyncComponents.jsx:32"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3c614147af376c03", "name": "`fetch()` without try/.catch or AbortSignal \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/CacheDem", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/CacheDemoPage.jsx:273"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0ea22ac70741fc16", "name": "`fetch()` without try/.catch or AbortSignal \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/RSCPosts", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/RSCPostsPageOverHTTP.jsx:21"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dcef6f735527a8c3", "name": "Commented-code block (5 lines) in react_on_rails_pro/spec/dummy/client/app/loadable/loadable-client.imports-loadable.jsx", "shortDescription": {"text": "Commented-code block (5 lines) in react_on_rails_pro/spec/dummy/client/app/loadable/loadable-client.imports-loadable.jsx:26"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fdf25af9c81a4902", "name": "Commented-code block (6 lines) in react_on_rails_pro/spec/dummy/config/webpack/development.js:29", "shortDescription": {"text": "Commented-code block (6 lines) in react_on_rails_pro/spec/dummy/config/webpack/development.js:29"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3d20ab1fa77f45f9", "name": "Commented-code block (20 lines) in react_on_rails_pro/spec/dummy/config/webpack/rscManifestClientReferences.js:22", "shortDescription": {"text": "Commented-code block (20 lines) in react_on_rails_pro/spec/dummy/config/webpack/rscManifestClientReferences.js:22"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b1dcf72cb91c09e5", "name": "Commented-code block (6 lines) in react_on_rails_pro/spec/dummy/tests/rsc-manifest-client-references.test.js:18", "shortDescription": {"text": "Commented-code block (6 lines) in react_on_rails_pro/spec/dummy/tests/rsc-manifest-client-references.test.js:18"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d030f907173541a5", "name": "Commented-code block (6 lines) in react_on_rails_pro/spec/execjs-compatible-dummy/config/webpack/development.js:34", "shortDescription": {"text": "Commented-code block (6 lines) in react_on_rails_pro/spec/execjs-compatible-dummy/config/webpack/development.js:34"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f1b0ae34485a1516", "name": "Frontend route `A` has no Link/navigate to it \u2014 react_on_rails_pro/spec/dummy/client/app/components/Loadable/routes/Rout", "shortDescription": {"text": "Frontend route `A` has no Link/navigate to it \u2014 react_on_rails_pro/spec/dummy/client/app/components/Loadable/routes/Routes.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bc44f8b9aaec34a1", "name": "Frontend route `B` has no Link/navigate to it \u2014 react_on_rails_pro/spec/dummy/client/app/components/Loadable/routes/Rout", "shortDescription": {"text": "Frontend route `B` has no Link/navigate to it \u2014 react_on_rails_pro/spec/dummy/client/app/components/Loadable/routes/Routes.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-71ed33428a94878c", "name": "Frontend route `/react_router/*` has no Link/navigate to it \u2014 react_on_rails/spec/dummy/client/app/routes/routes.tsx", "shortDescription": {"text": "Frontend route `/react_router/*` has no Link/navigate to it \u2014 react_on_rails/spec/dummy/client/app/routes/routes.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7f8ea7c70a48dc3d", "name": "Frontend route `simple-server` has no Link/navigate to it \u2014 react_on_rails_pro/spec/dummy/client/app/components/ServerCo", "shortDescription": {"text": "Frontend route `simple-server` has no Link/navigate to it \u2014 react_on_rails_pro/spec/dummy/client/app/components/ServerComponentRouter.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cdd905bf9d611e42", "name": "Frontend route `client-component` has no Link/navigate to it \u2014 react_on_rails_pro/spec/dummy/client/app/components/Serve", "shortDescription": {"text": "Frontend route `client-component` has no Link/navigate to it \u2014 react_on_rails_pro/spec/dummy/client/app/components/ServerComponentRouter.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d83e40a01dd1774b", "name": "Dangling fetch: GET http://internal-api/greeting (react_on_rails/lib/generators/react_on_rails/templates/rsc/base/app/ja", "shortDescription": {"text": "Dangling fetch: GET http://internal-api/greeting (react_on_rails/lib/generators/react_on_rails/templates/rsc/base/app/javascript/src/HelloServer/components/HelloServer.jsx:22)"}, "fullDescription": {"text": "`react_on_rails/lib/generators/react_on_rails/templates/rsc/base/app/javascript/src/HelloServer/components/HelloServer.jsx:22` calls `GET http://internal-api/greeting` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/internal-api/greeting`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-952e2bea3f584eee", "name": "Dangling fetch: GET /test (packages/react-on-rails-pro/tests/utils.test.js:66)", "shortDescription": {"text": "Dangling fetch: GET /test (packages/react-on-rails-pro/tests/utils.test.js:66)"}, "fullDescription": {"text": "`packages/react-on-rails-pro/tests/utils.test.js:66` calls `GET /test` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/test`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ab675afca2cbf51d", "name": "Dangling fetch: GET https://api.nationalize.io/?name=ReactOnRails (react_on_rails_pro/spec/dummy/client/app/ror-auto-loa", "shortDescription": {"text": "Dangling fetch: GET https://api.nationalize.io/?name=ReactOnRails (react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/ReactHelmetApp.server.jsx:35)"}, "fullDescription": {"text": "`react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/ReactHelmetApp.server.jsx:35` calls `GET https://api.nationalize.io/?name=ReactOnRails` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.nationalize.io`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-60c7a9a15c72752d", "name": "Dangling fetch: GET https://jsonplaceholder.org/posts/1 (react_on_rails_pro/spec/dummy/client/app/ror-auto-load-componen", "shortDescription": {"text": "Dangling fetch: GET https://jsonplaceholder.org/posts/1 (react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/StreamAsyncComponents.jsx:32)"}, "fullDescription": {"text": "`react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/StreamAsyncComponents.jsx:32` calls `GET https://jsonplaceholder.org/posts/1` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/jsonplaceholder.org/posts/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6a82528a9ac543e9", "name": "Dangling fetch: GET https://jsonplaceholder.org/comments/${commentId} (react_on_rails_pro/spec/dummy/client/app/ror-auto", "shortDescription": {"text": "Dangling fetch: GET https://jsonplaceholder.org/comments/${commentId} (react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/StreamAsyncComponents.jsx:53)"}, "fullDescription": {"text": "`react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/StreamAsyncComponents.jsx:53` calls `GET https://jsonplaceholder.org/comments/${commentId}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/jsonplaceholder.org/comments/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-db4528b42c0a974d", "name": "Dangling fetch: GET http://localhost:3000/api/posts (react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/R", "shortDescription": {"text": "Dangling fetch: GET http://localhost:3000/api/posts (react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/RSCPostsPageOverHTTP.jsx:21)"}, "fullDescription": {"text": "`react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/RSCPostsPageOverHTTP.jsx:21` calls `GET http://localhost:3000/api/posts` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/localhost:3000/api/posts`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dfbc56b424953128", "name": "Dangling fetch: GET http://localhost:3000/api/posts/${postId}/comments (react_on_rails_pro/spec/dummy/client/app/ror-aut", "shortDescription": {"text": "Dangling fetch: GET http://localhost:3000/api/posts/${postId}/comments (react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/RSCPostsPageOverHTTP.jsx:26)"}, "fullDescription": {"text": "`react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/RSCPostsPageOverHTTP.jsx:26` calls `GET http://localhost:3000/api/posts/${postId}/comments` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/localhost:3000/api/posts/<p>/comments`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-47d220881fd162bd", "name": "Dangling fetch: GET http://localhost:3000/api/users/${userId} (react_on_rails_pro/spec/dummy/client/app/ror-auto-load-co", "shortDescription": {"text": "Dangling fetch: GET http://localhost:3000/api/users/${userId} (react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/RSCPostsPageOverHTTP.jsx:31)"}, "fullDescription": {"text": "`react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/RSCPostsPageOverHTTP.jsx:31` calls `GET http://localhost:3000/api/users/${userId}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/localhost:3000/api/users/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-aff9993fc86aa43d", "name": "Dangling fetch: GET http://internal-api/greeting (react_on_rails/lib/generators/react_on_rails/templates/rsc/base/app/ja", "shortDescription": {"text": "Dangling fetch: GET http://internal-api/greeting (react_on_rails/lib/generators/react_on_rails/templates/rsc/base/app/javascript/src/HelloServer/components/HelloServer.tsx:32)"}, "fullDescription": {"text": "`react_on_rails/lib/generators/react_on_rails/templates/rsc/base/app/javascript/src/HelloServer/components/HelloServer.tsx:32` calls `GET http://internal-api/greeting` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/internal-api/greeting`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-df4588c2727b3476", "name": "Unused endpoint: POST /probe/unary", "shortDescription": {"text": "Unused endpoint: POST /probe/unary"}, "fullDescription": {"text": "`react_on_rails_pro/scripts/load/transport_probe_server.mjs` declares `POST /probe/unary` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9238524d7f9ab719", "name": "Unused endpoint: POST /probe/stream", "shortDescription": {"text": "Unused endpoint: POST /probe/stream"}, "fullDescription": {"text": "`react_on_rails_pro/scripts/load/transport_probe_server.mjs` declares `POST /probe/stream` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4321271f647e2bd0", "name": "Unused endpoint: POST /contacts", "shortDescription": {"text": "Unused endpoint: POST /contacts"}, "fullDescription": {"text": "`packages/react-on-rails/src/useRailsForm.ts` declares `POST /contacts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c236625afb6a8cb", "name": "Unused endpoint: GET /ready", "shortDescription": {"text": "Unused endpoint: GET /ready"}, "fullDescription": {"text": "`packages/react-on-rails-pro-node-renderer/src/worker.ts` declares `GET /ready` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19393"}, "properties": {"repository": "shakacode/react_on_rails", "repoUrl": "https://github.com/shakacode/react_on_rails", "branch": "main"}, "results": [{"ruleId": "scanner-89228dac00df5726", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails/spec/dummy/client/app/startup/CacheDisabled.tsx:5"}, "properties": {"repobilityId": "f99b7c643461aa72", "scanner": "scanner-primary", "fingerprint": "89228dac00df5726", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1001dfc4ddfbb3b2", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 react_on_rails/spec/dummy/client/app/startup/HelloWorldHooks.tsx:12"}, "properties": {"repobilityId": "6006e7a8d0d85c05", "scanner": "scanner-primary", "fingerprint": "1001dfc4ddfbb3b2", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-043115e03b0914b5", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails/spec/dummy/client/app/startup/HelloWorld.tsx:42"}, "properties": {"repobilityId": "1cd1f858d4326667", "scanner": "scanner-primary", "fingerprint": "043115e03b0914b5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1986f4fb51c101fe", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails/spec/dummy/client/app/startup/HelloWorldProps.tsx:13"}, "properties": {"repobilityId": "79635070c3ed5d3e", "scanner": "scanner-primary", "fingerprint": "1986f4fb51c101fe", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-fc4acad56686f0f8", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails/spec/dummy/client/app/startup/HelloWorldWithLogAndThrow.tsx:4"}, "properties": {"repobilityId": "bf1609be14b775d3", "scanner": "scanner-primary", "fingerprint": "fc4acad56686f0f8", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-da2f440ad1a350c1", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails/spec/dummy/client/app/components/HelloWorldRedux.tsx:40"}, "properties": {"repobilityId": "0f479d055d048a75", "scanner": "scanner-primary", "fingerprint": "da2f440ad1a350c1", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c40ffbbe0c10befd", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails/spec/dummy/client/app/components/RailsContext.tsx:10"}, "properties": {"repobilityId": "bf4e06ec0bf5726f", "scanner": "scanner-primary", "fingerprint": "c40ffbbe0c10befd", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a534fc492c325e69", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails/spec/dummy/config/webpack/webpackConfig.js:15"}, "properties": {"repobilityId": "c562241de8b9d270", "scanner": "scanner-primary", "fingerprint": "a534fc492c325e69", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-fc2d8ddcf9af61d7", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 