{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "MINED115", "name": "[MINED115] Action `mdeweerd/logToCheckStyle` pinned to mutable ref `@v2025.1.1`: `uses: mdeweerd/logToCheckStyle@v2025.1", "shortDescription": {"text": "[MINED115] Action `mdeweerd/logToCheckStyle` pinned to mutable ref `@v2025.1.1`: `uses: mdeweerd/logToCheckStyle@v2025.1.1` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/chan"}, "fullDescription": {"text": "Replace with: `uses: mdeweerd/logToCheckStyle@<40-char-sha>  # v2025.1.1` and let Dependabot bump it on a scheduled cadence."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "medium", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "MINED124", "name": "[MINED124] requirements.txt: `google-cloud-bigquery` has no version pin: Unpinned pip requirement means every fresh inst", "shortDescription": {"text": "[MINED124] requirements.txt: `google-cloud-bigquery` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Repr"}, "fullDescription": {"text": "Replace `google-cloud-bigquery` with `google-cloud-bigquery==<version>` and manage upgrades through PRs / Dependabot."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "medium", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "MINED111", "name": "[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or ", "shortDescription": {"text": "[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose."}, "fullDescription": {"text": "Either narrow the exception type, log the exception with `logger.exception(...)`, or re-raise after handling."}, "properties": {"scanner": "repobility-ast-engine", "category": "quality", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "JRN012", "name": "Runtime environment contract is missing referenced variables", "shortDescription": {"text": "Runtime environment contract is missing referenced variables"}, "fullDescription": {"text": "Add every required runtime variable to .env.example or deployment docs with safe placeholder values, then verify CI/deploy bootstraps from that contract."}, "properties": {"scanner": "repobility-journey-contract", "category": "quality", "severity": "medium", "confidence": 0.72, "cwe": "", "owasp": ""}}, {"id": "JRN011", "name": "Mutation journey appears local-only with no backend write", "shortDescription": {"text": "Mutation journey appears local-only with no backend write"}, "fullDescription": {"text": "Move the mutation into a backend/API/server action, handle failure states, and test the full write/read-back path against the real datastore."}, "properties": {"scanner": "repobility-journey-contract", "category": "quality", "severity": "medium", "confidence": 0.69, "cwe": "", "owasp": ""}}, {"id": "JRN010", "name": "Critical user action appears to be handled by a no-op or placeholder", "shortDescription": {"text": "Critical user action appears to be handled by a no-op or placeholder"}, "fullDescription": {"text": "Wire the action to a real backend mutation or remove/disable the control until it is implemented. Add an end-to-end or integration test that performs the action and observes persisted state."}, "properties": {"scanner": "repobility-journey-contract", "category": "quality", "severity": "medium", "confidence": 0.74, "cwe": "", "owasp": ""}}, {"id": "AUC001", "name": "[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobilit", "shortDescription": {"text": "[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation."}, "fullDescription": {"text": "Add .repobility/access.yml mapping routes to anonymous, authenticated, owner, admin, and super_admin. Keep business-specific rules in the repo so CI can enforce them."}, "properties": {"scanner": "repobility-access-control", "category": "auth", "severity": "medium", "confidence": 0.92, "cwe": "", "owasp": ""}}, {"id": "DKR001", "name": "Docker final stage has no non-root USER", "shortDescription": {"text": "Docker final stage has no non-root USER"}, "fullDescription": {"text": "Add a non-root USER in the final runtime stage after files and permissions are prepared."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "medium", "confidence": 0.82, "cwe": "", "owasp": ""}}, {"id": "DKR002", "name": "Dockerfile base image has no explicit tag", "shortDescription": {"text": "Dockerfile base image has no explicit tag"}, "fullDescription": {"text": "Pin the image to a supported version tag or digest, for example python:3.13-slim or image@sha256:..."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "medium", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "DKR014", "name": "Dockerfile copies broad context with incomplete .dockerignore", "shortDescription": {"text": "Dockerfile copies broad context with incomplete .dockerignore"}, "fullDescription": {"text": "Tighten .dockerignore or replace COPY . with explicit COPY statements."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "medium", "confidence": 0.76, "cwe": "", "owasp": ""}}, {"id": "DKR013", "name": "Dockerfile ADD downloads remote content", "shortDescription": {"text": "Dockerfile ADD downloads remote content"}, "fullDescription": {"text": "Use curl/wget with a pinned URL, verify checksum or signature, and prefer COPY for local files."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "medium", "confidence": 0.84, "cwe": "", "owasp": ""}}, {"id": "AGT015", "name": "Remote install command pipes network code directly to a shell", "shortDescription": {"text": "Remote install command pipes network code directly to a shell"}, "fullDescription": {"text": "Publish a package-manager install path or add checksum/signature verification before execution. For docs, show the inspect-then-run flow and pin the downloaded artifact version."}, "properties": {"scanner": "repobility-agent-runtime", "category": "dependency", "severity": "medium", "confidence": 0.7, "cwe": "", "owasp": ""}}, {"id": "AIC017", "name": "Shipping source still contains a stub implementation", "shortDescription": {"text": "Shipping source still contains a stub implementation"}, "fullDescription": {"text": "Replace the stub with real behavior, or remove the route/module from the active product surface until it is implemented and covered by a test."}, "properties": {"scanner": "repobility-ai-code-hygiene", "category": "quality", "severity": "medium", "confidence": 0.76, "cwe": "", "owasp": ""}}, {"id": "ERR001", "name": "[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG ", "shortDescription": {"text": "[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level."}, "fullDescription": {"text": "Log the error: `except Exception: logger.debug('cleanup failed', exc_info=True)`. Or handle specific exception types."}, "properties": {"scanner": "repobility-threat-engine", "category": "error_handling", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC136", "name": "[SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all exception block that silently returns ", "shortDescription": {"text": "[SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all exception block that silently returns success or no-ops. AI agents reach for this pattern when a flaky test or an unfamiliar API throws \u2014 wrap, swallow, retur"}, "fullDescription": {"text": "Catch the specific exception type, log at error level with full exception info, and return a failure-shaped result. If the operation is genuinely best-effort, log at warning and document why in a comment so the next reader (or scanner) knows."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC017", "name": "[SEC017] Unbounded Input to LLM/External API: User input is passed to an LLM or external AI API (OpenAI, Anthropic, etc.", "shortDescription": {"text": "[SEC017] Unbounded Input to LLM/External API: User input is passed to an LLM or external AI API (OpenAI, Anthropic, etc.) without any visible length or size validation. This creates two risks: (1) Cost abuse \u2014 an attacker can send extremely"}, "fullDescription": {"text": "1) Enforce a maximum input length BEFORE sending to the API: e.g. `if len(text) > 4000: return error`. 2) Use token counting (tiktoken for OpenAI, anthropic's token counter) to enforce token-level limits. 3) Set max_tokens on the API call to cap response cost. 4) Add rate limiting per user/IP to prevent automated abuse. 5) Monitor API spend with alerts for unusual usage patterns."}, "properties": {"scanner": "repobility-threat-engine", "category": "llm_injection", "severity": "medium", "confidence": 0.8, "cwe": "", "owasp": ""}}, {"id": "SEC005", "name": "[SEC005] Command Injection Risk: Unsafe shell execution or eval of user input.", "shortDescription": {"text": "[SEC005] Command Injection Risk: Unsafe shell execution or eval of user input."}, "fullDescription": {"text": "Use subprocess with shell=False and a list of args. Never eval user input."}, "properties": {"scanner": "repobility-threat-engine", "category": "injection", "severity": "medium", "confidence": 0.5, "cwe": "", "owasp": ""}}, {"id": "COMP001", "name": "[COMP001] High cognitive complexity: Function `_format_action` has cognitive complexity 18 (SonarSource scale). Cognitiv", "shortDescription": {"text": "[COMP001] High cognitive complexity: Function `_format_action` has cognitive complexity 18 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursio"}, "fullDescription": {"text": "Extract nested branches into named helper functions; flatten early-return / guard clauses; replace long if/elif chains with dispatch dicts or polymorphism. SonarQube's threshold for 'should refactor' is 15 \u2014 yours is 18."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "medium", "confidence": 0.95, "cwe": "", "owasp": ""}}, {"id": "MINED116", "name": "[MINED116] Workflow references `secrets.DOCKERHUB_USERNAME` in a `pull_request` workflow: `pull_request` workflows from ", "shortDescription": {"text": "[MINED116] Workflow references `secrets.DOCKERHUB_USERNAME` in a `pull_request` workflow: `pull_request` workflows from forks do not receive normal repository secrets, so `${ secrets.DOCKERHUB_USERNAME }` is usually empty for untrusted fork"}, "fullDescription": {"text": "If fork PRs need this check, split it into an untrusted test workflow and a trusted follow-up workflow after maintainer review. If only same-repository PRs should run it, add an explicit same-repo guard."