react_on_rails/spec/dummy/config/webpack/alias.js:7"}, "properties": {"repobilityId": "d9895b6c1648ca02", "scanner": "scanner-primary", "fingerprint": "fc2d8ddcf9af61d7", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-d9b7f476cc93b0da", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails/spec/dummy/config/webpack/webpack.config.js:9"}, "properties": {"repobilityId": "e9d993beb4beeebc", "scanner": "scanner-primary", "fingerprint": "d9b7f476cc93b0da", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5df4b76439ad01c9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails/tests/jest.setup.js:43"}, "properties": {"repobilityId": "fc824a15dc8999ca", "scanner": "scanner-primary", "fingerprint": "5df4b76439ad01c9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7757be4d1fe597f2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails/src/serverRenderReactComponent.ts:38"}, "properties": {"repobilityId": "b882a0402908b80f", "scanner": "scanner-primary", "fingerprint": "7757be4d1fe597f2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-4dbb2de89fffe047", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails/src/createReactOutput.ts:68"}, "properties": {"repobilityId": "0c8cd9c01b24a2db", "scanner": "scanner-primary", "fingerprint": "4dbb2de89fffe047", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ba9c78e03fa3cd28", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails/src/ClientRenderer.ts:118"}, "properties": {"repobilityId": "db43494e3fbb7b50", "scanner": "scanner-primary", "fingerprint": "ba9c78e03fa3cd28", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-aeae4186c0439921", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails/src/StoreRegistry.ts:59"}, "properties": {"repobilityId": "bfe3cd9018b5ec5b", "scanner": "scanner-primary", "fingerprint": "aeae4186c0439921", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f446610218e8acc0", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails/src/turbolinksUtils.ts:20"}, "properties": {"repobilityId": "7def6ab1ac076a1a", "scanner": "scanner-primary", "fingerprint": "f446610218e8acc0", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-bd0aaad3e16736d7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails/src/base/client.ts:170"}, "properties": {"repobilityId": "df328a6ae0b503d4", "scanner": "scanner-primary", "fingerprint": "bd0aaad3e16736d7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-50d7557c3ed9485c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails/src/capabilities/core.ts:96"}, "properties": {"repobilityId": "17f59c5cd224afd1", "scanner": "scanner-primary", "fingerprint": "50d7557c3ed9485c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-185dba6ae3750260", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/create-react-on-rails-app/src/create-app.ts:443"}, "properties": {"repobilityId": "7d7ce5fc04386031", "scanner": "scanner-primary", "fingerprint": "185dba6ae3750260", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1e157c6246a1542f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/create-react-on-rails-app/src/index.ts:51"}, "properties": {"repobilityId": "9aeed8a52b06b813", "scanner": "scanner-primary", "fingerprint": "1e157c6246a1542f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a586b7bb0d0c0430", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/create-react-on-rails-app/src/prompt.ts:69"}, "properties": {"repobilityId": "c1185e8c21f372be", "scanner": "scanner-primary", "fingerprint": "a586b7bb0d0c0430", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b510417ee2270921", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/create-react-on-rails-app/src/utils.ts:85"}, "properties": {"repobilityId": "ca72927e4453820e", "scanner": "scanner-primary", "fingerprint": "b510417ee2270921", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-88e4581e99fce0bc", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro/tests/serverRenderRSCReactComponent.rsc.test.tsx:32"}, "properties": {"repobilityId": "81bf98caccd26cab", "scanner": "scanner-primary", "fingerprint": "88e4581e99fce0bc", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d62906f761bd0b21", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro/tests/jest.setup.js:85"}, "properties": {"repobilityId": "f78db8e2e20dd07a", "scanner": "scanner-primary", "fingerprint": "d62906f761bd0b21", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5432b9c1be6fafe9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro/tests/utils.test.js:67"}, "properties": {"repobilityId": "9aadb2fa3669e9bb", "scanner": "scanner-primary", "fingerprint": "5432b9c1be6fafe9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-bc4e2ed4a6aada8b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro/tests/createRscPayloadNode.client.test.ts:360"}, "properties": {"repobilityId": "815efb2265476162", "scanner": "scanner-primary", "fingerprint": "bc4e2ed4a6aada8b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2a4da6b97dd396c4", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro/tests/injectRSCPayload.test.ts:154"}, "properties": {"repobilityId": "b31e0cf2574984fa", "scanner": "scanner-primary", "fingerprint": "2a4da6b97dd396c4", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1f329cad1001c173", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro/src/ClientSideRenderer.ts:92"}, "properties": {"repobilityId": "c854d9558cbec6f5", "scanner": "scanner-primary", "fingerprint": "1f329cad1001c173", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-85d31e61a68b2fa6", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/react-on-rails-pro/src/RSCProvider.tsx:74"}, "properties": {"repobilityId": "dc03a015a44f797d", "scanner": "scanner-primary", "fingerprint": "85d31e61a68b2fa6", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-9e7dc0144b0478c6", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro-node-renderer/tests/handleRenderRequest.test.ts:175"}, "properties": {"repobilityId": "f4e6129b3e8ecf07", "scanner": "scanner-primary", "fingerprint": "9e7dc0144b0478c6", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c3dd9b599269f214", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/react-on-rails-pro-node-renderer/tests/concurrentHtmlStreaming.test.ts:57"}, "properties": {"repobilityId": "e6a5f6ee3a54ceb5", "scanner": "scanner-primary", "fingerprint": "c3dd9b599269f214", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-2e58c685ff19224e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro-node-renderer/tests/vm.test.ts:256"}, "properties": {"repobilityId": "17804004af9fe7e1", "scanner": "scanner-primary", "fingerprint": "2e58c685ff19224e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-29cb92ed8feef8c5", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro-node-renderer/src/default-node-renderer.ts:19"}, "properties": {"repobilityId": "88a484daf8179cf5", "scanner": "scanner-primary", "fingerprint": "29cb92ed8feef8c5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f7dced9cb56377ee", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/react-on-rails-pro-node-renderer/src/master.ts:308"}, "properties": {"repobilityId": "695f71f60a1c9c57", "scanner": "scanner-primary", "fingerprint": "f7dced9cb56377ee", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-d21c89c4e19fcf60", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/react-on-rails-pro-node-renderer/src/worker.ts:97"}, "properties": {"repobilityId": "27a77392d6b0f96c", "scanner": "scanner-primary", "fingerprint": "d21c89c4e19fcf60", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-8b7498a1cdfdd989", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro-node-renderer/src/worker.ts:540"}, "properties": {"repobilityId": "e193145acd618e55", "scanner": "scanner-primary", "fingerprint": "8b7498a1cdfdd989", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c7b651fd1bd03f73", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/react-on-rails-pro-node-renderer/src/shared/log.ts:55"}, "properties": {"repobilityId": "c825dacefcd420ee", "scanner": "scanner-primary", "fingerprint": "c7b651fd1bd03f73", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-9afb20f0cd024a5f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/react-on-rails-pro-node-renderer/src/shared/log.ts:27"}, "properties": {"repobilityId": "1641c708c580f5d2", "scanner": "scanner-primary", "fingerprint": "9afb20f0cd024a5f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a50629deb6dfedd4", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/react-on-rails-pro-node-renderer/src/shared/sharedConsoleHistory.ts:89"}, "properties": {"repobilityId": "b860261650eca5f0", "scanner": "scanner-primary", "fingerprint": "a50629deb6dfedd4", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-c4a64dbc89d97f3b", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/react-on-rails-pro-node-renderer/src/shared/tracing.ts:51"}, "properties": {"repobilityId": "2814614e6a886985", "scanner": "scanner-primary", "fingerprint": "c4a64dbc89d97f3b", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-4ecbdf0cb62ab67b", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 packages/react-on-rails-pro-node-renderer/src/worker/authHandler.ts:22"}, "properties": {"repobilityId": "712be547ab687b06", "scanner": "scanner-primary", "fingerprint": "4ecbdf0cb62ab67b", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-5ebc5e3e8b50e8ee", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/packs/client-bundle.js:28"}, "properties": {"repobilityId": "fe511bafbef0f909", "scanner": "scanner-primary", "fingerprint": "5ebc5e3e8b50e8ee", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-32997987792b5baf", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/components/HelloWorldRedux.jsx:54"}, "properties": {"repobilityId": "32b9f76d4b94475f", "scanner": "scanner-primary", "fingerprint": "32997987792b5baf", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8dac3f69ab23ab1b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/components/RailsContext.jsx:21"}, "properties": {"repobilityId": "2bc5ecc83cfd98a1", "scanner": "scanner-primary", "fingerprint": "8dac3f69ab23ab1b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-66ed01eecace8819", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/components/SimpleClientComponent.jsx:24"}, "properties": {"repobilityId": "51d4b8551ef4de12", "scanner": "scanner-primary", "fingerprint": "66ed01eecace8819", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2fda04baa445f550", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/components/AsyncOnServerSyncOnClient.tsx:40"}, "properties": {"repobilityId": "305b96269cb8ca98", "scanner": "scanner-primary", "fingerprint": "2fda04baa445f550", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b460174fef4ce773", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 react_on_rails_pro/spec/dummy/client/app/components/HelloWorldHooks.jsx:18"}, "properties": {"repobilityId": "c3e549f2e5c9ca30", "scanner": "scanner-primary", "fingerprint": "b460174fef4ce773", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-00d33bffac76c9fd", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/components/HydrationStatus.jsx:36"}, "properties": {"repobilityId": "9a45914883feecd9", "scanner": "scanner-primary", "fingerprint": "00d33bffac76c9fd", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-098e1f65869283b0", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/components/RouterLayout.jsx:20"}, "properties": {"repobilityId": "1757e562e6b331d3", "scanner": "scanner-primary", "fingerprint": "098e1f65869283b0", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-907851c01eb202fa", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/components/HelloWorldRedux/index.jsx:53"}, "properties": {"repobilityId": "060786ff9f534f8b", "scanner": "scanner-primary", "fingerprint": "907851c01eb202fa", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9a1b6ebf70ffe418", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/components/RSCPostsPage/ToggleContainer.jsx:23"}, "properties": {"repobilityId": "302c8d3d7aabda8b", "scanner": "scanner-primary", "fingerprint": "9a1b6ebf70ffe418", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7eec3ff32b257d5d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/routes/routes.jsx:23"}, "properties": {"repobilityId": "cd6cd422b4daa435", "scanner": "scanner-primary", "fingerprint": "7eec3ff32b257d5d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d1fa215bcca5cf78", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/ssr-computations/userQuery.ssr-computation.ts:45"}, "properties": {"repobilityId": "04edbe34d2e29ab7", "scanner": "scanner-primary", "fingerprint": "d1fa215bcca5cf78", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-4d5ca6e5e8e4c7f5", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/SetTimeoutLoggingApp.server.jsx:27"}, "properties": {"repobilityId": "60024fcf2cc21bdb", "scanner": "scanner-primary", "fingerprint": "4d5ca6e5e8e4c7f5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ecef0a438be76937", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/AsyncComponentsTreeForTesting.jsx:22"}, "properties": {"repobilityId": "1d00f26272670eb3", "scanner": "scanner-primary", "fingerprint": "ecef0a438be76937", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0fe9e983288dc82b", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/ApolloGraphQLApp.server.jsx:60"}, "properties": {"repobilityId": "a47151ae275829c7", "scanner": "scanner-primary", "fingerprint": "0fe9e983288dc82b", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-2baeae5eebfae8bb", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/HelloWorld.jsx:52"}, "properties": {"repobilityId": "e443fb92db55e17f", "scanner": "scanner-primary", "fingerprint": "2baeae5eebfae8bb", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-25e7846e49ae34b7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/CacheDisabled.jsx:22"}, "properties": {"repobilityId": "e68b84e48619f10e", "scanner": "scanner-primary", "fingerprint": "25e7846e49ae34b7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a845d46a43093174", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/LazyApolloGraphQLApp.server.tsx:68"}, "properties": {"repobilityId": "6c45b912daa081e2", "scanner": "scanner-primary", "fingerprint": "a845d46a43093174", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-f147af9a0560c46e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/HelloWorldWithLogAndThrow.jsx:21"}, "properties": {"repobilityId": "2eb2a1cb97dc2508", "scanner": "scanner-primary", "fingerprint": "f147af9a0560c46e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-183b30ef4a5baefe", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/ConsoleLogsInAsyncServer.server.jsx:23"}, "properties": {"repobilityId": "281ae0d3363d5b9e", "scanner": "scanner-primary", "fingerprint": "183b30ef4a5baefe", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-917028fd1296af39", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/StreamAsyncComponents.jsx:29"}, "properties": {"repobilityId": "41855796a7470e15", "scanner": "scanner-primary", "fingerprint": "917028fd1296af39", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-71f5db20b3083d11", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/config/webpack/ServerClientOrBoth.js:32"}, "properties": {"repobilityId": "b7e9ee00cafe3022", "scanner": "scanner-primary", "fingerprint": "71f5db20b3083d11", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a106263ac6fb54cc", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/config/webpack/webpack.config.js:23"}, "properties": {"repobilityId": "e5474e7229cdd488", "scanner": "scanner-primary", "fingerprint": "a106263ac6fb54cc", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-48742963478fa927", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/dummy/e2e-tests/fixture.ts:45"}, "properties": {"repobilityId": "8c9074df2af33493", "scanner": "scanner-primary", "fingerprint": "48742963478fa927", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d06ecd692c7a5110", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/execjs-compatible-dummy/config/webpack/webpackConfig.js:33"}, "properties": {"repobilityId": "7fd76d40314fc34e", "scanner": "scanner-primary", "fingerprint": "d06ecd692c7a5110", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-78f55f612bf87189", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 react_on_rails_pro/spec/execjs-compatible-dummy/config/webpack/webpack.config.js:23"}, "properties": {"repobilityId": "664d2dcf67c16e2f", "scanner": "scanner-primary", "fingerprint": "78f55f612bf87189", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-708a6bceead06938", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:${NODE_VERSION}-bookworm"}, "properties": {"repobilityId": "f76fa15d419a1197", "scanner": "scanner-primary", "fingerprint": "708a6bceead06938", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "analysis/rsc-fouc-shakaperf-artifacts/setup/twin-servers/Dockerfile"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-b1cdfa4952c01078", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: ruby:${RUBY_VERSION}-bookworm"}, "properties": {"repobilityId": "03559ae9c529aeea", "scanner": "scanner-primary", "fingerprint": "b1cdfa4952c01078", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "analysis/rsc-fouc-shakaperf-artifacts/setup/twin-servers/Dockerfile"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-88a16446b7a52f4a", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: registry.docker.com/library/ruby:$RUBY_VERSION-slim"}, "properties": {"repobilityId": "6438cb3b1c1e8889", "scanner": "scanner-primary", "fingerprint": "88a16446b7a52f4a", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/execjs-compatible-dummy/Dockerfile"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-a2f3d280e72e02a9", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in react_on_rails/spec/dummy/spec/packs_generator_spec.rb:1099"}, "properties": {"repobilityId": "05bf1fc94a2a59d4", "scanner": "scanner-primary", "fingerprint": "a2f3d280e72e02a9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails/spec/dummy/spec/packs_generator_spec.rb"}, "region": {"startLine": 1099}}}]}, {"ruleId": "scanner-bc72af01d8273c63", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in react_on_rails/spec/dummy/spec/helpers/react_on_rails_helper_spec.rb:787"}, "properties": {"repobilityId": "30c3c6252c5bf75b", "scanner": "scanner-primary", "fingerprint": "bc72af01d8273c63", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails/spec/dummy/spec/helpers/react_on_rails_helper_spec.rb"}, "region": {"startLine": 787}}}]}, {"ruleId": "scanner-f514e7f357f5003d", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in react_on_rails/spec/dummy/config/shakapacker.yml:62"}, "properties": {"repobilityId": "2fece300a6344ef2", "scanner": "scanner-primary", "fingerprint": "f514e7f357f5003d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails/spec/dummy/config/shakapacker.yml"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-59f56cd775c04bf7", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in react_on_rails/lib/react_on_rails/dev/server_manager.rb:409"}, "properties": {"repobilityId": "f9ddc74c90a8b8d5", "scanner": "scanner-primary", "fingerprint": "59f56cd775c04bf7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails/lib/react_on_rails/dev/server_manager.rb"}, "region": {"startLine": 409}}}]}, {"ruleId": "scanner-6a65a5f5decfa473", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in packages/create-react-on-rails-app/src/utils.ts:1"}, "properties": {"repobilityId": "0c88bf90aaae9217", "scanner": "scanner-primary", "fingerprint": "6a65a5f5decfa473", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/create-react-on-rails-app/src/utils.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8ad6b549aec2176f", "level": "error", "message": {"text": "Possible secret in packages/react-on-rails-pro-node-renderer/src/shared/configBuilder.ts"}, "properties": {"repobilityId": "1e48500e55156657", "scanner": "scanner-primary", "fingerprint": "8ad6b549aec2176f", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/react-on-rails-pro-node-renderer/src/shared/configBuilder.ts"}, "region": {"startLine": 366}}}]}, {"ruleId": "scanner-3399d3365112ef98", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-old-vs-current/self-contained-performance-report.html:55"}, "properties": {"repobilityId": "f0f2327352d7d1ba", "scanner": "scanner-primary", "fingerprint": "3399d3365112ef98", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-old-vs-current/self-contained-performance-report.html"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-71c6f8f159c18173", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-old-vs-current/self-contained-performance-report.html:54"}, "properties": {"repobilityId": "9bada01f12e6d577", "scanner": "scanner-primary", "fingerprint": "71c6f8f159c18173", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-old-vs-current/self-contained-performance-report.html"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-04632b7e21182745", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-old-vs-current/full-report.html:55"}, "properties": {"repobilityId": "10eacbebfd967642", "scanner": "scanner-primary", "fingerprint": "04632b7e21182745", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-old-vs-current/full-report.html"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-c9dbb1be307f0b87", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-old-vs-current/full-report.html:54"}, "properties": {"repobilityId": "993727cb4bc9bb74", "scanner": "scanner-primary", "fingerprint": "c9dbb1be307f0b87", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-old-vs-current/full-report.html"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-a55b7bfc4e2332d1", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-current-vs-current/self-contained-performance-report.html:55"}, "properties": {"repobilityId": "6af49943a7b5cd4b", "scanner": "scanner-primary", "fingerprint": "a55b7bfc4e2332d1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-current-vs-current/self-contained-performance-report.html"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-675fc6f116ec1387", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-current-vs-current/self-contained-performance-report.html:54"}, "properties": {"repobilityId": "f4847660f109aca0", "scanner": "scanner-primary", "fingerprint": "675fc6f116ec1387", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-current-vs-current/self-contained-performance-report.html"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-95949f57a5a4d791", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-current-vs-current/full-report.html:55"}, "properties": {"repobilityId": "1662523538a4abef", "scanner": "scanner-primary", "fingerprint": "95949f57a5a4d791", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-current-vs-current/full-report.html"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-02f1d213b2dab77e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-current-vs-current/full-report.html:54"}, "properties": {"repobilityId": "b65796bd50078bfd", "scanner": "scanner-primary", "fingerprint": "02f1d213b2dab77e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "analysis/rsc-fouc-shakaperf-artifacts/reports/first-paint-current-vs-current/full-report.html"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-8a42a866a9f76328", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-current-vs-current/self-contained-performance-report.html:55"}, "properties": {"repobilityId": "a2fd476a3bafa654", "scanner": "scanner-primary", "fingerprint": "8a42a866a9f76328", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-current-vs-current/self-contained-performance-report.html"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-d74b4cca58a723dd", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-current-vs-current/self-contained-performance-report.html:54"}, "properties": {"repobilityId": "a5086282e7b169e0", "scanner": "scanner-primary", "fingerprint": "d74b4cca58a723dd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-current-vs-current/self-contained-performance-report.html"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-db1173177b3f60ed", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-current-vs-current/full-report.html:55"}, "properties": {"repobilityId": "e036b5ebeb0868c5", "scanner": "scanner-primary", "fingerprint": "db1173177b3f60ed", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-current-vs-current/full-report.html"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-788945b4853e229f", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-current-vs-current/full-report.html:54"}, "properties": {"repobilityId": "d2d87df0d50d3d87", "scanner": "scanner-primary", "fingerprint": "788945b4853e229f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-current-vs-current/full-report.html"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-5e82afda29a3e701", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-old-vs-current/self-contained-performance-report.html:55"}, "properties": {"repobilityId": "9d6f233d4ffb5b87", "scanner": "scanner-primary", "fingerprint": "5e82afda29a3e701", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-old-vs-current/self-contained-performance-report.html"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-dc0d6a0d499e1fcc", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-old-vs-current/self-contained-performance-report.html:54"}, "properties": {"repobilityId": "70f740fc8c79a18c", "scanner": "scanner-primary", "fingerprint": "dc0d6a0d499e1fcc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-old-vs-current/self-contained-performance-report.html"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-f6f349cf8d307dfe", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-old-vs-current/full-report.html:55"}, "properties": {"repobilityId": "30a1217a84121d6e", "scanner": "scanner-primary", "fingerprint": "f6f349cf8d307dfe", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-old-vs-current/full-report.html"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-a4c4a86899c391ff", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-old-vs-current/full-report.html:54"}, "properties": {"repobilityId": "cefe27771f360115", "scanner": "scanner-primary", "fingerprint": "a4c4a86899c391ff", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "analysis/rsc-fouc-shakaperf-artifacts/reports/natural-first-visible-old-vs-current/full-report.html"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-fc5cf2b768554385", "level": "error", "message": {"text": "Possible secret in react_on_rails_pro/spec/dummy/renderer/node-renderer.js"}, "properties": {"repobilityId": "5d38335f23ff4ccb", "scanner": "scanner-primary", "fingerprint": "fc5cf2b768554385", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/dummy/renderer/node-renderer.js"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-0c95e63466db0762", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/ApolloGraphQLApp.server.jsx:60"}, "properties": {"repobilityId": "0bed4b0afb49aa32", "scanner": "scanner-primary", "fingerprint": "0c95e63466db0762", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/ApolloGraphQLApp.server.jsx"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-082c3ff2f8247ebe", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/LazyApolloGraphQLApp.server.tsx:68"}, "properties": {"repobilityId": "5dc1f4e6373d0c5a", "scanner": "scanner-primary", "fingerprint": "082c3ff2f8247ebe", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/LazyApolloGraphQLApp.server.tsx"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-b18bad7058b8c0dc", "level": "error", "message": {"text": "Possible secret in react_on_rails_pro/spec/dummy/spec/pre_seed_renderer_cache_spec.rb"}, "properties": {"repobilityId": "01124b34facd7c28", "scanner": "scanner-primary", "fingerprint": "b18bad7058b8c0dc", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/dummy/spec/pre_seed_renderer_cache_spec.rb"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-b18bad7058b8c0dc", "level": "error", "message": {"text": "Possible secret in react_on_rails_pro/spec/dummy/spec/pre_seed_renderer_cache_spec.rb"}, "properties": {"repobilityId": "01124b34facd7c28", "scanner": "scanner-primary", "fingerprint": "b18bad7058b8c0dc", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/dummy/spec/pre_seed_renderer_cache_spec.rb"}, "region": {"startLine": 549}}}]}, {"ruleId": "scanner-87dc21d15b92fd14", "level": "error", "message": {"text": "Possible secret in react_on_rails_pro/spec/dummy/spec/prepare_node_renderer_bundles_spec.rb"}, "properties": {"repobilityId": "7de942a32af065c3", "scanner": "scanner-primary", "fingerprint": "87dc21d15b92fd14", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/dummy/spec/prepare_node_renderer_bundles_spec.rb"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-87dc21d15b92fd14", "level": "error", "message": {"text": "Possible secret in react_on_rails_pro/spec/dummy/spec/prepare_node_renderer_bundles_spec.rb"}, "properties": {"repobilityId": "7de942a32af065c3", "scanner": "scanner-primary", "fingerprint": "87dc21d15b92fd14", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/dummy/spec/prepare_node_renderer_bundles_spec.rb"}, "region": {"startLine": 185}}}]}, {"ruleId": "scanner-0150eab11e80479e", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in react_on_rails_pro/spec/dummy/spec/requests/incremental_rendering_integration_spec.rb:138"}, "properties": {"repobilityId": "9a1f527a059d6ace", "scanner": "scanner-primary", "fingerprint": "0150eab11e80479e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/dummy/spec/requests/incremental_rendering_integration_spec.rb"}, "region": {"startLine": 138}}}]}, {"ruleId": "scanner-5e9545d9a1ebe438", "level": "error", "message": {"text": "Possible secret in react_on_rails_pro/spec/dummy/spec/requests/upload_asset_spec.rb"}, "properties": {"repobilityId": "24c239783c22d70d", "scanner": "scanner-primary", "fingerprint": "5e9545d9a1ebe438", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/dummy/spec/requests/upload_asset_spec.rb"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-27e363717484fec5", "level": "note", "message": {"text": "Insecure pattern 'document_write' in react_on_rails_pro/spec/dummy/spec/support/custom_navigation.rb:114"}, "properties": {"repobilityId": "01c70c58f1d41975", "scanner": "scanner-primary", "fingerprint": "27e363717484fec5", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "document_write"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/dummy/spec/support/custom_navigation.rb"}, "region": {"startLine": 114}}}]}, {"ruleId": "scanner-5a26e02a4b73d985", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in react_on_rails_pro/spec/dummy/config/shakapacker.yml:79"}, "properties": {"repobilityId": "c39bcb9c342d17d9", "scanner": "scanner-primary", "fingerprint": "5a26e02a4b73d985", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/dummy/config/shakapacker.yml"}, "region": {"startLine": 79}}}]}, {"ruleId": "scanner-0ac66d322b99ad35", "level": "error", "message": {"text": "Possible secret in react_on_rails_pro/spec/dummy/config/initializers/react_on_rails_pro.rb"}, "properties": {"repobilityId": "2cd96b80ba49a4ec", "scanner": "scanner-primary", "fingerprint": "0ac66d322b99ad35", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/dummy/config/initializers/react_on_rails_pro.rb"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-e3f310f8aae2b559", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in react_on_rails_pro/spec/dummy/app/controllers/application_controller.rb:63"}, "properties": {"repobilityId": "e0003dc6945c1bfe", "scanner": "scanner-primary", "fingerprint": "e3f310f8aae2b559", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/dummy/app/controllers/application_controller.rb"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-fa7851ae2e2a35b0", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in react_on_rails_pro/spec/execjs-compatible-dummy/config/shakapacker.yml:57"}, "properties": {"repobilityId": "763b4a145933f1cc", "scanner": "scanner-primary", "fingerprint": "fa7851ae2e2a35b0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/execjs-compatible-dummy/config/shakapacker.yml"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-b75e95e816805725", "level": "error", "message": {"text": "Possible secret in