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "low", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "DKR011", "name": "Dockerfile installs recommended OS packages", "shortDescription": {"text": "Dockerfile installs recommended OS packages"}, "fullDescription": {"text": "Add `--no-install-recommends` and explicitly list only packages the image needs."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "low", "confidence": 0.72, "cwe": "", "owasp": ""}}, {"id": "DKR010", "name": "Dockerfile leaves apt package indexes in the image layer", "shortDescription": {"text": "Dockerfile leaves apt package indexes in the image layer"}, "fullDescription": {"text": "End the apt install layer with `rm -rf /var/lib/apt/lists/*`."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "low", "confidence": 0.74, "cwe": "", "owasp": ""}}, {"id": "DKR008", "name": ".dockerignore misses sensitive defaults", "shortDescription": {"text": ".dockerignore misses sensitive defaults"}, "fullDescription": {"text": "Add missing patterns such as .env, .git, private keys, certificates, dependency folders, and local databases."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "low", "confidence": 0.72, "cwe": "", "owasp": ""}}, {"id": "AIC003", "name": "Duplicated implementation block across source files", "shortDescription": {"text": "Duplicated implementation block across source files"}, "fullDescription": {"text": "Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used."}, "properties": {"scanner": "repobility-ai-code-hygiene", "category": "quality", "severity": "low", "confidence": 0.86, "cwe": "", "owasp": ""}}, {"id": "SEC124", "name": "[SEC124] TOCTOU file access (os.access then open): Check-then-use file pattern (access/exists then open) lets an attacke", "shortDescription": {"text": "[SEC124] TOCTOU file access (os.access then open): Check-then-use file pattern (access/exists then open) lets an attacker swap the file between check and use (symlink attack). `mktemp` is deprecated for the same reason."}, "fullDescription": {"text": "Use `os.open(path, os.O_CREAT | os.O_EXCL | os.O_WRONLY)` for atomic create-only. Use `tempfile.NamedTemporaryFile()` (not `mktemp`). For locking, use `fcntl.flock`."}, "properties": {"scanner": "repobility-threat-engine", "category": "race_condition", "severity": "low", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED049", "name": "[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout.", "shortDescription": {"text": "[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-532 / A09:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC020", "name": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequen", "shortDescription": {"text": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for troubleshooting."}, "fullDescription": {"text": "Log only redacted, hashed, or last-four-style metadata. Rotate any secret that may have reached logs."}, "properties": {"scanner": "repobility-threat-engine", "category": "credential_exposure", "severity": "info", "confidence": 0.1, "cwe": "", "owasp": ""}}, {"id": "MINED090", "name": "[MINED090] Python Tempfile Mktemp: tempfile.mktemp() is deprecated due to TOCTOU race.", "shortDescription": {"text": "[MINED090] Python Tempfile Mktemp: tempfile.mktemp() is deprecated due to TOCTOU race."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-377 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED072", "name": "[MINED072] Python Pass Only Class: class Foo: pass \u2014 stub waiting to be filled in.", "shortDescription": {"text": "[MINED072] Python Pass Only Class: class Foo: pass \u2014 stub waiting to be filled in."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-1188 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED055", "name": "[MINED055] Npm Install No Lockfile: Production image runs npm install (resolves new versions on every build) instead of ", "shortDescription": {"text": "[MINED055] Npm Install No Lockfile: Production image runs npm install (resolves new versions on every build) instead of npm ci."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-1357 / A06:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED067", "name": "[MINED067] Python Requests No Timeout (and 3 more): Same pattern found in 3 additional files. Review if needed.", "shortDescription": {"text": "[MINED067] Python Requests No Timeout (and 3 more): Same pattern found in 3 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-400 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "SEC078", "name": "[SEC078] Python: requests without timeout (and 3 more): Same pattern found in 3 additional files. Review if needed.", "shortDescription": {"text": "[SEC078] Python: requests without timeout (and 3 more): Same pattern found in 3 additional files. Review if needed."}, "fullDescription": {"text": "Add `timeout=10` (or appropriate value) to every requests call."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED064", "name": "[MINED064] Python Input Call: input() blocks for stdin. Inappropriate in services.", "shortDescription": {"text": "[MINED064] Python Input Call: input() blocks for stdin. Inappropriate in services."}, "fullDescription": {"text": "Review and fix per the pattern semantics."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED006", "name": "[MINED006] Overcatch Baseexception (and 1 more): Same pattern found in 1 additional files. Review if needed.", "shortDescription": {"text": "[MINED006] Overcatch Baseexception (and 1 more): Same pattern found in 1 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-705 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED043", "name": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.", "shortDescription": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-319 / A02:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED050", "name": "[MINED050] Stub Only Function (and 8 more): Same pattern found in 8 additional files. Review if needed.", "shortDescription": {"text": "[MINED050] Stub Only Function (and 8 more): Same pattern found in 8 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-1188 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED001", "name": "[MINED001] Bare Except Pass (and 5 more): Same pattern found in 5 additional files. Review if needed.", "shortDescription": {"text": "[MINED001] Bare Except Pass (and 5 more): Same pattern found in 5 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-755 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "SEC128", "name": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake) (and 5 more): Same pattern found in 5 addit", "shortDescription": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake) (and 5 more): Same pattern found in 5 additional files. Review if needed."}, "fullDescription": {"text": "Add `await` before each async call, or chain with `.then`. If you intentionally want fire-and-forget, prefix with `void` (TS) or assign to `_` (Python with `asyncio.create_task`) to make the intent explicit and survive lint."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED118", "name": "[MINED118] Dockerfile FROM `python:3.12-slim-bookworm` not pinned by digest: `FROM python:3.12-slim-bookworm` resolves t", "shortDescription": {"text": "[MINED118] Dockerfile FROM `python:3.12-slim-bookworm` not pinned by digest: `FROM python:3.12-slim-bookworm` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially differe"}, "fullDescription": {"text": "Replace with: `FROM python:3.12-slim-bookworm@sha256:<digest>`. Get the digest from `docker manifest inspect`. Re-pin via a scheduled bot (Renovate, Dependabot)."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "high", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "MINED119", "name": "[MINED119] Dockerfile `ADD https://sh.rustup.rs`: Dockerfile `ADD <url>` downloads a remote artifact into the image with", "shortDescription": {"text": "[MINED119] Dockerfile `ADD https://sh.rustup.rs`: Dockerfile `ADD <url>` downloads a remote artifact into the image with no integrity check. If the host or DNS is compromised between layers \u2014 or if the URL serves a different file later \u2014 ma"}, "fullDescription": {"text": "Download the file in CI with a known checksum, vendor it into the repo, and COPY it during the build. Or use `RUN curl -sSL URL | sha256sum -c <(echo '<expected> -')` to verify."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "high", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "MINED131", "name": "[MINED131] pre-commit hook `https://github.com/codespell-project/codespell` pinned to mutable rev `v2.2.6`: `.pre-commit", "shortDescription": {"text": "[MINED131] pre-commit hook `https://github.com/codespell-project/codespell` pinned to mutable rev `v2.2.6`: `.pre-commit-config.yaml` references `https://github.com/codespell-project/codespell` at `rev: v2.2.6`. If `{rev}` is a branch or ve"}, "fullDescription": {"text": "Pin to a commit SHA: `rev: <40-char-sha>` and bump it through `pre-commit autoupdate` (which writes to PRs that are reviewed)."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "high", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "MINED112", "name": "[MINED112] FastAPI PATCH webbrowser.open has no auth: Handler `test_git_index_version_greater_than_2` is registered with", "shortDescription": {"text": "[MINED112] FastAPI PATCH webbrowser.open has no auth: Handler `test_git_index_version_greater_than_2` is registered with router/app.patch(...) but no Depends/Security parameter is declared and no auth marker appears in the function body."}, "fullDescription": {"text": "Add Depends(get_current_user) or Security(...) to the handler signature. If the route is truly public, document it with a code comment so the rule knows it's intentional."