react_on_rails_pro/spec/execjs-compatible-dummy/config/initializers/react_on_rails_pro.rb"}, "properties": {"repobilityId": "8733755ef014a3cb", "scanner": "scanner-primary", "fingerprint": "b75e95e816805725", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/execjs-compatible-dummy/config/initializers/react_on_rails_pro.rb"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-356854f2d6803051", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in react_on_rails_pro/spec/react_on_rails_pro/assets_precompile_spec.rb:79"}, "properties": {"repobilityId": "537191053a0c58d6", "scanner": "scanner-primary", "fingerprint": "356854f2d6803051", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/react_on_rails_pro/assets_precompile_spec.rb"}, "region": {"startLine": 79}}}]}, {"ruleId": "scanner-b66dc685082ac079", "level": "error", "message": {"text": "Possible secret in react_on_rails_pro/spec/react_on_rails_pro/configuration_spec.rb"}, "properties": {"repobilityId": "a306f5b510ea9a28", "scanner": "scanner-primary", "fingerprint": "b66dc685082ac079", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/react_on_rails_pro/configuration_spec.rb"}, "region": {"startLine": 361}}}]}, {"ruleId": "scanner-b66dc685082ac079", "level": "error", "message": {"text": "Possible secret in react_on_rails_pro/spec/react_on_rails_pro/configuration_spec.rb"}, "properties": {"repobilityId": "a306f5b510ea9a28", "scanner": "scanner-primary", "fingerprint": "b66dc685082ac079", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/react_on_rails_pro/configuration_spec.rb"}, "region": {"startLine": 517}}}]}, {"ruleId": "scanner-b66dc685082ac079", "level": "error", "message": {"text": "Possible secret in react_on_rails_pro/spec/react_on_rails_pro/configuration_spec.rb"}, "properties": {"repobilityId": "a306f5b510ea9a28", "scanner": "scanner-primary", "fingerprint": "b66dc685082ac079", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/react_on_rails_pro/configuration_spec.rb"}, "region": {"startLine": 582}}}]}, {"ruleId": "scanner-b66dc685082ac079", "level": "error", "message": {"text": "Possible secret in react_on_rails_pro/spec/react_on_rails_pro/configuration_spec.rb"}, "properties": {"repobilityId": "a306f5b510ea9a28", "scanner": "scanner-primary", "fingerprint": "b66dc685082ac079", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/react_on_rails_pro/configuration_spec.rb"}, "region": {"startLine": 697}}}]}, {"ruleId": "scanner-b66dc685082ac079", "level": "error", "message": {"text": "Possible secret in react_on_rails_pro/spec/react_on_rails_pro/configuration_spec.rb"}, "properties": {"repobilityId": "a306f5b510ea9a28", "scanner": "scanner-primary", "fingerprint": "b66dc685082ac079", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/react_on_rails_pro/configuration_spec.rb"}, "region": {"startLine": 739}}}]}, {"ruleId": "scanner-b66dc685082ac079", "level": "error", "message": {"text": "Possible secret in react_on_rails_pro/spec/react_on_rails_pro/configuration_spec.rb"}, "properties": {"repobilityId": "a306f5b510ea9a28", "scanner": "scanner-primary", "fingerprint": "b66dc685082ac079", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/react_on_rails_pro/configuration_spec.rb"}, "region": {"startLine": 753}}}]}, {"ruleId": "scanner-37c0fcfc12f70767", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in react_on_rails_pro/spec/react_on_rails_pro/cache_spec.rb:409"}, "properties": {"repobilityId": "6d97139f90d62d30", "scanner": "scanner-primary", "fingerprint": "37c0fcfc12f70767", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/react_on_rails_pro/cache_spec.rb"}, "region": {"startLine": 409}}}]}, {"ruleId": "scanner-8c99fd4c349ea7c8", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in react_on_rails_pro/spec/react_on_rails_pro/utils_spec.rb:72"}, "properties": {"repobilityId": "2b14a10f7ddddbe8", "scanner": "scanner-primary", "fingerprint": "8c99fd4c349ea7c8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/react_on_rails_pro/utils_spec.rb"}, "region": {"startLine": 72}}}]}, {"ruleId": "scanner-178e946b2bcc7898", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in react_on_rails_pro/spec/react_on_rails_pro/server_rendering_pool/pro_rendering_spec.rb:126"}, "properties": {"repobilityId": "1ed718a540a60ca6", "scanner": "scanner-primary", "fingerprint": "178e946b2bcc7898", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/react_on_rails_pro/server_rendering_pool/pro_rendering_spec.rb"}, "region": {"startLine": 126}}}]}, {"ruleId": "scanner-e301ec297de9b6b3", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in react_on_rails_pro/scripts/load/lib/scenarios/standard_render.rb:29"}, "properties": {"repobilityId": "1fd0ebf6f356db9b", "scanner": "scanner-primary", "fingerprint": "e301ec297de9b6b3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/scripts/load/lib/scenarios/standard_render.rb"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-9beadfd8072ff5ff", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in react_on_rails_pro/scripts/load/lib/scenarios/streaming_render.rb:37"}, "properties": {"repobilityId": "bb8d5cc72aef542b", "scanner": "scanner-primary", "fingerprint": "9beadfd8072ff5ff", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/scripts/load/lib/scenarios/streaming_render.rb"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-feef334337f655b9", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in react_on_rails_pro/lib/react_on_rails_pro/utils.rb:89"}, "properties": {"repobilityId": "717cd71e7f0f9307", "scanner": "scanner-primary", "fingerprint": "feef334337f655b9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/lib/react_on_rails_pro/utils.rb"}, "region": {"startLine": 89}}}]}, {"ruleId": "scanner-778023715ec2d9b3", "level": "error", "message": {"text": "Possible secret in react_on_rails_pro/lib/react_on_rails_pro/configuration.rb"}, "properties": {"repobilityId": "817e39c0f0a79849", "scanner": "scanner-primary", "fingerprint": "778023715ec2d9b3", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/lib/react_on_rails_pro/configuration.rb"}, "region": {"startLine": 570}}}]}, {"ruleId": "scanner-f75a2c2c9ecff921", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in react_on_rails_pro/lib/react_on_rails_pro/server_rendering_pool/pro_rendering.rb:59"}, "properties": {"repobilityId": "9dd6dbea0ed81b95", "scanner": "scanner-primary", "fingerprint": "f75a2c2c9ecff921", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/lib/react_on_rails_pro/server_rendering_pool/pro_rendering.rb"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-83d8d8667be67d39", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5416b40fe27a35ae", "scanner": "scanner-primary", "fingerprint": "83d8d8667be67d39", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/package-js-tests.yml"}, "region": {"startLine": 110}}}]}, {"ruleId": "scanner-83d8d8667be67d39", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d23eb698733b895b", "scanner": "scanner-primary", "fingerprint": "83d8d8667be67d39", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/package-js-tests.yml"}, "region": {"startLine": 114}}}]}, {"ruleId": "scanner-83d8d8667be67d39", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "21d13d54d4d1fb07", "scanner": "scanner-primary", "fingerprint": "83d8d8667be67d39", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/package-js-tests.yml"}, "region": {"startLine": 119}}}]}, {"ruleId": "scanner-65aa740cba4a4a73", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8860eac61a1ebe26", "scanner": "scanner-primary", "fingerprint": "65aa740cba4a4a73", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-65aa740cba4a4a73", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7640466c92034bac", "scanner": "scanner-primary", "fingerprint": "65aa740cba4a4a73", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-65aa740cba4a4a73", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8805470db04747b3", "scanner": "scanner-primary", "fingerprint": "65aa740cba4a4a73", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql.yml"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-65aa740cba4a4a73", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3130c0a2c5ea460e", "scanner": "scanner-primary", "fingerprint": "65aa740cba4a4a73", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/codeql.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-6628dee3f22bf9ab", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "df6ca9550db8e706", "scanner": "scanner-primary", "fingerprint": "6628dee3f22bf9ab", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/bundle-size.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-6628dee3f22bf9ab", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "df6ca9550db8e706", "scanner": "scanner-primary", "fingerprint": "6628dee3f22bf9ab", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/bundle-size.yml"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-6628dee3f22bf9ab", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ec6079b0fe86da29", "scanner": "scanner-primary", "fingerprint": "6628dee3f22bf9ab", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/bundle-size.yml"}, "region": {"startLine": 65}}}]}, {"ruleId": "scanner-6628dee3f22bf9ab", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f06ae11600858ada", "scanner": "scanner-primary", "fingerprint": "6628dee3f22bf9ab", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/bundle-size.yml"}, "region": {"startLine": 70}}}]}, {"ruleId": "scanner-6628dee3f22bf9ab", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "df6ca9550db8e706", "scanner": "scanner-primary", "fingerprint": "6628dee3f22bf9ab", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/bundle-size.yml"}, "region": {"startLine": 77}}}]}, {"ruleId": "scanner-6628dee3f22bf9ab", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "df6ca9550db8e706", "scanner": "scanner-primary", "fingerprint": "6628dee3f22bf9ab", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/bundle-size.yml"}, "region": {"startLine": 113}}}]}, {"ruleId": "scanner-6628dee3f22bf9ab", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "87cc52acf8b8d277", "scanner": "scanner-primary", "fingerprint": "6628dee3f22bf9ab", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/bundle-size.yml"}, "region": {"startLine": 129}}}]}, {"ruleId": "scanner-0887f70794cc964b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "baf0e560b07053d5", "scanner": "scanner-primary", "fingerprint": "0887f70794cc964b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/benchmark-suite.yml"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-0887f70794cc964b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c7100eb5a7999c87", "scanner": "scanner-primary", "fingerprint": "0887f70794cc964b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/benchmark-suite.yml"}, "region": {"startLine": 104}}}]}, {"ruleId": "scanner-0887f70794cc964b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "228fd6aa647a93a2", "scanner": "scanner-primary", "fingerprint": "0887f70794cc964b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/benchmark-suite.yml"}, "region": {"startLine": 113}}}]}, {"ruleId": "scanner-0887f70794cc964b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3ea69d19fad95346", "scanner": "scanner-primary", "fingerprint": "0887f70794cc964b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/benchmark-suite.yml"}, "region": {"startLine": 120}}}]}, {"ruleId": "scanner-0887f70794cc964b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3ea69d19fad95346", "scanner": "scanner-primary", "fingerprint": "0887f70794cc964b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/benchmark-suite.yml"}, "region": {"startLine": 145}}}]}, {"ruleId": "scanner-0887f70794cc964b", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "44252383b6d4a807", "scanner": "scanner-primary", "fingerprint": "0887f70794cc964b", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/benchmark-suite.yml"}, "region": {"startLine": 155}}}]}, {"ruleId": "scanner-0887f70794cc964b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "85019a26dfbf75ad", "scanner": "scanner-primary", "fingerprint": "0887f70794cc964b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/benchmark-suite.yml"}, "region": {"startLine": 162}}}]}, {"ruleId": "scanner-0887f70794cc964b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6c56a038e0876e70", "scanner": "scanner-primary", "fingerprint": "0887f70794cc964b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/benchmark-suite.yml"}, "region": {"startLine": 428}}}]}, {"ruleId": "scanner-0887f70794cc964b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a17e37c3669508dd", "scanner": "scanner-primary", "fingerprint": "0887f70794cc964b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/benchmark-suite.yml"}, "region": {"startLine": 442}}}]}, {"ruleId": "scanner-0887f70794cc964b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6c56a038e0876e70", "scanner": "scanner-primary", "fingerprint": "0887f70794cc964b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/benchmark-suite.yml"}, "region": {"startLine": 461}}}]}, {"ruleId": "scanner-0887f70794cc964b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6c56a038e0876e70", "scanner": "scanner-primary", "fingerprint": "0887f70794cc964b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/benchmark-suite.yml"}, "region": {"startLine": 472}}}]}, {"ruleId": "scanner-8f4c232b4aa78fc9", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f2aa8458f6ec87a2", "scanner": "scanner-primary", "fingerprint": "8f4c232b4aa78fc9", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude-code-review.yml"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-8f4c232b4aa78fc9", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7572d8d133564421", "scanner": "scanner-primary", "fingerprint": "8f4c232b4aa78fc9", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude-code-review.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-77166cbd46fcd8e4", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "50f3b563ffac10e9", "scanner": "scanner-primary", "fingerprint": "77166cbd46fcd8e4", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude-code-review.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4bf368337f4e2dab", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "309af884f9213bd0", "scanner": "scanner-primary", "fingerprint": "4bf368337f4e2dab", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/gem-tests.yml"}, "region": {"startLine": 198}}}]}, {"ruleId": "scanner-4bf368337f4e2dab", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "309af884f9213bd0", "scanner": "scanner-primary", "fingerprint": "4bf368337f4e2dab", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/gem-tests.yml"}, "region": {"startLine": 203}}}]}, {"ruleId": "scanner-f8cdfffd70600cb1", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b1a393fd5b50d625", "scanner": "scanner-primary", "fingerprint": "f8cdfffd70600cb1", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/playwright.yml"}, "region": {"startLine": 70}}}]}, {"ruleId": "scanner-f8cdfffd70600cb1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0b96295926bb9236", "scanner": "scanner-primary", "fingerprint": "f8cdfffd70600cb1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/playwright.yml"}, "region": {"startLine": 77}}}]}, {"ruleId": "scanner-f8ec16cead2a0ec0", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4dccd85c6048abc3", "scanner": "scanner-primary", "fingerprint": "f8ec16cead2a0ec0", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/check-markdown-links.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-f8ec16cead2a0ec0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "922afb03bff3907c", "scanner": "scanner-primary", "fingerprint": "f8ec16cead2a0ec0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/check-markdown-links.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-f8ec16cead2a0ec0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "aca3b2191f31ec1b", "scanner": "scanner-primary", "fingerprint": "f8ec16cead2a0ec0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/check-markdown-links.yml"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-f8ec16cead2a0ec0", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "16a68ce8beb15201", "scanner": "scanner-primary", "fingerprint": "f8ec16cead2a0ec0", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/check-markdown-links.yml"}, "region": {"startLine": 80}}}]}, {"ruleId": "scanner-8003d00ad7fb5cbc", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "81d7676fc582761e", "scanner": "scanner-primary", "fingerprint": "8003d00ad7fb5cbc", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/detect-invalid-ci-commands.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-8003d00ad7fb5cbc", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "81d7676fc582761e", "scanner": "scanner-primary", "fingerprint": "8003d00ad7fb5cbc", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/detect-invalid-ci-commands.yml"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-83a0e55c3271e33c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cb15a095160a0710", "scanner": "scanner-primary", "fingerprint": "83a0e55c3271e33c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/stop-run-skipped-ci.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-83a0e55c3271e33c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ee32c184f8957671", "scanner": "scanner-primary", "fingerprint": "83a0e55c3271e33c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/stop-run-skipped-ci.yml"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-83a0e55c3271e33c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cb15a095160a0710", "scanner": "scanner-primary", "fingerprint": "83a0e55c3271e33c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/stop-run-skipped-ci.yml"}, "region": {"startLine": 65}}}]}, {"ruleId": "scanner-fa3f609e55ea1295", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3af92389c555ee79", "scanner": "scanner-primary", "fingerprint": "fa3f609e55ea1295", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/check-llms-full.yml"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-0fd94799c7b32b8c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a9c2295990e35540", "scanner": "scanner-primary", "fingerprint": "0fd94799c7b32b8c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/shakaperf-release-gates.yml"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-0fd94799c7b32b8c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2627d5748c2c1e6a", "scanner": "scanner-primary", "fingerprint": "0fd94799c7b32b8c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/shakaperf-release-gates.yml"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-0fd94799c7b32b8c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ea3762ee556e3311", "scanner": "scanner-primary", "fingerprint": "0fd94799c7b32b8c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/shakaperf-release-gates.yml"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-0fd94799c7b32b8c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ea3762ee556e3311", "scanner": "scanner-primary", "fingerprint": "0fd94799c7b32b8c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/shakaperf-release-gates.yml"}, "region": {"startLine": 113}}}]}, {"ruleId": "scanner-0fd94799c7b32b8c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6f8063ad1b88e82b", "scanner": "scanner-primary", "fingerprint": "0fd94799c7b32b8c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/shakaperf-release-gates.yml"}, "region": {"startLine": 191}}}]}, {"ruleId": "scanner-0fd94799c7b32b8c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6f8063ad1b88e82b", "scanner": "scanner-primary", "fingerprint": "0fd94799c7b32b8c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/shakaperf-release-gates.yml"}, "region": {"startLine": 199}}}]}, {"ruleId": "scanner-f82e2b1d375e9e60", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dfb50ce473dc6d83", "scanner": "scanner-primary", "fingerprint": "f82e2b1d375e9e60", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-test-package-and-gem.yml"}, "region": {"startLine": 123}}}]}, {"ruleId": "scanner-f82e2b1d375e9e60", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f6fbbbcad78156e4", "scanner": "scanner-primary", "fingerprint": "f82e2b1d375e9e60", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-test-package-and-gem.yml"}, "region": {"startLine": 130}}}]}, {"ruleId": "scanner-f82e2b1d375e9e60", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "68c0e764ebf635ee", "scanner": "scanner-primary", "fingerprint": "f82e2b1d375e9e60", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-test-package-and-gem.yml"}, "region": {"startLine": 137}}}]}, {"ruleId": "scanner-f82e2b1d375e9e60", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dfb50ce473dc6d83", "scanner": "scanner-primary", "fingerprint": "f82e2b1d375e9e60", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-test-package-and-gem.yml"}, "region": {"startLine": 236}}}]}, {"ruleId": "scanner-f82e2b1d375e9e60", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f6fbbbcad78156e4", "scanner": "scanner-primary", "fingerprint": "f82e2b1d375e9e60", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-test-package-and-gem.yml"}, "region": {"startLine": 243}}}]}, {"ruleId": "scanner-f82e2b1d375e9e60", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "68c0e764ebf635ee", "scanner": "scanner-primary", "fingerprint": "f82e2b1d375e9e60", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-test-package-and-gem.yml"}, "region": {"startLine": 250}}}]}, {"ruleId": "scanner-f82e2b1d375e9e60", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2bd86efbf52b7902", "scanner": "scanner-primary", "fingerprint": "f82e2b1d375e9e60", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-test-package-and-gem.yml"}, "region": {"startLine": 300}}}]}, {"ruleId": "scanner-f82e2b1d375e9e60", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dfb50ce473dc6d83", "scanner": "scanner-primary", "fingerprint": "f82e2b1d375e9e60", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-test-package-and-gem.yml"}, "region": {"startLine": 342}}}]}, {"ruleId": "scanner-f82e2b1d375e9e60", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f6fbbbcad78156e4", "scanner": "scanner-primary", "fingerprint": "f82e2b1d375e9e60", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-test-package-and-gem.yml"}, "region": {"startLine": 349}}}]}, {"ruleId": "scanner-f82e2b1d375e9e60", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "68c0e764ebf635ee", "scanner": "scanner-primary", "fingerprint": "f82e2b1d375e9e60", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-test-package-and-gem.yml"}, "region": {"startLine": 356}}}]}, {"ruleId": "scanner-f82e2b1d375e9e60", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "68c0e764ebf635ee", "scanner": "scanner-primary", "fingerprint": "f82e2b1d375e9e60", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-test-package-and-gem.yml"}, "region": {"startLine": 380}}}]}, {"ruleId": "scanner-f82e2b1d375e9e60", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7fbe44a0a8ac497c", "scanner": "scanner-primary", "fingerprint": "f82e2b1d375e9e60", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-test-package-and-gem.yml"}, "region": {"startLine": 406}}}]}, {"ruleId": "scanner-f82e2b1d375e9e60", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7fbe44a0a8ac497c", "scanner": "scanner-primary", "fingerprint": "f82e2b1d375e9e60", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-test-package-and-gem.yml"}, "region": {"startLine": 461}}}]}, {"ruleId": "scanner-f82e2b1d375e9e60", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7fbe44a0a8ac497c", "scanner": "scanner-primary", "fingerprint": "f82e2b1d375e9e60", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-test-package-and-gem.yml"}, "region": {"startLine": 468}}}]}, {"ruleId": "scanner-de53ac274e5b4ecf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "02600186fc092bd4", "scanner": "scanner-primary", "fingerprint": "de53ac274e5b4ecf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-de53ac274e5b4ecf", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8ead6a2c2bfe167b", "scanner": "scanner-primary", "fingerprint": "de53ac274e5b4ecf", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-37716d9c0a33ad5c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "abfb5752158cf655", "scanner": "scanner-primary", "fingerprint": "37716d9c0a33ad5c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-44b904e162b5f982", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "191f221492c2f96a", "scanner": "scanner-primary", "fingerprint": "44b904e162b5f982", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/examples.yml"}, "region": {"startLine": 162}}}]}, {"ruleId": "scanner-44b904e162b5f982", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "88a243ebd894a3d5", "scanner": "scanner-primary", "fingerprint": "44b904e162b5f982", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/examples.yml"}, "region": {"startLine": 169}}}]}, {"ruleId": "scanner-44b904e162b5f982", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b00706ab45403fce", "scanner": "scanner-primary", "fingerprint": "44b904e162b5f982", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/examples.yml"}, "region": {"startLine": 174}}}]}, {"ruleId": "scanner-44b904e162b5f982", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f2bbeb3a6e372475", "scanner": "scanner-primary", "fingerprint": "44b904e162b5f982", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/examples.yml"}, "region": {"startLine": 245}}}]}, {"ruleId": "scanner-de89249e3f6b5134", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6d00eefb4b82504b", "scanner": "scanner-primary", "fingerprint": "de89249e3f6b5134", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-integration-tests.yml"}, "region": {"startLine": 118}}}]}, {"ruleId": "scanner-de89249e3f6b5134", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7ccee1b0da4f7e85", "scanner": "scanner-primary", "fingerprint": "de89249e3f6b5134", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-integration-tests.yml"}, "region": {"startLine": 128}}}]}, {"ruleId": "scanner-de89249e3f6b5134", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bf55454e5bd5f4ae", "scanner": "scanner-primary", "fingerprint": "de89249e3f6b5134", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-integration-tests.yml"}, "region": {"startLine": 135}}}]}, {"ruleId": "scanner-de89249e3f6b5134", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7e39907e208c1c3f", "scanner": "scanner-primary", "fingerprint": "de89249e3f6b5134", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-integration-tests.yml"}, "region": {"startLine": 185}}}]}, {"ruleId": "scanner-de89249e3f6b5134", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6d00eefb4b82504b", "scanner": "scanner-primary", "fingerprint": "de89249e3f6b5134", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-integration-tests.yml"}, "region": {"startLine": 237}}}]}, {"ruleId": "scanner-de89249e3f6b5134", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7ccee1b0da4f7e85", "scanner": "scanner-primary", "fingerprint": "de89249e3f6b5134", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-integration-tests.yml"}, "region": {"startLine": 244}}}]}, {"ruleId": "scanner-de89249e3f6b5134", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bf55454e5bd5f4ae", "scanner": "scanner-primary", "fingerprint": "de89249e3f6b5134", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-integration-tests.yml"}, "region": {"startLine": 251}}}]}, {"ruleId": "scanner-de89249e3f6b5134", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bf55454e5bd5f4ae", "scanner": "scanner-primary", "fingerprint": "de89249e3f6b5134", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-integration-tests.yml"}, "region": {"startLine": 277}}}]}, {"ruleId": "scanner-de89249e3f6b5134", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f400497353d5cf2f", "scanner": "scanner-primary", "fingerprint": "de89249e3f6b5134", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-integration-tests.yml"}, "region": {"startLine": 350}}}]}, {"ruleId": "scanner-de89249e3f6b5134", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f400497353d5cf2f", "scanner": "scanner-primary", "fingerprint": "de89249e3f6b5134", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-integration-tests.yml"}, "region": {"startLine": 357}}}]}, {"ruleId": "scanner-de89249e3f6b5134", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f400497353d5cf2f", "scanner": "scanner-primary", "fingerprint": "de89249e3f6b5134", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-integration-tests.yml"}, "region": {"startLine": 364}}}]}, {"ruleId": "scanner-de89249e3f6b5134", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f400497353d5cf2f", "scanner": "scanner-primary", "fingerprint": "de89249e3f6b5134", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-integration-tests.yml"}, "region": {"startLine": 371}}}]}, {"ruleId": "scanner-de89249e3f6b5134", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f400497353d5cf2f", "scanner": "scanner-primary", "fingerprint": "de89249e3f6b5134", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-integration-tests.yml"}, "region": {"startLine": 378}}}]}, {"ruleId": "scanner-de89249e3f6b5134", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6d00eefb4b82504b", "scanner": "scanner-primary", "fingerprint": "de89249e3f6b5134", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-integration-tests.yml"}, "region": {"startLine": 429}}}]}, {"ruleId": "scanner-de89249e3f6b5134", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7ccee1b0da4f7e85", "scanner": "scanner-primary", "fingerprint": "de89249e3f6b5134", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-integration-tests.yml"}, "region": {"startLine": 436}}}]}, {"ruleId": "scanner-de89249e3f6b5134", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bf55454e5bd5f4ae", "scanner": "scanner-primary", "fingerprint": "de89249e3f6b5134", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-integration-tests.yml"}, "region": {"startLine": 443}}}]}, {"ruleId": "scanner-de89249e3f6b5134", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bf55454e5bd5f4ae", "scanner": "scanner-primary", "fingerprint": "de89249e3f6b5134", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-integration-tests.yml"}, "region": {"startLine": 469}}}]}, {"ruleId": "scanner-de89249e3f6b5134", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f400497353d5cf2f", "scanner": "scanner-primary", "fingerprint": "de89249e3f6b5134", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-integration-tests.yml"}, "region": {"startLine": 538}}}]}, {"ruleId": "scanner-de89249e3f6b5134", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f400497353d5cf2f", "scanner": "scanner-primary", "fingerprint": "de89249e3f6b5134", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-integration-tests.yml"}, "region": {"startLine": 545}}}]}, {"ruleId": "scanner-de89249e3f6b5134", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6d00eefb4b82504b", "scanner": "scanner-primary", "fingerprint": "de89249e3f6b5134", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pro-integration-tests.yml"}, "region": {"startLine": 601}}}]}, {"ruleId": "scanner-67753a21236f3f54", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2ac0ef095d514fe8", "scanner": "scanner-primary", "fingerprint": "67753a21236f3f54", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/dummy-app-bundler-tests.