}, "properties": {"scanner": "repobility-route-auth", "category": "quality", "severity": "high", "confidence": 0.8, "cwe": "", "owasp": ""}}, {"id": "MINED106", "name": "[MINED106] Phantom test coverage: test_architect_coder_auto_accept_false_rejected: Test function `test_architect_coder_a", "shortDescription": {"text": "[MINED106] Phantom test coverage: test_architect_coder_auto_accept_false_rejected: Test function `test_architect_coder_auto_accept_false_rejected` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. "}, "fullDescription": {"text": "Add an explicit assertion that captures the test's intent, or remove the test."}, "properties": {"scanner": "repobility-ast-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED108", "name": "[MINED108] `self.messages` used but never assigned in __init__: Method `info` of class `GUI` reads `self.messages`, but ", "shortDescription": {"text": "[MINED108] `self.messages` used but never assigned in __init__: Method `info` of class `GUI` reads `self.messages`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the meth"}, "fullDescription": {"text": "Initialize `self.messages = <default>` in __init__, or add a class-level default."}, "properties": {"scanner": "repobility-ast-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "DKR006", "name": "Dockerfile pipes a remote script into a shell", "shortDescription": {"text": "Dockerfile pipes a remote script into a shell"}, "fullDescription": {"text": "Download the artifact, verify its checksum or signature, pin the version, and then execute it."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "high", "confidence": 0.92, "cwe": "", "owasp": ""}}, {"id": "SEC013", "name": "[SEC013] Path Traversal \u2014 User Input in File Path: User-controlled input used in file path without sanitization. Allows ", "shortDescription": {"text": "[SEC013] Path Traversal \u2014 User Input in File Path: User-controlled input used in file path without sanitization. Allows reading arbitrary files."}, "fullDescription": {"text": "Use os.path.realpath() and verify the path starts with your expected base directory. Use secure_filename() for uploads."}, "properties": {"scanner": "repobility-threat-engine", "category": "path_traversal", "severity": "high", "confidence": 0.8, "cwe": "", "owasp": ""}}, {"id": "SEC103", "name": "[SEC103] LDAP injection \u2014 non-constant search filter: User input concatenated into an LDAP search filter. Attackers inje", "shortDescription": {"text": "[SEC103] LDAP injection \u2014 non-constant search filter: User input concatenated into an LDAP search filter. Attackers inject `*)(uid=*` style payloads to bypass auth or enumerate accounts."}, "fullDescription": {"text": "Escape with javax.naming.ldap.Rdn.escapeValue or equivalent. For python-ldap, use ldap.filter.escape_filter_chars. Better: use parameterized search APIs (Spring LdapTemplate filter encoders)."}, "properties": {"scanner": "repobility-threat-engine", "category": "injection", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC029", "name": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled ", "shortDescription": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes e"}, "fullDescription": {"text": "Validate the URL against an allowlist BEFORE fetching:\n  ALLOWED = {'images.example.com', 'cdn.example.com'}\n  host = urlparse(url).hostname\n  if host not in ALLOWED: abort(400)\nOr use a server-side proxy (Imgproxy / serve-files-only-from-S3) that isolates outbound network access from the request handler.\nBlock private CIDRs explicitly: 10/8, 172.16/12, 192.168/16, 169.254/16."}, "properties": {"scanner": "repobility-threat-engine", "category": "ssrf", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC032", "name": "[SEC032] Unrestricted File Upload \u2014 no extension/MIME validation: File upload accepts the user's filename without valida", "shortDescription": {"text": "[SEC032] Unrestricted File Upload \u2014 no extension/MIME validation: File upload accepts the user's filename without validating extension, content-type, or magic bytes. Attackers upload `.php`, `.jsp`, or executable files to a web-served direc"}, "fullDescription": {"text": "Validate THREE things server-side:\n  1. Extension allowlist:\n       ALLOWED = {'.png', '.jpg', '.pdf'}\n       ext = Path(file.filename).suffix.lower()\n       if ext not in ALLOWED: abort(400)\n  2. Magic-byte check (don't trust the extension):\n       import magic\n       mime = magic.from_buffer(file.read(2048), mime=True)\n  3. Save with a random/UUID filename to a non-executable directory.\nSanitize with `werkzeug.secure_filename`. Never reuse the user's name."}, "properties": {"scanner": "repobility-threat-engine", "category": "file_upload", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC016", "name": "[SEC016] LLM Prompt Injection \u2014 User Input in AI Prompt: User-supplied text is interpolated directly into an AI/LLM prom", "shortDescription": {"text": "[SEC016] LLM Prompt Injection \u2014 User Input in AI Prompt: User-supplied text is interpolated directly into an AI/LLM prompt (e.g. OpenAI, Anthropic, or local model). This is the AI equivalent of SQL injection: an attacker can craft input tha"}, "fullDescription": {"text": "1) Separate user content from instructions: use the 'user' role for user text and 'system' role for your instructions \u2014 never concatenate them into one string. 2) Validate and constrain: limit input length, strip control characters, and reject known injection patterns. 3) Use structured output (JSON mode / function calling) so the model returns data, not freeform actions. 4) Apply output validation: check the AI's response before acting on it. 5) Consider a prompt injection detection layer (e.g. Anthropic's constitutional AI, prompt-guard models)."}, "properties": {"scanner": "repobility-threat-engine", "category": "llm_injection", "severity": "high", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "MINED034", "name": "[MINED034] Python Subprocess Shell True: subprocess(..., shell=True) enables command injection.", "shortDescription": {"text": "[MINED034] Python Subprocess Shell True: subprocess(..., shell=True) enables command injection."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-78 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED107", "name": "[MINED107] Missing import: `io` used but not imported: The file uses `io.something(...)` but never imports `io`. This ra", "shortDescription": {"text": "[MINED107] Missing import: `io` used but not imported: The file uses `io.something(...)` but never imports `io`. This raises NameError at runtime the first time the line executes."}, "fullDescription": {"text": "Add `import io` at the top of the file."}, "properties": {"scanner": "repobility-ast-engine", "category": "quality", "severity": "critical", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC002", "name": "[SEC002] Hardcoded API Key: Hardcoded API key found in source code.", "shortDescription": {"text": "[SEC002] Hardcoded API Key: Hardcoded API key found in source code."}, "fullDescription": {"text": "Use environment variables. Add the pattern to .gitignore."}, "properties": {"scanner": "repobility-threat-engine", "category": "credential_exposure", "severity": "critical", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "scanner-90c4c5de3f6f35c3", "name": "Possibly dead Python function: format_html_table", "shortDescription": {"text": "Possibly dead Python function: format_html_table"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-670c8345b8bea9c0", "name": "Possibly dead Python function: verify_refactor", "shortDescription": {"text": "Possibly dead Python function: verify_refactor"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d083c3238fc5d54", "name": "Possibly dead Python function: visit_FunctionDef", "shortDescription": {"text": "Possibly dead Python function: visit_FunctionDef"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-79f5f5902d9e8ce0", "name": "Possibly dead Python function: visit_ClassDef", "shortDescription": {"text": "Possibly dead Python function: visit_ClassDef"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1114f1dcf0aeedbb", "name": "Possibly dead Python function: plot_timing", "shortDescription": {"text": "Possibly dead Python function: plot_timing"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2b9d7adb6c7cff59", "name": "Possibly dead Python function: plot_outcomes", "shortDescription": {"text": "Possibly dead Python function: plot_outcomes"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e9f4771e7e0f313", "name": "Possibly dead Python function: plot_outcomes_claude", "shortDescription": {"text": "Possibly dead Python function: plot_outcomes_claude"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd0888c954558c05", "name": "Possibly dead Python function: completions_model", "shortDescription": {"text": "Possibly dead Python function: completions_model"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-73c8f6db8de37afc", "name": "Possibly dead Python function: cmd_models", "shortDescription": {"text": "Possibly dead Python function: cmd_models"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a51513ad43ff1b29", "name": "Possibly dead Python function: cmd_clear", "shortDescription": {"text": "Possibly dead Python function: cmd_clear"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-658333bd2474c33c", "name": "Possibly dead Python function: completions_drop", "shortDescription": {"text": "Possibly dead Python function: completions_drop"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb3413faa46971d4", "name": "Possibly dead Python function: cmd_quit", "shortDescription": {"text": "Possibly dead Python function: cmd_quit"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c967614df14406d4", "name": "Possibly dead Python function: cmd_ls", "shortDescription": {"text": "Possibly