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-67753a21236f3f54", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eab58e93a00c659d", "scanner": "scanner-primary", "fingerprint": "67753a21236f3f54", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/dummy-app-bundler-tests.yml"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-67753a21236f3f54", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f8039129e3816059", "scanner": "scanner-primary", "fingerprint": "67753a21236f3f54", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/dummy-app-bundler-tests.yml"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-67753a21236f3f54", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0c7eebc83d53861d", "scanner": "scanner-primary", "fingerprint": "67753a21236f3f54", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/dummy-app-bundler-tests.yml"}, "region": {"startLine": 128}}}]}, {"ruleId": "scanner-67753a21236f3f54", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2ac0ef095d514fe8", "scanner": "scanner-primary", "fingerprint": "67753a21236f3f54", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/dummy-app-bundler-tests.yml"}, "region": {"startLine": 156}}}]}, {"ruleId": "scanner-67753a21236f3f54", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eab58e93a00c659d", "scanner": "scanner-primary", "fingerprint": "67753a21236f3f54", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/dummy-app-bundler-tests.yml"}, "region": {"startLine": 160}}}]}, {"ruleId": "scanner-67753a21236f3f54", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f8039129e3816059", "scanner": "scanner-primary", "fingerprint": "67753a21236f3f54", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/dummy-app-bundler-tests.yml"}, "region": {"startLine": 165}}}]}, {"ruleId": "scanner-67753a21236f3f54", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9084fca2474641a3", "scanner": "scanner-primary", "fingerprint": "67753a21236f3f54", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/dummy-app-bundler-tests.yml"}, "region": {"startLine": 186}}}]}, {"ruleId": "scanner-67753a21236f3f54", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0c7eebc83d53861d", "scanner": "scanner-primary", "fingerprint": "67753a21236f3f54", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/dummy-app-bundler-tests.yml"}, "region": {"startLine": 252}}}]}, {"ruleId": "scanner-67753a21236f3f54", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0c7eebc83d53861d", "scanner": "scanner-primary", "fingerprint": "67753a21236f3f54", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/dummy-app-bundler-tests.yml"}, "region": {"startLine": 258}}}]}, {"ruleId": "scanner-67753a21236f3f54", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0c7eebc83d53861d", "scanner": "scanner-primary", "fingerprint": "67753a21236f3f54", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/dummy-app-bundler-tests.yml"}, "region": {"startLine": 264}}}]}, {"ruleId": "scanner-67753a21236f3f54", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0c7eebc83d53861d", "scanner": "scanner-primary", "fingerprint": "67753a21236f3f54", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/dummy-app-bundler-tests.yml"}, "region": {"startLine": 270}}}]}, {"ruleId": "scanner-3042c1ef8d032d3c", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "db3bd8151595d27e", "scanner": "scanner-primary", "fingerprint": "3042c1ef8d032d3c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci-commands.yml"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-6e737343dd91046d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ec1af3183d653c6a", "scanner": "scanner-primary", "fingerprint": "6e737343dd91046d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/benchmark.yml"}, "region": {"startLine": 208}}}]}, {"ruleId": "scanner-6e737343dd91046d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "49817010a89b12df", "scanner": "scanner-primary", "fingerprint": "6e737343dd91046d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/benchmark.yml"}, "region": {"startLine": 212}}}]}, {"ruleId": "scanner-6e737343dd91046d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ec1af3183d653c6a", "scanner": "scanner-primary", "fingerprint": "6e737343dd91046d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/benchmark.yml"}, "region": {"startLine": 270}}}]}, {"ruleId": "scanner-6e737343dd91046d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "49817010a89b12df", "scanner": "scanner-primary", "fingerprint": "6e737343dd91046d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/benchmark.yml"}, "region": {"startLine": 274}}}]}, {"ruleId": "scanner-52b666f63e540a62", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0332254042e83065", "scanner": "scanner-primary", "fingerprint": "52b666f63e540a62", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/run-skipped-ci.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-52b666f63e540a62", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9143a85faf69a347", "scanner": "scanner-primary", "fingerprint": "52b666f63e540a62", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/run-skipped-ci.yml"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-52b666f63e540a62", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0332254042e83065", "scanner": "scanner-primary", "fingerprint": "52b666f63e540a62", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/run-skipped-ci.yml"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-52b666f63e540a62", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0332254042e83065", "scanner": "scanner-primary", "fingerprint": "52b666f63e540a62", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/run-skipped-ci.yml"}, "region": {"startLine": 89}}}]}, {"ruleId": "scanner-66a08680f6e9e8c7", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cba00fe1932c60ff", "scanner": "scanner-primary", "fingerprint": "66a08680f6e9e8c7", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/lint-js-and-ruby.yml"}, "region": {"startLine": 89}}}]}, {"ruleId": "scanner-66a08680f6e9e8c7", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "66fabb5e96a465e6", "scanner": "scanner-primary", "fingerprint": "66a08680f6e9e8c7", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/lint-js-and-ruby.yml"}, "region": {"startLine": 95}}}]}, {"ruleId": "scanner-66a08680f6e9e8c7", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cba00fe1932c60ff", "scanner": "scanner-primary", "fingerprint": "66a08680f6e9e8c7", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/lint-js-and-ruby.yml"}, "region": {"startLine": 130}}}]}, {"ruleId": "scanner-66a08680f6e9e8c7", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "66fabb5e96a465e6", "scanner": "scanner-primary", "fingerprint": "66a08680f6e9e8c7", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/lint-js-and-ruby.yml"}, "region": {"startLine": 136}}}]}, {"ruleId": "scanner-66a08680f6e9e8c7", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1f33d352f6a77a34", "scanner": "scanner-primary", "fingerprint": "66a08680f6e9e8c7", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/lint-js-and-ruby.yml"}, "region": {"startLine": 141}}}]}, {"ruleId": "scanner-c3f66725c1919230", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "894c5a7b33cc2d12", "scanner": "scanner-primary", "fingerprint": "c3f66725c1919230", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/precompile-check.yml"}, "region": {"startLine": 97}}}]}, {"ruleId": "scanner-c3f66725c1919230", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9a7986619161b90e", "scanner": "scanner-primary", "fingerprint": "c3f66725c1919230", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/precompile-check.yml"}, "region": {"startLine": 101}}}]}, {"ruleId": "scanner-c3f66725c1919230", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "23e89601d35ade6f", "scanner": "scanner-primary", "fingerprint": "c3f66725c1919230", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/precompile-check.yml"}, "region": {"startLine": 106}}}]}, {"ruleId": "scanner-c3f66725c1919230", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3f496c4bd8747913", "scanner": "scanner-primary", "fingerprint": "c3f66725c1919230", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/precompile-check.yml"}, "region": {"startLine": 166}}}]}, {"ruleId": "scanner-d9aed5f9484c3b14", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2563ba452be7edbc", "scanner": "scanner-primary", "fingerprint": "d9aed5f9484c3b14", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/actionlint.yml"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-cb639d9a10a47b23", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "edeab51902066991", "scanner": "scanner-primary", "fingerprint": "cb639d9a10a47b23", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6f2cdfffa669fe62", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "6341968e6ecc36e1", "scanner": "scanner-primary", "fingerprint": "6f2cdfffa669fe62", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/react-on-rails/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-64053cd3b0eafb48", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "ab3bca0a930ca973", "scanner": "scanner-primary", "fingerprint": "64053cd3b0eafb48", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/react-on-rails-pro/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1734d394e6ae2d5f", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "52c538f865f88c8a", "scanner": "scanner-primary", "fingerprint": "1734d394e6ae2d5f", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/react-on-rails-pro-node-renderer/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4e91c3c8d54a8ee3", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "8841336c66cbfbe9", "scanner": "scanner-primary", "fingerprint": "4e91c3c8d54a8ee3", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/dummy/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-34731177af9b5e16", "level": "note", "message": {"text": "Very large file: packages/react-on-rails-pro/tests/tanstackRouter.test.ts (2249 lines)"}, "properties": {"repobilityId": "5447e8d8efc697c0", "scanner": "scanner-primary", "fingerprint": "34731177af9b5e16", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8a6637ab91cc6242", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: react_on_rails/spec/dummy/package.json"}, "properties": {"repobilityId": "6ab2b94475c571ea", "scanner": "scanner-primary", "fingerprint": "8a6637ab91cc6242", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails/spec/dummy/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d6daea6428a9d3f6", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/react-on-rails/package.json"}, "properties": {"repobilityId": "7eae348e918a29dc", "scanner": "scanner-primary", "fingerprint": "d6daea6428a9d3f6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/react-on-rails/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a5c2e67876ef71bb", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/create-react-on-rails-app/package.json"}, "properties": {"repobilityId": "6483a90be5d1fffc", "scanner": "scanner-primary", "fingerprint": "a5c2e67876ef71bb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/create-react-on-rails-app/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-98287ef87df3d887", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/react-on-rails-pro/package.json"}, "properties": {"repobilityId": "ab20fd9b7cd71b64", "scanner": "scanner-primary", "fingerprint": "98287ef87df3d887", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/react-on-rails-pro/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4ea612e649d1d649", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/react-on-rails-pro-node-renderer/package.json"}, "properties": {"repobilityId": "f55d34ad1e072b04", "scanner": "scanner-primary", "fingerprint": "4ea612e649d1d649", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/react-on-rails-pro-node-renderer/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-431bf06562d29302", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: react_on_rails_pro/package.json"}, "properties": {"repobilityId": "2e926751794bd2bd", "scanner": "scanner-primary", "fingerprint": "431bf06562d29302", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-23fce35e310c4a41", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: react_on_rails_pro/spec/dummy/package.json"}, "properties": {"repobilityId": "58edff52c93c60e9", "scanner": "scanner-primary", "fingerprint": "23fce35e310c4a41", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/dummy/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-07cb9333a92fe294", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: react_on_rails_pro/spec/execjs-compatible-dummy/package.json"}, "properties": {"repobilityId": "a8342319229d1ca8", "scanner": "scanner-primary", "fingerprint": "07cb9333a92fe294", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/spec/execjs-compatible-dummy/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-53a874631345e644", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: react_on_rails_pro/scripts/load/package.json"}, "properties": {"repobilityId": "3406903dd4c6f60b", "scanner": "scanner-primary", "fingerprint": "53a874631345e644", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "react_on_rails_pro/scripts/load/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "b2867764031b80f4", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "2014d9933f3875b1", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "ef93ae7d8b9a3e12", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "f93fbc60efedb69a", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "42705de837e9a39f", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "a3f11cde6cb446cd", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-3e244ac093278384", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: analysis/rsc-fouc-shakaperf-artifacts/setup/generated-shakaperf-skills/setup-docker-servers-for-ab-tests/SKILL.md"}, "properties": {"repobilityId": "6a4db936d91275ce", "scanner": "scanner-primary", "fingerprint": "3e244ac093278384", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "analysis/rsc-fouc-shakaperf-artifacts/setup/generated-shakaperf-skills/setup-docker-servers-for-ab-tests/SKILL.md"}, "region": {"startLine": 147}}}]}, {"ruleId": "scanner-122f91b7f2906dc4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "properties": {"repobilityId": "a2967269048b6a9d", "scanner": "scanner-primary", "fingerprint": "122f91b7f2906dc4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5e43af45b3199f6a", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/docs/changelog-guidelines.md"}, "properties": {"repobilityId": "a2b36ccdc3a63ce5", "scanner": "scanner-primary", "fingerprint": "5e43af45b3199f6a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/docs/changelog-guidelines.