dead Python function: cmd_ls"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-00ef868ec87f1dcc", "name": "Possibly dead Python function: completions_ask", "shortDescription": {"text": "Possibly dead Python function: completions_ask"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-64f725840b9880e9", "name": "Possibly dead Python function: completions_code", "shortDescription": {"text": "Possibly dead Python function: completions_code"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bc72ae7ee16733d1", "name": "Possibly dead Python function: completions_architect", "shortDescription": {"text": "Possibly dead Python function: completions_architect"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5f5abdb6cae0e3d0", "name": "Possibly dead Python function: completions_context", "shortDescription": {"text": "Possibly dead Python function: completions_context"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7b126a078081499d", "name": "Possibly dead Python function: cmd_architect", "shortDescription": {"text": "Possibly dead Python function: cmd_architect"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c83852ba983ee563", "name": "Possibly dead Python function: cmd_context", "shortDescription": {"text": "Possibly dead Python function: cmd_context"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e0d1e37b679b1b8e", "name": "Possibly dead Python function: cmd_ok", "shortDescription": {"text": "Possibly dead Python function: cmd_ok"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a6e8e9bfac3ef24", "name": "Possibly dead Python function: cmd_voice", "shortDescription": {"text": "Possibly dead Python function: cmd_voice"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-042aec5933fbbe7d", "name": "Possibly dead Python function: cmd_paste", "shortDescription": {"text": "Possibly dead Python function: cmd_paste"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f99e1b7709e5aa5d", "name": "Possibly dead Python function: cmd_map", "shortDescription": {"text": "Possibly dead Python function: cmd_map"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a9e171267a76679", "name": "Possibly dead Python function: cmd_map_refresh", "shortDescription": {"text": "Possibly dead Python function: cmd_map_refresh"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ebefaf14fe543795", "name": "Possibly dead Python function: cmd_settings", "shortDescription": {"text": "Possibly dead Python function: cmd_settings"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d9d4a4e2e98ffa19", "name": "Stray `console.log` in TS/JS \u2014 tests/fixtures/languages/typescript/test.ts:2", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 tests/fixtures/languages/typescript/test.ts:2"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f7aed018ca948d6b", "name": "Stray `console.log` in TS/JS \u2014 tests/fixtures/sample-code-base/sample.js:44", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 tests/fixtures/sample-code-base/sample.js:44"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-90333cd113206beb", "name": "Stray `console.log` in TS/JS \u2014 aider/website/_includes/recording.js:235", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 aider/website/_includes/recording.js:235"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-078e7138cf4a39f3", "name": "insecure hash algorithm sha1 \u2014 aider/coders/base_coder.py:1874", "shortDescription": {"text": "insecure hash algorithm sha1 \u2014 aider/coders/base_coder.py:1874"}, "fullDescription": {"text": "Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\nRule: python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1\nSeverity: WARNING\nOWASP: A03:2017 - Sensitive Data Exposure, A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c41e2901a31411e2", "name": "subprocess shell true \u2014 aider/commands.py:980", "shortDescription": {"text": "subprocess shell true \u2014 aider/commands.py:980"}, "fullDescription": {"text": "Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.\n\nRule: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true\nSeverity: ERROR\nOWASP: A01:2017 - Injection, A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-f7f30b3426397256", "name": "subprocess shell true \u2014 aider/editor.py:134", "shortDescription": {"text": "subprocess shell true \u2014 aider/editor.py:134"}, "fullDescription": {"text": "Found 'subprocess' function 'call' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.\n\nRule: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true\nSeverity: ERROR\nOWASP: A01:2017 - Injection, A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-fd9e4020ff0582f8", "name": "subprocess shell true \u2014 aider/io.py:1094", "shortDescription": {"text": "subprocess shell true \u2014 aider/io.py:1094"}, "fullDescription": {"text": "Found 'subprocess' function 'run' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.\n\nRule: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true\nSeverity: ERROR\nOWASP: A01:2017 - Injection, A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-93969fd5069f5609", "name": "insecure hash algorithm sha1 \u2014 aider/models.py:1019", "shortDescription": {"text": "insecure hash algorithm sha1 \u2014 aider/models.py:1019"}, "fullDescription": {"text": "Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\nRule: python.lang.security.insecure-hash-algorithms.insecure-hash-algorithm-sha1\nSeverity: WARNING\nOWASP: A03:2017 - Sensitive Data Exposure, A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-09d6f0961d82ed98", "name": "subprocess shell true \u2014 aider/run_cmd.py:67", "shortDescription": {"text": "subprocess shell true \u2014 aider/run_cmd.py:67"}, "fullDescription": {"text": "Found 'subprocess' function 'Popen' with 'shell=True'. This is dangerous because this call will spawn the command using a shell process. Doing so propagates current shell settings and variables, which makes it much easier for a malicious actor to execute commands. Use 'shell=False' instead.\n\nRule: python.lang.security.audit.subprocess-shell-true.subprocess-shell-true\nSeverity: ERROR\nOWASP: A01:2017 - Injection, A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-a97424df32be8949", "name": "var in href \u2014 aider/website/_layouts/redirect.html:9", "shortDescription": {"text": "var in href \u2014 aider/website/_layouts/redirect.html:9"}, "fullDescription": {"text": "Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href=\"/{{link}}\"`). You may also consider setting the Content Security Policy (CSP) header.\n\nRule: generic.html-templates.security.var-in-href.var-in-href\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-52cb3cf77d231eb2", "name": "var in href \u2014 aider/website/blog/index.html:13", "shortDescription": {"text": "var in href \u2014 aider/website/blog/index.html:13"}, "fullDescription": {"text": "Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href=\"/{{link}}\"`). You may also consider setting the Content Security Policy (CSP) header.\n\nRule: generic.html-templates.security.var-in-href.var-in-href\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-36b15f69f3189be0", "name": "var in href \u2014 aider/website/blog/index.html:22", "shortDescription": {"text": "var in href \u2014 aider/website/blog/index.html:22"}, "fullDescription": {"text": "Detected a template variable used in an anchor tag with the 'href' attribute. This allows a malicious actor to input the 'javascript:' URI and is subject to cross- site scripting (XSS) attacks. If using Flask, use 'url_for()' to safely generate a URL. If using Django, use the 'url' filter to safely generate a URL. If using Mustache, use a URL encoding library, or prepend a slash '/' to the variable for relative links (`href=\"/{{link}}\"`). You may also consider setting the Content Security Policy (CSP) header.\n\nRule: generic.html-templates.security.var-in-href.var-in-href\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fb6458945e3e7ee7", "name": "CVE-2026-22815: aiohttp 3.13.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-22815: aiohttp 3.13.3 \u2014 requirements.txt"}, "fullDescription": {"text": "aiohttp: AIOHTTP: Denial of Service via insufficient header/trailer handling\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, insufficient restrictions in header/trailer handling could cause uncapped memory usage. This issue has been patched in version 3.13.4.\n\nPackage: aiohttp\nInstalled: 3.13.3\nFixed in: 3.13.4\nSeverity: MEDIUM\nFix: Upgrade aiohttp to 3.13.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2ba1f4d7c9340479", "name": "CVE-2026-34515: aiohttp 3.13.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-34515: aiohttp 3.13.3 \u2014 requirements.txt"}, "fullDescription": {"text": "aiohttp: AIOHTTP: Information disclosure via static resource handler on Windows\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, on Windows the static resource handler may expose information about a NTLMv2 remote path. This issue has been patched in version 3.13.4.\n\nPackage: aiohttp\nInstalled: 3.13.3\nFixed in: 3.13.4\nSeverity: MEDIUM\nFix: Upgrade aiohttp to 3.13.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c5e907a7a507db34", "name": "CVE-2026-34516: aiohttp 3.13.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-34516: aiohttp 3.13.3 \u2014 requirements.txt"}, "fullDescription": {"text": "aiohttp: AIOHTTP: Denial of Service via excessive multipart headers\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, a response with an excessive number of multipart headers may be allowed to use more memory than intended, potentially allowing a DoS vulnerability. This issue has been patched in version 3.13.4.\n\nPackage: aiohttp\nInstalled: 3.13.3\nFixed in: 3.13.4\nSeverity: MEDIUM\nFix: Upgrade aiohttp to 3.13.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-55b83843f71a31d9", "name": "CVE-2026-34525: aiohttp 3.13.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-34525: aiohttp 3.13.3 \u2014 requirements.txt"}, "fullDescription": {"text": "aiohttp: aiohttp: Security bypass via multiple Host headers\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, multiple Host headers were allowed in aiohttp. This issue has been patched in version 3.13.4.\n\nPackage: aiohttp\nInstalled: 3.13.3\nFixed in: 3.13.4\nSeverity: MEDIUM\nFix: Upgrade aiohttp to 3.13.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4f8641da79843ec6", "name": "CVE-2026-34993: aiohttp 3.13.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-34993: aiohttp 3.13.3 \u2014 requirements.txt"}, "fullDescription": {"text": "aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's own data, so this is unlikely to affect many applications. Version 3.14.0 patches the issue. If an application does allow attacker controlled files to be loaded, a workaround on older releases would be to sanitize the files before loading.\n\nPackage: aiohttp\nInstalled: 3.13.3\nFixed in: 3.14.0\nSeverity: MEDIUM\nFix: Upgrade aiohttp to 3.14.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-93f1d137fb24bb86", "name": "CVE-2026-47265: aiohttp 3.13.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-47265: aiohttp 3.13.3 \u2014 requirements.txt"}, "fullDescription": {"text": "python-aiohttp: AIOHTTP: Information disclosure via improper handling of cookies during cross-origin redirects\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect. If a developer uses the `cookies` parameter on a per-request basis then sensitive data might be leaked to an attacker if they manage to control a redirect. Version 3.14.0 patches the issue. If unable to upgrade, using a `Cookie` header in the `headers` parameter is not vulnerable.\n\nPackage: aiohttp\nInstalled: 3.13.3\nFixed in: 3.14.0\nSeverity: MEDIUM\nFix: Upgrade aiohttp to 3.14.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2cf4bfe1890e5248", "name": "CVE-2026-54273: aiohttp 3.13.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-54273: aiohttp 3.13.3 \u2014 requirements.txt"}, "fullDescription": {"text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, no limit was present on the number of pipelined requests that could be queued. An attacker may be able to use pipelined requests to use excessive amounts of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.\n\nPackage: aiohttp\nInstalled: 3.13.3\nFixed in: 3.14.1\nSeverity: MEDIUM\nFix: Upgrade aiohttp to 3.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3b6d363b19eea21d", "name": "CVE-2026-54274: aiohttp 3.13.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-54274: aiohttp 3.13.3 \u2014 requirements.txt"}, "fullDescription": {"text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1.\n\nPackage: aiohttp\nInstalled: 3.13.3\nFixed in: 3.14.1\nSeverity: MEDIUM\nFix: Upgrade aiohttp to 3.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b1d66d79c25168fc", "name": "CVE-2026-54276: aiohttp 3.13.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-54276: aiohttp 3.13.3 \u2014 requirements.txt"}, "fullDescription": {"text": "aiohttp: aiohttp: Information disclosure via DigestAuthMiddleware after cross-origin redirect\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, DigestAuthMiddleware can send an authentication response after following a cross-origin redirect. This likely requires an open redirect vulnerability or similar on the target domain for an attacker to be able to execute. Further, the attacker is only receiving the digest, so should only be able to extract the user's credentials if the cryptography is weak or there is some kind of password reuse. This\n\nPackage: aiohttp\nInstalled: 3.13.3\nFixed in: 3.14.1\nSeverity: MEDIUM\nFix: Upgrade aiohttp to 3.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4787b93a9efe9769", "name": "CVE-2026-54277: aiohttp 3.13.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-54277: aiohttp 3.13.3 \u2014 requirements.txt"}, "fullDescription": {"text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1.\n\nPackage: aiohttp\nInstalled: 3.13.3\nFixed in: 3.14.1\nSeverity: MEDIUM\nFix: Upgrade aiohttp to 3.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ce4af4bd4d841d68", "name": "CVE-2026-54278: aiohttp 3.13.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-54278: aiohttp 3.13.3 \u2014 requirements.txt"}, "fullDescription": {"text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case). This vulnerability is fixed in 3.14.1.\n\nPackage: aiohttp\nInstalled: 3.13.3\nFixed in: 3.14.1\nSeverity: MEDIUM\nFix: Upgrade aiohttp to 3.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7bd9a6eef3a6f81b", "name": "CVE-2026-34513: aiohttp 3.13.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-34513: aiohttp 3.13.3 \u2014 requirements.txt"}, "fullDescription": {"text": "aiohttp: AIOHTTP: Denial of Service due to unbounded DNS cache\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an unbounded DNS cache could result in excessive memory usage possibly resulting in a DoS situation. This issue has been patched in version 3.13.4.\n\nPackage: aiohttp\nInstalled: 3.13.3\nFixed in: 3.13.4\nSeverity: LOW\nFix: Upgrade aiohttp to 3.13.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5b703fa1279a4436", "name": "CVE-2026-34514: aiohttp 3.13.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-34514: aiohttp 3.13.3 \u2014 requirements.txt"}, "fullDescription": {"text": "aiohttp: AIOHTTP: Header Injection via content_type parameter manipulation\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the content_type parameter in aiohttp could use this to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.\n\nPackage: aiohttp\nInstalled: 3.13.3\nFixed in: 3.13.4\nSeverity: LOW\nFix: Upgrade aiohttp to 3.13.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0bcf8000d92d34c6", "name": "CVE-2026-34517: aiohttp 3.13.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-34517: aiohttp 3.13.3 \u2014 requirements.txt"}, "fullDescription": {"text": "aiohttp: AIOHTTP: Denial of Service via large multipart form fields\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, for some multipart form fields, aiohttp read the entire field into memory before checking client_max_size. This issue has been patched in version 3.13.4.\n\nPackage: aiohttp\nInstalled: 3.13.3\nFixed in: 3.13.4\nSeverity: LOW\nFix: Upgrade aiohttp to 3.13.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fe20a62f9fa99db2", "name": "CVE-2026-34518: aiohttp 3.13.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-34518: aiohttp 3.13.3 \u2014 requirements.txt"}, "fullDescription": {"text": "aiohttp: AIOHTTP: Information disclosure via retained Cookie and Proxy-Authorization headers during redirects\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, when following redirects to a different origin, aiohttp drops the Authorization header, but retains the Cookie and Proxy-Authorization headers. This issue has been patched in version 3.13.4.\n\nPackage: aiohttp\nInstalled: 3.13.3\nFixed in: 3.13.4\nSeverity: LOW\nFix: Upgrade aiohttp to 3.13.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ae899c9e6e96212f", "name": "CVE-2026-34519: aiohttp 3.13.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-34519: aiohttp 3.13.3 \u2014 requirements.txt"}, "fullDescription": {"text": "aiohttp: aiohttp: Header injection vulnerability via reason parameter\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, an attacker who controls the reason parameter when creating a Response may be able to inject extra headers or similar exploits. This issue has been patched in version 3.13.4.\n\nPackage: aiohttp\nInstalled: 3.13.3\nFixed in: 3.13.4\nSeverity: LOW\nFix: Upgrade aiohttp to 3.13.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b1bb3749cf13bd8b", "name": "CVE-2026-34520: aiohttp 3.13.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-34520: aiohttp 3.13.3 \u2014 requirements.txt"}, "fullDescription": {"text": "aiohttp: AIOHTTP: Header injection vulnerability due to improper character handling\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.13.4, the C parser (the default for most installs) accepted null bytes and control characters in response headers. This issue has been patched in version 3.13.4.\n\nPackage: aiohttp\nInstalled: 3.13.3\nFixed in: 3.13.4\nSeverity: LOW\nFix: Upgrade aiohttp to 3.13.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7d56839ac23fd70a", "name": "CVE-2026-50269: aiohttp 3.13.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-50269: aiohttp 3.13.3 \u2014 requirements.txt"}, "fullDescription": {"text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerabi\n\nPackage: aiohttp\nInstalled: 3.13.3\nFixed in: 3.14.0\nSeverity: LOW\nFix: Upgrade aiohttp to 3.14.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0b78c203142e7c77", "name": "CVE-2026-54275: aiohttp 3.13.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-54275: aiohttp 3.13.3 \u2014 requirements.txt"}, "fullDescription": {"text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. If an application makes multiple requests to the same domain, but with different per-request server_hostname parameters, then the later calls may succeed by reusing the existing connection when they should have been rejected due to the TLS SNI check. This vulnerability is fixed in 3.14.1.\n\nPackage: aiohttp\nInstalled: 3.13.3\nFixed in: 3.14.1\nSeverity: LOW\nFix: Upgrade aiohttp to 3.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b157eca11d8b8c1f", "name": "CVE-2026-54279: aiohttp 3.13.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-54279: aiohttp 3.13.3 \u2014 requirements.txt"}, "fullDescription": {"text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1.\n\nPackage: aiohttp\nInstalled: 3.13.3\nFixed in: 3.14.1\nSeverity: LOW\nFix: Upgrade aiohttp to 3.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6c8739a9e223f5fb", "name": "CVE-2026-54280: aiohttp 3.13.