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9afb25db299f0e9d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/docs/conductor-compatibility.md"}, "properties": {"repobilityId": "868520a23f7ed1ed", "scanner": "scanner-primary", "fingerprint": "9afb25db299f0e9d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/docs/conductor-compatibility.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c30e76934d7708fa", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/prompts/address-review.md"}, "properties": {"repobilityId": "17c0f432b93f12cf", "scanner": "scanner-primary", "fingerprint": "c30e76934d7708fa", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/prompts/address-review.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0f0c5de788ec58e3", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/prompts/adversarial-pr-review.md"}, "properties": {"repobilityId": "f2d2a7a622aa72a2", "scanner": "scanner-primary", "fingerprint": "0f0c5de788ec58e3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/prompts/adversarial-pr-review.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1b9547b2e5ecb105", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .cursor/BUGBOT.md"}, "properties": {"repobilityId": "1af6b02487ce9dd9", "scanner": "scanner-primary", "fingerprint": "1b9547b2e5ecb105", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "cursor_rule"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".cursor/BUGBOT.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-85191462c77b20c5", "level": "none", "message": {"text": "Commented-code block (5 lines) in react_on_rails/spec/dummy/babel.config.js:29"}, "properties": {"repobilityId": "71f5f67a68e4b406", "scanner": "scanner-primary", "fingerprint": "85191462c77b20c5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1fdc234c25672625", "level": "none", "message": {"text": "Commented-code block (5 lines) in react_on_rails/spec/dummy/client/app/strictModeSupport.tsx:94"}, "properties": {"repobilityId": "a26f16dccb317a19", "scanner": "scanner-primary", "fingerprint": "1fdc234c25672625", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-384cc6372dc0cc25", "level": "none", "message": {"text": "Commented-code block (5 lines) in react_on_rails/spec/dummy/client/app/startup/ReactCompilerExample.tsx:8"}, "properties": {"repobilityId": "77fb9fce609edb76", "scanner": "scanner-primary", "fingerprint": "384cc6372dc0cc25", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-babe9cb5e4ef2589", "level": "none", "message": {"text": "Commented-code block (5 lines) in react_on_rails/spec/dummy/client/app/startup/ViewTransitionsDemo.client.tsx:3"}, "properties": {"repobilityId": "3ef98f9801bbee4e", "scanner": "scanner-primary", "fingerprint": "babe9cb5e4ef2589", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-98234f361017bcdd", "level": "none", "message": {"text": "Commented-code block (9 lines) in react_on_rails/spec/dummy/client/app/packs/client-bundle.ts:22"}, "properties": {"repobilityId": "dbdd7fc039c84555", "scanner": "scanner-primary", "fingerprint": "98234f361017bcdd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-173c129822e0d906", "level": "none", "message": {"text": "Commented-code block (6 lines) in react_on_rails/spec/dummy/config/webpack/alias.js:3"}, "properties": {"repobilityId": "030df2d06426d51a", "scanner": "scanner-primary", "fingerprint": "173c129822e0d906", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4cd12c8a6854fe51", "level": "none", "message": {"text": "Commented-code block (5 lines) in react_on_rails/lib/generators/react_on_rails/templates/rsc/base/app/javascript/src/HelloServer/components/HelloServer.jsx:19"}, "properties": {"repobilityId": "a09c94d971e4842c", "scanner": "scanner-primary", "fingerprint": "4cd12c8a6854fe51", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5cec0f066bad6174", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 react_on_rails/lib/generators/react_on_rails/templates/rsc/base/app/javascript/src/HelloServer/components/HelloServer.jsx:17"}, "properties": {"repobilityId": "461b0b699d67c75a", "scanner": "scanner-primary", "fingerprint": "5cec0f066bad6174", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3bed45527ec86768", "level": "none", "message": {"text": "Commented-code block (5 lines) in react_on_rails/lib/generators/react_on_rails/templates/rsc/base/app/javascript/src/HelloServer/components/HelloServer.tsx:29"}, "properties": {"repobilityId": "fd2c5cb9ad0d053e", "scanner": "scanner-primary", "fingerprint": "3bed45527ec86768", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8c769e4bab4c87cf", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 react_on_rails/lib/generators/react_on_rails/templates/rsc/base/app/javascript/src/HelloServer/components/HelloServer.tsx:27"}, "properties": {"repobilityId": "2dbcdfd39c1867e6", "scanner": "scanner-primary", "fingerprint": "8c769e4bab4c87cf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-220f8584c70738f6", "level": "none", "message": {"text": "Commented-code block (5 lines) in docs/sidebars.ts:3"}, "properties": {"repobilityId": "6c212f6db600edc0", "scanner": "scanner-primary", "fingerprint": "220f8584c70738f6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-356f673f8cf329c0", "level": "none", "message": {"text": "Commented-code block (8 lines) in packages/react-on-rails/tests/pageLifecycle.test.js:265"}, "properties": {"repobilityId": "a4fff211b6c493a5", "scanner": "scanner-primary", "fingerprint": "356f673f8cf329c0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-551328c2621f85c9", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/react-on-rails/tests/ClientRenderer.test.ts:535"}, "properties": {"repobilityId": "29e17dde8526f18e", "scanner": "scanner-primary", "fingerprint": "551328c2621f85c9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4b459161b080a4b4", "level": "none", "message": {"text": "Commented-code block (9 lines) in packages/react-on-rails/tests/serverRenderReactComponent.test.ts:208"}, "properties": {"repobilityId": "a278e430e1f37d0b", "scanner": "scanner-primary", "fingerprint": "4b459161b080a4b4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cb96b8e483d89ea9", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/react-on-rails/src/serverRenderReactComponent.ts:167"}, "properties": {"repobilityId": "2a1b98c7256eb5f0", "scanner": "scanner-primary", "fingerprint": "cb96b8e483d89ea9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-56dc5d48c5821fb6", "level": "none", "message": {"text": "Commented-code block (8 lines) in packages/react-on-rails/src/createReactOutput.ts:89"}, "properties": {"repobilityId": "dfef54299e9fe7fc", "scanner": "scanner-primary", "fingerprint": "56dc5d48c5821fb6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-20be909f34bb4e77", "level": "none", "message": {"text": "Commented-code block (8 lines) in packages/react-on-rails/src/ClientRenderer.ts:27"}, "properties": {"repobilityId": "f977e07226d7bc8f", "scanner": "scanner-primary", "fingerprint": "20be909f34bb4e77", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e75d8035372ff68a", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/react-on-rails/src/rootErrorHandlers.ts:129"}, "properties": {"repobilityId": "9fafb340b29cc04c", "scanner": "scanner-primary", "fingerprint": "e75d8035372ff68a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a0545d8879f0613f", "level": "none", "message": {"text": "Commented-code block (8 lines) in packages/react-on-rails/src/createReactOnRails.ts:46"}, "properties": {"repobilityId": "36684a9ab39a5cb7", "scanner": "scanner-primary", "fingerprint": "a0545d8879f0613f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d3c22e53b83abad4", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/react-on-rails/src/types/index.ts:49"}, "properties": {"repobilityId": "a347e7095199244d", "scanner": "scanner-primary", "fingerprint": "d3c22e53b83abad4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-81212473defcd4b6", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/react-on-rails/src/base/full.ts:70"}, "properties": {"repobilityId": "4392fcb2f608eae1", "scanner": "scanner-primary", "fingerprint": "81212473defcd4b6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fbeb7163baebac30", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/react-on-rails/src/base/full.rsc.ts:34"}, "properties": {"repobilityId": "8a2ce2806f6e32fc", "scanner": "scanner-primary", "fingerprint": "fbeb7163baebac30", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-16e58e2fc29237d9", "level": "none", "message": {"text": "Commented-code block (8 lines) in packages/create-react-on-rails-app/src/index.ts:84"}, "properties": {"repobilityId": "1b8572ec6b9fbf04", "scanner": "scanner-primary", "fingerprint": "16e58e2fc29237d9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-31593c2088d76067", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/react-on-rails-pro/tests/RSCRequestTracker.test.ts:146"}, "properties": {"repobilityId": "c4be5841953c197d", "scanner": "scanner-primary", "fingerprint": "31593c2088d76067", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3bb34d5fb698e3d1", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/react-on-rails-pro/tests/ClientSideRenderer.test.ts:657"}, "properties": {"repobilityId": "3ba8a6fb7b01f508", "scanner": "scanner-primary", "fingerprint": "3bb34d5fb698e3d1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8814e7c52de4c6c7", "level": "none", "message": {"text": "Commented-code block (10 lines) in packages/react-on-rails-pro/tests/wrapServerComponentRenderer.client.imports.test.ts:21"}, "properties": {"repobilityId": "5ccb6b84307e4dd2", "scanner": "scanner-primary", "fingerprint": "8814e7c52de4c6c7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c0036f997d9e0df3", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/react-on-rails-pro/tests/tanstackRouter.test.ts:1821"}, "properties": {"repobilityId": "2d7eeb641290eb2c", "scanner": "scanner-primary", "fingerprint": "c0036f997d9e0df3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0c9cd2dffc151eaa", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/react-on-rails-pro/tests/jest.setup.js:39"}, "properties": {"repobilityId": "4d11be6cc0a7b686", "scanner": "scanner-primary", "fingerprint": "0c9cd2dffc151eaa", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ff592667bede23ce", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/react-on-rails-pro/tests/streamBackpressure.e2e.test.tsx:145"}, "properties": {"repobilityId": "d19cee07228ea5c3", "scanner": "scanner-primary", "fingerprint": "ff592667bede23ce", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1e047afa6f90ae39", "level": "none", "message": {"text": "Commented-code block (12 lines) in packages/react-on-rails-pro/tests/SuspenseHydration.test.tsx:73"}, "properties": {"repobilityId": "7da2c38a84d0ecee", "scanner": "scanner-primary", "fingerprint": "1e047afa6f90ae39", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c9f65db1bce362ef", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/react-on-rails-pro/src/getReactServerComponent.server.ts:59"}, "properties": {"repobilityId": "c89ee2307aac5d7a", "scanner": "scanner-primary", "fingerprint": "c9f65db1bce362ef", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-075cae19385c32fe", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/react-on-rails-pro/src/RSCRequestTracker.ts:131"}, "properties": {"repobilityId": "0f33477187ca3f8e", "scanner": "scanner-primary", "fingerprint": "075cae19385c32fe", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-36cd426a93023222", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/react-on-rails-pro/src/rscDiagnostics.ts:60"}, "properties": {"repobilityId": "266d2cbd62209127", "scanner": "scanner-primary", "fingerprint": "36cd426a93023222", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-28f2d630d3588fe6", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/react-on-rails-pro/src/ClientSideRenderer.ts:99"}, "properties": {"repobilityId": "042a654398a62204", "scanner": "scanner-primary", "fingerprint": "28f2d630d3588fe6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-53ed947ddfd4ae80", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 packages/react-on-rails-pro/src/utils.ts:22"}, "properties": {"repobilityId": "459e8985d13a64b2", "scanner": "scanner-primary", "fingerprint": "53ed947ddfd4ae80", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9ba8160e6895c952", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/react-on-rails-pro/src/getReactServerComponent.client.ts:149"}, "properties": {"repobilityId": "50467fd8d40b1e61", "scanner": "scanner-primary", "fingerprint": "9ba8160e6895c952", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d59b2bc1eaed00d4", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/react-on-rails-pro/src/streamingUtils.ts:143"}, "properties": {"repobilityId": "48dbb2df0fa8c010", "scanner": "scanner-primary", "fingerprint": "d59b2bc1eaed00d4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-af3d2e17aa1136f3", "level": "none", "message": {"text": "Commented-code block (8 lines) in packages/react-on-rails-pro/src/injectRSCPayload.ts:24"}, "properties": {"repobilityId": "2259843be2a1ec6a", "scanner": "scanner-primary", "fingerprint": "af3d2e17aa1136f3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e6cb7be8517ecff5", "level": "note", "message": {"text": "Legacy-named symbol `didWarnRouterClientDeprecated` in packages/react-on-rails-pro/src/tanstack-router/index.ts:100"}, "properties": {"repobilityId": "bdfa4afce1abd35a", "scanner": "scanner-primary", "fingerprint": "e6cb7be8517ecff5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-11ac41ec8d9fe598", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/react-on-rails-pro/src/tanstack-router/clientHydrate.ts:50"}, "properties": {"repobilityId": "a721cc4d6de87e4e", "scanner": "scanner-primary", "fingerprint": "11ac41ec8d9fe598", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a94f335259eef6ce", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/react-on-rails-pro/src/tanstack-router/types.ts:38"}, "properties": {"repobilityId": "f6b5eef2ac3b70e5", "scanner": "scanner-primary", "fingerprint": "a94f335259eef6ce", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-54b5b65eaa8bb972", "level": "none", "message": {"text": "Commented-code block (9 lines) in