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-54280: aiohttp 3.13.3 \u2014 requirements.txt"}, "fullDescription": {"text": "AIOHTTP is an asynchronous HTTP client/server framework for asyncio an ...\n\nAIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, payload resources are not closed correctly when a client disconnects in the middle of a write. If a payload is using an open file or similar limited resource, then an attacker may be able to cause resource starvation temporarily until garbage collection or similar closes the file. This vulnerability is fixed in 3.14.1.\n\nPackage: aiohttp\nInstalled: 3.13.3\nFixed in: 3.14.1\nSeverity: LOW\nFix: Upgrade aiohttp to 3.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-887af60284e1d277", "name": "CVE-2025-69872: diskcache 5.6.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2025-69872: diskcache 5.6.3 \u2014 requirements.txt"}, "fullDescription": {"text": "python-diskcache: python-diskcache: Arbitrary code execution via insecure pickle deserialization\n\nDiskCache (python-diskcache) through 5.6.3 uses Python pickle for serialization by default. An attacker with write access to the cache directory can achieve arbitrary code execution when a victim application reads from the cache.\n\nPackage: diskcache\nInstalled: 5.6.3\nFixed in: \u2014\nSeverity: MEDIUM\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4dc647726cd3bf87", "name": "CVE-2026-42215: gitpython 3.1.46 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-42215: gitpython 3.1.46 \u2014 requirements.txt"}, "fullDescription": {"text": "GitPython is a python library used to interact with Git repositories.  ...\n\nGitPython is a python library used to interact with Git repositories. From version 3.1.30 to before version 3.1.47, GitPython blocks dangerous Git options such as --upload-pack and --receive-pack by default, but the equivalent Python kwargs upload_pack and receive_pack bypass that check. If an application passes attacker-controlled kwargs into Repo.clone_from(), Remote.fetch(), Remote.pull(), or Remote.push(), this leads to arbitrary command execution even when allow_unsafe_options is left at it\n\nPackage: gitpython\nInstalled: 3.1.46\nFixed in: 3.1.47\nSeverity: HIGH\nFix: Upgrade gitpython to 3.1.47"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8ac190a0625e2295", "name": "CVE-2026-42284: gitpython 3.1.46 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-42284: gitpython 3.1.46 \u2014 requirements.txt"}, "fullDescription": {"text": "GitPython is a python library used to interact with Git repositories.  ...\n\nGitPython is a python library used to interact with Git repositories. Prior to version 3.1.47, _clone() validates multi_options as the original list, then executes shlex.split(\" \".join(multi_options)). A string like \"--branch main --config core.hooksPath=/x\" passes validation (starts with --branch), but after split becomes [\"--branch\", \"main\", \"--config\", \"core.hooksPath=/x\"]. Git applies the config and executes attacker hooks during clone. This issue has been patched in version 3.1.47.\n\nPackage: gitpython\nInstalled: 3.1.46\nFixed in: 3.1.47\nSeverity: HIGH\nFix: Upgrade gitpython to 3.1.47"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-48ff175feafdb745", "name": "CVE-2026-44243: gitpython 3.1.46 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-44243: gitpython 3.1.46 \u2014 requirements.txt"}, "fullDescription": {"text": "GitPython: GitPython: Arbitrary file write via crafted reference paths\n\nGitPython is a python library used to interact with Git repositories. Prior to version 3.1.48, a vulnerability in GitPython allows attackers who can supply a crafted reference path to an application using GitPython to write, overwrite, move, or delete files outside the repository\u2019s .git directory via insufficient validation of reference paths in reference creation, rename, and delete operations. This issue has been patched in version 3.1.48.\n\nPackage: gitpython\nInstalled: 3.1.46\nFixed in: 3.1.48\nSeverity: HIGH\nFix: Upgrade gitpython to 3.1.48"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-46a28fc36eae6692", "name": "CVE-2026-44244: gitpython 3.1.46 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-44244: gitpython 3.1.46 \u2014 requirements.txt"}, "fullDescription": {"text": "GitPython is a python library used to interact with Git repositories.  ...\n\nGitPython is a python library used to interact with Git repositories. Prior to version 3.1.49, GitConfigParser.set_value() passes values to Python's configparser without validating for newlines. GitPython's own _write() converts embedded newlines into indented continuation lines (e.g. \\n becomes \\n\\t), but Git still accepts an indented [core] stanza as a section header \u2014 so the injected core.hooksPath becomes effective configuration. Any Git operation that invokes hooks (commit, merge, checkout)\n\nPackage: gitpython\nInstalled: 3.1.46\nFixed in: 3.1.49\nSeverity: HIGH\nFix: Upgrade gitpython to 3.1.49"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e446211864f541f2", "name": "GHSA-mv93-w799-cj2w: gitpython 3.1.46 \u2014 requirements.txt", "shortDescription": {"text": "GHSA-mv93-w799-cj2w: gitpython 3.1.46 \u2014 requirements.txt"}, "fullDescription": {"text": "GitPython: Newline injection in config_writer() section parameter bypasses CVE-2026-42215 patch, enabling RCE via core.hooksPath\n\nSummary\n\nThe patch for CVE-2026-42215 (GitPython 3.1.49) validates newlines only in the value parameter of set_value(). The section and option parameters are passed to configparser without any newline validation. An attacker who controls the section argument can inject \\n to write arbitrary section headers into .git/config, including a forged [core] section with hooksPath pointing to an attacker-controlled directory, leading to RCE when any git hook is triggered.\n\nDetails\n\nFile: git/config.py \u2014 \n\nPackage: gitpython\nInstalled: 3.1.46\nFixed in: 3.1.50\nSeverity: HIGH\nFix: Upgrade gitpython to 3.1.50"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-71ed5e88483a5665", "name": "CVE-2026-45409: idna 3.11 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-45409: idna 3.11 \u2014 requirements.txt"}, "fullDescription": {"text": "Internationalized Domain Names in Applications (IDNA) for Python provi ...\n\nInternationalized Domain Names in Applications (IDNA) for Python provides support for Internationalized Domain Names in Applications (IDNA) and Unicode IDNA Compatibility Processing. In versions prior to 3.15, payloads such as `\"\\u0660\" * N` or `\"\\u30fb\" * N + \"\\u6f22\"` utilize the `valid_contexto` function prior to length rejection, and for high values of `N` will take a long time to process. This is the same issue as CVE-2024-3651, however the original remediation in 2024 was not a complete fi\n\nPackage: idna\nInstalled: 3.11\nFixed in: 3.15\nSeverity: MEDIUM\nFix: Upgrade idna to 3.15"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6a9ac3a9d6426390", "name": "CVE-2026-35030: litellm 1.82.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-35030: litellm 1.82.3 \u2014 requirements.txt"}, "fullDescription": {"text": "litellm: LiteLLM: Authentication bypass and privilege escalation via OIDC userinfo cache key collision\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, when JWT authentication is enabled (enable_jwt_auth: true), the OIDC userinfo cache uses token[:20] as the cache key. JWT headers produced by the same signing algorithm generate identical first 20 characters. This configuration option is not enabled by default. Most instances are not affected. An unauthenticated attacker can craft a token whose first 20 characters match a legitimate user's cach\n\nPackage: litellm\nInstalled: 1.82.3\nFixed in: 1.83.0\nSeverity: CRITICAL\nFix: Upgrade litellm to 1.83.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-1162ca8dad46a83e", "name": "CVE-2026-42208: litellm 1.82.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-42208: litellm 1.82.3 \u2014 requirements.txt"}, "fullDescription": {"text": "LiteLLM: LiteLLM: Unauthorized data access and modification via SQL injection\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.81.16 to before version 1.83.7, a database query used during proxy API key checks mixed the caller-supplied key value into the query text instead of passing it as a separate parameter. An unauthenticated attacker could send a specially crafted Authorization header to any LLM API route (for example POST /chat/completions) and reach this query through the proxy's error-handling path. An attacker co\n\nPackage: litellm\nInstalled: 1.82.3\nFixed in: 1.83.7\nSeverity: CRITICAL\nFix: Upgrade litellm to 1.83.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-e99d62c1947105cc", "name": "CVE-2026-49468: litellm 1.82.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-49468: litellm 1.82.3 \u2014 requirements.txt"}, "fullDescription": {"text": "LiteLLM: Authentication Bypass via Host Header Injection\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0,  This vulnerability is fixed in 1.84.0.\n\nPackage: litellm\nInstalled: 1.82.3\nFixed in: 1.84.0\nSeverity: CRITICAL\nFix: Upgrade litellm to 1.84.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-d89475f5dba58dc2", "name": "CVE-2026-35029: litellm 1.82.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-35029: litellm 1.82.3 \u2014 requirements.txt"}, "fullDescription": {"text": "litellm: LiteLLM: Remote code execution and privilege escalation via unrestricted proxy configuration endpoint\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.83.0, the /config/update endpoint does not enforce admin role authorization. A user who is already authenticated into the platform can then use this endpoint to modify proxy configuration and environment variables, register custom pass-through endpoint handlers pointing to attacker-controlled Python code, achieving remote code execution, read arbitrary server files by setting UI_LOGO_PATH and fetchin\n\nPackage: litellm\nInstalled: 1.82.3\nFixed in: 1.83.0\nSeverity: HIGH\nFix: Upgrade litellm to 1.83.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-302173576d1b5f3e", "name": "CVE-2026-40217: litellm 1.82.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-40217: litellm 1.82.3 \u2014 requirements.txt"}, "fullDescription": {"text": "LiteLLM: LiteLLM: Arbitrary Code Execution via bytecode rewriting\n\nLiteLLM through 2026-04-08 allows remote attackers to execute arbitrary code via bytecode rewriting at the /guardrails/test_custom_code URI.\n\nPackage: litellm\nInstalled: 1.82.3\nFixed in: 1.83.10\nSeverity: HIGH\nFix: Upgrade litellm to 1.83.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-924c1dcdaeeb8337", "name": "CVE-2026-42203: litellm 1.82.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-42203: litellm 1.82.3 \u2014 requirements.txt"}, "fullDescription": {"text": "litellm: LiteLLM: Arbitrary code execution via unsandboxed prompt templates\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.80.5 to before version 1.83.7, the POST /prompts/test endpoint accepted user-supplied prompt templates and rendered them without sandboxing. A crafted template could run arbitrary code inside the LiteLLM Proxy process. The endpoint only checks that the caller presents a valid proxy API key, so any authenticated user could reach it. Depending on how the proxy is deployed, this could expose secrets\n\nPackage: litellm\nInstalled: 1.82.3\nFixed in: 1.83.7\nSeverity: HIGH\nFix: Upgrade litellm to 1.83.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3bc4daf87ed556aa", "name": "CVE-2026-42271: litellm 1.82.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-42271: litellm 1.82.3 \u2014 requirements.txt"}, "fullDescription": {"text": "litellm: LiteLLM: Authenticated command execution via MCP stdio test endpoints\n\nLiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. From version 1.74.2 to before version 1.83.7, two endpoints used to preview an MCP server before saving it \u2014 POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list \u2014 accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio configuration, the endpoints attempted to connect, which spawned the supplied com\n\nPackage: litellm\nInstalled: 1.82.3\nFixed in: 1.83.7\nSeverity: HIGH\nFix: Upgrade litellm to 1.83.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a7c0f5716236aa90", "name": "CVE-2026-47101: litellm 1.82.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-47101: litellm 1.82.3 \u2014 requirements.txt"}, "fullDescription": {"text": "LiteLLM allows an authenticated internal_user to create API keys with access to routes that their role does not permit\n\nLiteLLM prior to 1.83.14 allows an authenticated internal_user to create API keys with access to routes that their role does not permit. When generating a key, the allowed_routes field is stored without verifying that the specified routes fall within the user's own permissions. A key created with access to admin-only routes can then be used to reach those routes successfully, bypassing the role-based access controls that would otherwise block the request, enabling full privilege escalation from \n\nPackage: litellm\nInstalled: 1.82.3\nFixed in: 1.83.14\nSeverity: HIGH\nFix: Upgrade litellm to 1.83.14"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5b7ee1c6f394711e", "name": "CVE-2026-47102: litellm 1.82.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-47102: litellm 1.82.3 \u2014 requirements.txt"}, "fullDescription": {"text": "LiteLLM allows a user to modify their own user_role via the /user/update endpoint\n\nLiteLLM prior to 1.83.10 allows a user to modify their own user_role via the /user/update endpoint. While the endpoint correctly restricts users to updating only their own account, it does not restrict which fields may be changed. A user who can reach this endpoint can set their role to proxy_admin, gaining full administrative access to LiteLLM including all users, teams, keys, models, and prompt history. Users with the org_admin role have legitimate access to this endpoint and can exploit this \n\nPackage: litellm\nInstalled: 1.82.3\nFixed in: 1.83.10\nSeverity: HIGH\nFix: Upgrade litellm to 1.83.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-857c628bd7f43971", "name": "GHSA-69x8-hrgq-fjj8: litellm 1.82.3 \u2014 requirements.txt", "shortDescription": {"text": "GHSA-69x8-hrgq-fjj8: litellm 1.82.3 \u2014 requirements.txt"}, "fullDescription": {"text": "LiteLLM: Password hash exposure and pass-the-hash authentication bypass\n\n### Impact\n\nThree issues combine into a full authentication bypass chain:\n\n1. Weak hashing: User passwords are stored as unsalted SHA-256 hashes, making them vulnerable to rainbow table attacks and trivially identifying users with identical passwords.\n2. Hash exposure: Multiple API endpoints (/user/info, /user/update, /spend/users) return the password hash field in responses to any authenticated user regardless of role. Plaintext passwords could also potentially be exposed in certain scenarios.\n\n\nPackage: litellm\nInstalled: 1.82.3\nFixed in: 1.83.0\nSeverity: HIGH\nFix: Upgrade litellm to 1.83.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-468763ae62469f4a", "name": "CVE-2026-40192: pillow 12.1.1 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-40192: pillow 12.1.1 \u2014 requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing\n\nPillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memory consumption, leading to denial of service (OOM crash or severe performance degradation). If users are unable to immediately upgrade, they should only open specific image formats, excluding FITS, as a workaround.\n\nPackage: pillow\nInstalled: 12.1.1\nFixed in: 12.2.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a55fa3a9369befbd", "name": "CVE-2026-42311: pillow 12.1.1 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-42311: pillow 12.1.1 \u2014 requirements.txt"}, "fullDescription": {"text": "Pillow is a Python imaging library. From version 10.3.0 to before vers ...\n\nPillow is a Python imaging library. From version 10.3.0 to before version 12.2.0, processing a malicious PSD file could lead to memory corruption, potentially resulting in a crash or arbitrary code execution. This issue has been patched in version 12.2.0.\n\nPackage: pillow\nInstalled: 12.1.1\nFixed in: 12.2.0\nSeverity: HIGH\nFix: Upgrade pillow to 12.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-20af473dd99d8219", "name": "CVE-2026-42308: pillow 12.1.1 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-42308: pillow 12.1.1 \u2014 requirements.txt"}, "fullDescription": {"text": "Pillow: python: Pillow: Denial of Service via integer overflow in font processing\n\nPillow is a Python imaging library. Prior to version 12.2.0, if a font advances for each glyph by an exceeding large amount, when Pillow keeps track of the current position, it may lead to an integer overflow. This issue has been patched in version 12.2.0.\n\nPackage: pillow\nInstalled: 12.1.1\nFixed in: 12.2.0\nSeverity: MEDIUM\nFix: Upgrade pillow to 12.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-04fb100fc1a6f595", "name": "CVE-2026-42309: pillow 12.1.1 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-42309: pillow 12.1.1 \u2014 requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Denial of Service via specially crafted coordinate input\n\nPillow is a Python imaging library. From version 11.2.1 to before version 12.2.0, passing nested lists as coordinates to APIs that accept coordinates such as ImagePath.Path, ImageDraw.ImageDraw.polygon and ImageDraw.ImageDraw.line could cause a heap buffer overflow, as nested lists were recursively unpacked beyond the allocated buffer. Coordinate lists are now validated to contain exactly two numeric coordinates. This issue has been patched in version 12.2.0.\n\nPackage: pillow\nInstalled: 12.1.1\nFixed in: 12.2.0\nSeverity: MEDIUM\nFix: Upgrade pillow to 12.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fab9a6c7be2d9f53", "name": "CVE-2026-42310: pillow 12.1.1 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-42310: pillow 12.1.1 \u2014 requirements.txt"}, "fullDescription": {"text": "Pillow: Pillow: Denial of Service via malicious PDF processing\n\nPillow is a Python imaging library. From version 4.2.0 to before version 12.2.0, an attacker can supply a malicious PDF that causes the process to hang indefinitely, consuming 100% CPU and making the application unresponsive. This issue has been patched in version 12.2.0.\n\nPackage: pillow\nInstalled: 12.1.1\nFixed in: 12.2.0\nSeverity: MEDIUM\nFix: Upgrade pillow to 12.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b1139d497cb05874", "name": "CVE-2026-4539: pygments 2.19.2 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-4539: pygments 2.19.2 \u2014 requirements.txt"}, "fullDescription": {"text": "pygments: Pygments: Denial of Service via inefficient regular expression processing in AdlLexer\n\nA security flaw has been discovered in pygments up to 2.19.2. The impacted element is the function AdlLexer of the file pygments/lexers/archetype.py. The manipulation results in inefficient regular expression complexity. The attack is only possible with local access. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.\n\nPackage: pygments\nInstalled: 2.19.2\nFixed in: 2.20.0\nSeverity: LOW\nFix: Upgrade pygments to 2.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4785a66b36a6ab25", "name": "CVE-2026-25645: requests 2.32.5 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-25645: requests 2.32.5 \u2014 requirements.txt"}, "fullDescription": {"text": "requests: Requests: Security bypass due to predictable temporary file creation\n\nRequests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract_zipped_paths()` utility function uses a predictable filename when extracting files from zip archives into the system temporary directory. If the target file already exists, it is reused without validation. A local attacker with write access to the temp directory could pre-create a malicious file that would be loaded in place of the legitimate one. Standard usage of the Requests library is not affected by this vulner\n\nPackage: requests\nInstalled: 2.32.5\nFixed in: 2.33.0\nSeverity: MEDIUM\nFix: Upgrade requests to 2.33.