packages/react-on-rails-pro/src/wrapServerComponentRenderer/client.tsx:16"}, "properties": {"repobilityId": "37c260a96c03e644", "scanner": "scanner-primary", "fingerprint": "54b5b65eaa8bb972", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7c5db44c07b16e63", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/react-on-rails-pro-node-renderer/tests/handleRenderRequest.test.ts:410"}, "properties": {"repobilityId": "c7a63418f8f77a01", "scanner": "scanner-primary", "fingerprint": "7c5db44c07b16e63", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-84682242f1d4985f", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/react-on-rails-pro-node-renderer/tests/htmlStreaming.test.js:73"}, "properties": {"repobilityId": "7f2810e7a20fb6ee", "scanner": "scanner-primary", "fingerprint": "84682242f1d4985f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6d6e6baf36d6a3dd", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/react-on-rails-pro-node-renderer/tests/uploadRaceCondition.test.ts:240"}, "properties": {"repobilityId": "5f4fcc7fd0f070ca", "scanner": "scanner-primary", "fingerprint": "6d6e6baf36d6a3dd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d4ac5ede6ee85dfe", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/react-on-rails-pro-node-renderer/tests/vm.test.ts:635"}, "properties": {"repobilityId": "c91c78605cc9cce3", "scanner": "scanner-primary", "fingerprint": "d4ac5ede6ee85dfe", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cbc6f0f9137403e9", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/react-on-rails-pro-node-renderer/tests/vmSourceMapSupport.test.ts:703"}, "properties": {"repobilityId": "1fe904e9bb034bd8", "scanner": "scanner-primary", "fingerprint": "cbc6f0f9137403e9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e99b06247940d7a6", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/react-on-rails-pro-node-renderer/tests/integrations/opentelemetry.test.ts:280"}, "properties": {"repobilityId": "0f5a05e0b5501247", "scanner": "scanner-primary", "fingerprint": "e99b06247940d7a6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c0eb992256ce9a1e", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/react-on-rails-pro-node-renderer/src/master.ts:49"}, "properties": {"repobilityId": "18635d7e7cfdf252", "scanner": "scanner-primary", "fingerprint": "c0eb992256ce9a1e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0ed1fcc2c2b5231d", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/react-on-rails-pro-node-renderer/src/worker.ts:464"}, "properties": {"repobilityId": "63a90c9a1856772b", "scanner": "scanner-primary", "fingerprint": "0ed1fcc2c2b5231d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8103b947242b6ecb", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/react-on-rails-pro-node-renderer/src/integrations/opentelemetry.ts:263"}, "properties": {"repobilityId": "3153054f4e37e2ce", "scanner": "scanner-primary", "fingerprint": "8103b947242b6ecb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-157dad63fe43f988", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/react-on-rails-pro-node-renderer/src/shared/rscPeerSupport.ts:19"}, "properties": {"repobilityId": "fdbbeedc78ece377", "scanner": "scanner-primary", "fingerprint": "157dad63fe43f988", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ad74ff8068b43764", "level": "none", "message": {"text": "Commented-code block (11 lines) in packages/react-on-rails-pro-node-renderer/src/shared/configBuilder.ts:60"}, "properties": {"repobilityId": "fed7797622d1aefc", "scanner": "scanner-primary", "fingerprint": "ad74ff8068b43764", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a04708c5ea86ce57", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/react-on-rails-pro-node-renderer/src/shared/tracing.ts:226"}, "properties": {"repobilityId": "6349a6f4b0b0f252", "scanner": "scanner-primary", "fingerprint": "a04708c5ea86ce57", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-18d0bedf3d9d7ffa", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/react-on-rails-pro-node-renderer/src/worker/vm.ts:236"}, "properties": {"repobilityId": "9408a9900ebbfb54", "scanner": "scanner-primary", "fingerprint": "18d0bedf3d9d7ffa", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9e6a1be8aefdf9ce", "level": "none", "message": {"text": "Commented-code block (8 lines) in packages/react-on-rails-pro-node-renderer/src/worker/handleIncrementalRenderStream.ts:190"}, "properties": {"repobilityId": "42b7c6261d0ee3e1", "scanner": "scanner-primary", "fingerprint": "9e6a1be8aefdf9ce", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e0c04519d8b0505c", "level": "none", "message": {"text": "Commented-code block (5 lines) in packages/react-on-rails-pro-node-renderer/src/worker/vmSourceMapSupport.ts:412"}, "properties": {"repobilityId": "1423bbbcada6228c", "scanner": "scanner-primary", "fingerprint": "e0c04519d8b0505c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4b74807b5ed6e57b", "level": "none", "message": {"text": "Commented-code block (6 lines) in analysis/rsc-fouc-shakaperf-artifacts/setup/config/abtests.config.ts:5"}, "properties": {"repobilityId": "881916ac023db443", "scanner": "scanner-primary", "fingerprint": "4b74807b5ed6e57b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-efdd3839341a75b8", "level": "none", "message": {"text": "Commented-code block (6 lines) in script/check-single-react-resolution.mjs:12"}, "properties": {"repobilityId": "3df69b0c1dec749d", "scanner": "scanner-primary", "fingerprint": "efdd3839341a75b8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-084994d77e9e8cda", "level": "none", "message": {"text": "Commented-code block (5 lines) in react_on_rails_pro/spec/dummy/playwright.config.ts:101"}, "properties": {"repobilityId": "f4736ebb394ecdd4", "scanner": "scanner-primary", "fingerprint": "084994d77e9e8cda", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d1b0c3196f7a14f1", "level": "none", "message": {"text": "Commented-code block (5 lines) in react_on_rails_pro/spec/dummy/client/app/strictModeSupport.tsx:107"}, "properties": {"repobilityId": "45f257604299429a", "scanner": "scanner-primary", "fingerprint": "d1b0c3196f7a14f1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-57b6bbd5b271199b", "level": "none", "message": {"text": "Commented-code block (7 lines) in react_on_rails_pro/spec/dummy/client/app/strictModeReactOnRailsProNode.js:16"}, "properties": {"repobilityId": "114bd9ee8239e145", "scanner": "scanner-primary", "fingerprint": "57b6bbd5b271199b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7b0851bcfc342a0a", "level": "none", "message": {"text": "Commented-code block (6 lines) in react_on_rails_pro/spec/dummy/client/app/components/HelloWorldHooksForServerComponents.jsx:18"}, "properties": {"repobilityId": "7e05b8d691da189d", "scanner": "scanner-primary", "fingerprint": "7b0851bcfc342a0a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1db2957ba33e1a17", "level": "none", "message": {"text": "Commented-code block (5 lines) in react_on_rails_pro/spec/dummy/client/app/components/RefetchStressPage.client.tsx:173"}, "properties": {"repobilityId": "37ea92fbded2fa72", "scanner": "scanner-primary", "fingerprint": "1db2957ba33e1a17", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a235d425db16c7bc", "level": "none", "message": {"text": "Commented-code block (10 lines) in react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/TanStackStarterApp.jsx:92"}, "properties": {"repobilityId": "94703ba3f73b9e1d", "scanner": "scanner-primary", "fingerprint": "a235d425db16c7bc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-69b91b8ee81cedfb", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/StreamAsyncComponents.jsx:32"}, "properties": {"repobilityId": "7db1eaad4628680a", "scanner": "scanner-primary", "fingerprint": "69b91b8ee81cedfb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3c614147af376c03", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/CacheDemoPage.jsx:273"}, "properties": {"repobilityId": "ced4d24636730bd8", "scanner": "scanner-primary", "fingerprint": "3c614147af376c03", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0ea22ac70741fc16", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/RSCPostsPageOverHTTP.jsx:21"}, "properties": {"repobilityId": "f6a21148eb2bd346", "scanner": "scanner-primary", "fingerprint": "0ea22ac70741fc16", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-dcef6f735527a8c3", "level": "none", "message": {"text": "Commented-code block (5 lines) in react_on_rails_pro/spec/dummy/client/app/loadable/loadable-client.imports-loadable.jsx:26"}, "properties": {"repobilityId": "a6c694cd7aec20ce", "scanner": "scanner-primary", "fingerprint": "dcef6f735527a8c3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fdf25af9c81a4902", "level": "none", "message": {"text": "Commented-code block (6 lines) in react_on_rails_pro/spec/dummy/config/webpack/development.js:29"}, "properties": {"repobilityId": "7ccc301df7b18478", "scanner": "scanner-primary", "fingerprint": "fdf25af9c81a4902", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3d20ab1fa77f45f9", "level": "none", "message": {"text": "Commented-code block (20 lines) in react_on_rails_pro/spec/dummy/config/webpack/rscManifestClientReferences.js:22"}, "properties": {"repobilityId": "e17984d7d64d67c3", "scanner": "scanner-primary", "fingerprint": "3d20ab1fa77f45f9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b1dcf72cb91c09e5", "level": "none", "message": {"text": "Commented-code block (6 lines) in react_on_rails_pro/spec/dummy/tests/rsc-manifest-client-references.test.js:18"}, "properties": {"repobilityId": "c1e03975146ef475", "scanner": "scanner-primary", "fingerprint": "b1dcf72cb91c09e5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d030f907173541a5", "level": "none", "message": {"text": "Commented-code block (6 lines) in react_on_rails_pro/spec/execjs-compatible-dummy/config/webpack/development.js:34"}, "properties": {"repobilityId": "58eea3ff452f8a0a", "scanner": "scanner-primary", "fingerprint": "d030f907173541a5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f1b0ae34485a1516", "level": "warning", "message": {"text": "Frontend route `A` has no Link/navigate to it \u2014 react_on_rails_pro/spec/dummy/client/app/components/Loadable/routes/Routes.jsx"}, "properties": {"repobilityId": "0d12bab4b24dbe50", "scanner": "scanner-primary", "fingerprint": "f1b0ae34485a1516", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-bc44f8b9aaec34a1", "level": "warning", "message": {"text": "Frontend route `B` has no Link/navigate to it \u2014 react_on_rails_pro/spec/dummy/client/app/components/Loadable/routes/Routes.jsx"}, "properties": {"repobilityId": "50580c8f765e723a", "scanner": "scanner-primary", "fingerprint": "bc44f8b9aaec34a1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-71ed33428a94878c", "level": "warning", "message": {"text": "Frontend route `/react_router/*` has no Link/navigate to it \u2014 react_on_rails/spec/dummy/client/app/routes/routes.tsx"}, "properties": {"repobilityId": "7925334b6665e977", "scanner": "scanner-primary", "fingerprint": "71ed33428a94878c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-7f8ea7c70a48dc3d", "level": "warning", "message": {"text": "Frontend route `simple-server` has no Link/navigate to it \u2014 react_on_rails_pro/spec/dummy/client/app/components/ServerComponentRouter.tsx"}, "properties": {"repobilityId": "a48c75f6b2c10db8", "scanner": "scanner-primary", "fingerprint": "7f8ea7c70a48dc3d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-cdd905bf9d611e42", "level": "warning", "message": {"text": "Frontend route `client-component` has no Link/navigate to it \u2014 react_on_rails_pro/spec/dummy/client/app/components/ServerComponentRouter.tsx"}, "properties": {"repobilityId": "29a868e80bbd12c5", "scanner": "scanner-primary", "fingerprint": "cdd905bf9d611e42", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-d83e40a01dd1774b", "level": "error", "message": {"text": "Dangling fetch: GET http://internal-api/greeting (react_on_rails/lib/generators/react_on_rails/templates/rsc/base/app/javascript/src/HelloServer/components/HelloServer.jsx:22)"}, "properties": {"repobilityId": "9b09634dba83c724", "scanner": "scanner-primary", "fingerprint": "d83e40a01dd1774b", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-952e2bea3f584eee", "level": "error", "message": {"text": "Dangling fetch: GET /test (packages/react-on-rails-pro/tests/utils.test.js:66)"}, "properties": {"repobilityId": "296f9b985337fd36", "scanner": "scanner-primary", "fingerprint": "952e2bea3f584eee", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-ab675afca2cbf51d", "level": "error", "message": {"text": "Dangling fetch: GET https://api.nationalize.io/?name=ReactOnRails (react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/ReactHelmetApp.server.jsx:35)"}, "properties": {"repobilityId": "c29325c0ebfef2ff", "scanner": "scanner-primary", "fingerprint": "ab675afca2cbf51d", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-60c7a9a15c72752d", "level": "error", "message": {"text": "Dangling fetch: GET https://jsonplaceholder.org/posts/1 (react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/StreamAsyncComponents.jsx:32)"}, "properties": {"repobilityId": "a34bf74d6a8d692a", "scanner": "scanner-primary", "fingerprint": "60c7a9a15c72752d", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-6a82528a9ac543e9", "level": "error", "message": {"text": "Dangling fetch: GET https://jsonplaceholder.org/comments/${commentId} (react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/StreamAsyncComponents.jsx:53)"}, "properties": {"repobilityId": "56738ef074fbf1db", "scanner": "scanner-primary", "fingerprint": "6a82528a9ac543e9", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-db4528b42c0a974d", "level": "error", "message": {"text": "Dangling fetch: GET http://localhost:3000/api/posts (react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/RSCPostsPageOverHTTP.jsx:21)"}, "properties": {"repobilityId": "e5cc2a6f55483916", "scanner": "scanner-primary", "fingerprint": "db4528b42c0a974d", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-dfbc56b424953128", "level": "error", "message": {"text": "Dangling fetch: GET http://localhost:3000/api/posts/${postId}/comments (react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/RSCPostsPageOverHTTP.jsx:26)"}, "properties": {"repobilityId": "d60543a02a7748c9", "scanner": "scanner-primary", "fingerprint": "dfbc56b424953128", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-47d220881fd162bd", "level": "error", "message": {"text": "Dangling fetch: GET http://localhost:3000/api/users/${userId} (react_on_rails_pro/spec/dummy/client/app/ror-auto-load-components/RSCPostsPageOverHTTP.jsx:31)"}, "properties": {"repobilityId": "70337cba08da8e59", "scanner": "scanner-primary", "fingerprint": "47d220881fd162bd", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-aff9993fc86aa43d", "level": "error", "message": {"text": "Dangling fetch: GET http://internal-api/greeting (react_on_rails/lib/generators/react_on_rails/templates/rsc/base/app/javascript/src/HelloServer/components/HelloServer.tsx:32)"}, "properties": {"repobilityId": "981b61f807348ff1", "scanner": "scanner-primary", "fingerprint": "aff9993fc86aa43d", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-df4588c2727b3476", "level": "note", "message": {"text": "Unused endpoint: POST /probe/unary"}, "properties": {"repobilityId": "b1cee8ed1be86d1a", "scanner": "scanner-primary", "fingerprint": "df4588c2727b3476", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9238524d7f9ab719", "level": "note", "message": {"text": "Unused endpoint: POST /probe/stream"}, "properties": {"repobilityId": "6a2ebd52b31a8b75", "scanner": "scanner-primary", "fingerprint": "9238524d7f9ab719", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4321271f647e2bd0", "level": "note", "message": {"text": "Unused endpoint: POST /contacts"}, "properties": {"repobilityId": "62af1414747177c7", "scanner": "scanner-primary", "fingerprint": "4321271f647e2bd0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8c236625afb6a8cb", "level": "note", "message": {"text": "Unused endpoint: GET /ready"}, "properties": {"repobilityId": "fa62d79bc04df473", "scanner": "scanner-primary", "fingerprint": "8c236625afb6a8cb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}