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0992560bd606b471", "name": "CVE-2026-48818: starlette 0.52.1 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-48818: starlette 0.52.1 \u2014 requirements.txt"}, "fullDescription": {"text": "starlette: Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows\n\nStarlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\\\attacker.com\\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account\u2019s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as Fas\n\nPackage: starlette\nInstalled: 0.52.1\nFixed in: 1.1.0\nSeverity: HIGH\nFix: Upgrade starlette to 1.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-03cc15e44fbbe8be", "name": "CVE-2026-54283: starlette 0.52.1 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-54283: starlette 0.52.1 \u2014 requirements.txt"}, "fullDescription": {"text": "Starlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1. ...\n\nStarlette is a lightweight ASGI framework/toolkit. From 0.4.1 until 1.3.1, request.form() accepts max_fields and max_part_size to bound resource consumption while parsing form data. These limits are enforced for multipart/form-data, but silently ignored for application/x-www-form-urlencoded. An unauthenticated attacker can therefore send a urlencoded body with an arbitrarily large number of fields or an arbitrarily large field, even when the application configured limits it believed would apply.\n\nPackage: starlette\nInstalled: 0.52.1\nFixed in: 1.3.1\nSeverity: HIGH\nFix: Upgrade starlette to 1.3.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3b38dcb1690c4878", "name": "CVE-2026-48710: starlette 0.52.1 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-48710: starlette 0.52.1 \u2014 requirements.txt"}, "fullDescription": {"text": "starlette: Starlette: Security restriction bypass via malformed HTTP Host header\n\nStarlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuilt from the `Host` header, a malformed header could make `request.url.path` differ from the path that was actually requested. Middleware and endpoints that apply security restrictions based on `request.url` (rather than the raw `scope` path) \n\nPackage: starlette\nInstalled: 0.52.1\nFixed in: 1.0.1\nSeverity: MEDIUM\nFix: Upgrade starlette to 1.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5b42b30388f1c186", "name": "CVE-2026-48817: starlette 0.52.1 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-48817: starlette 0.52.1 \u2014 requirements.txt"}, "fullDescription": {"text": "starlette: Starlette: Information disclosure and unintended method execution via non-standard HTTP methods\n\nStarlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and below, when dispatching a request, HTTPEndpoint selects the handler by lowercasing the HTTP method and looking it up as an attribute with getattr, without restricting the lookup to a known set of HTTP verbs. When an HTTPEndpoint subclass is registered through Route(...) without an explicit methods= argument, the route does not constrain the method and every method reaches the endpoint. If a non-standard HTTP method whose lo\n\nPackage: starlette\nInstalled: 0.52.1\nFixed in: 1.1.0\nSeverity: MEDIUM\nFix: Upgrade starlette to 1.1.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f393e29313e5fba0", "name": "CVE-2026-54282: starlette 0.52.1 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-54282: starlette 0.52.1 \u2014 requirements.txt"}, "fullDescription": {"text": "Starlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the ...\n\nStarlette is a lightweight ASGI framework/toolkit. Prior to 1.3.0, the HTTP request path is not validated before being used to reconstruct request.url. Because request.url is rebuilt by concatenating {scheme}://{host}{path} and re-parsing the result, a path that does not begin with / (for example @google.com) moves the authority boundary during re-parsing, so request.url.hostname and request.url.netloc become attacker-controlled. Code that reads request.url.hostname (rather than the Host header \n\nPackage: starlette\nInstalled: 0.52.1\nFixed in: 1.3.0\nSeverity: LOW\nFix: Upgrade starlette to 1.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5cc8616e7a55f65d", "name": "CVE-2026-44431: urllib3 2.6.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-44431: urllib3 2.6.3 \u2014 requirements.txt"}, "fullDescription": {"text": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers\n\nurllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.\n\nPackage: urllib3\nInstalled: 2.6.3\nFixed in: 2.7.0\nSeverity: HIGH\nFix: Upgrade urllib3 to 2.7.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6f6cfe72bc08eed0", "name": "CVE-2026-44432: urllib3 2.6.3 \u2014 requirements.txt", "shortDescription": {"text": "CVE-2026-44432: urllib3 2.6.3 \u2014 requirements.txt"}, "fullDescription": {"text": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression\n\nurllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly \n\nPackage: urllib3\nInstalled: 2.6.3\nFixed in: 2.7.0\nSeverity: HIGH\nFix: Upgrade urllib3 to 2.7.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bfa757f6d525ec29", "name": "DS-0002: Image user should not be 'root' \u2014 benchmark/Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 benchmark/Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: benchmark/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f899882982e03461", "name": "DS-0013: 'RUN cd ...' to change directory \u2014 benchmark/Dockerfile", "shortDescription": {"text": "DS-0013: 'RUN cd ...' to change directory \u2014 benchmark/Dockerfile"}, "fullDescription": {"text": "'RUN cd ...' to change directory\n\nRUN should not be used to change directory: 'curl -fsSL https://deb.nodesource.com/setup_20.x | bash - &&     apt-get install -y nodejs &&     rm -rf /var/lib/apt/lists/* &&     mkdir -p /npm-install &&     cd /npm-install &&     npm init -y &&     npm install     jest     @babel/core@7.25.2     @exercism/babel-preset-javascript@0.2.1     @exercism/eslint-config-javascript@0.6.0     @types/jest@29.5.12     @types/node@20.12.12     babel-jest@29.6.4     core-js@3.37.1     eslint@8.49.0'. Use 'WOR\n\nRule: DS-0013\nSeverity: MEDIUM\nTarget: benchmark/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c007c19137f03fe0", "name": "DS-0026: No HEALTHCHECK defined \u2014 benchmark/Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 benchmark/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: benchmark/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-62b13431c8a173b2", "name": "DS-0029: 'apt-get' missing '--no-install-recommends' \u2014 benchmark/Dockerfile", "shortDescription": {"text": "DS-0029: 'apt-get' missing '--no-install-recommends' \u2014 benchmark/Dockerfile"}, "fullDescription": {"text": "'apt-get' missing '--no-install-recommends'\n\n'--no-install-recommends' flag is missed: 'apt-get update && apt-get install -y     software-properties-common     cmake     libboost-all-dev     && add-apt-repository ppa:deadsnakes/ppa     && apt-get update     && apt-get install -y     python3.11     python3.11-venv     python3.11-dev     python3-pip     ca-certificates-java     openjdk-21-jdk     libtbb-dev     && rm -rf /var/lib/apt/lists/*'\n\nRule: DS-0029\nSeverity: HIGH\nTarget: benchmark/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-055d03fec591276a", "name": "DS-0026: No HEALTHCHECK defined \u2014 docker/Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 docker/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: docker/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1279c2ca76399c43", "name": "DS-0001: ':latest' tag used \u2014 scripts/Dockerfile.jekyll", "shortDescription": {"text": "DS-0001: ':latest' tag used \u2014 scripts/Dockerfile.jekyll"}, "fullDescription": {"text": "':latest' tag used\n\nSpecify a tag in the 'FROM' statement for image 'bretfisher/jekyll-serve'\n\nRule: DS-0001\nSeverity: MEDIUM\nTarget: scripts/Dockerfile.jekyll"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d183543a11c5064e", "name": "DS-0002: Image user should not be 'root' \u2014 scripts/Dockerfile.jekyll", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 scripts/Dockerfile.jekyll"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: scripts/Dockerfile.jekyll"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-388db0918c55764f", "name": "DS-0021: 'apt-get' missing '-y' to avoid manual input \u2014 scripts/Dockerfile.jekyll", "shortDescription": {"text": "DS-0021: 'apt-get' missing '-y' to avoid manual input \u2014 scripts/Dockerfile.jekyll"}, "fullDescription": {"text": "'apt-get' missing '-y' to avoid manual input\n\n'-y' flag is missed: 'apt-get update && apt-get install libcurl4'\n\nRule: DS-0021\nSeverity: HIGH\nTarget: scripts/Dockerfile.jekyll"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e83161658379bf2a", "name": "DS-0026: No HEALTHCHECK defined \u2014 scripts/Dockerfile.jekyll", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 scripts/Dockerfile.jekyll"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: scripts/Dockerfile.jekyll"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7ffc6ccdd58f1857", "name": "DS-0029: 'apt-get' missing '--no-install-recommends' \u2014 scripts/Dockerfile.jekyll", "shortDescription": {"text": "DS-0029: 'apt-get' missing '--no-install-recommends' \u2014 scripts/Dockerfile.jekyll"}, "fullDescription": {"text": "'apt-get' missing '--no-install-recommends'\n\n'--no-install-recommends' flag is missed: 'apt-get update && apt-get install libcurl4'\n\nRule: DS-0029\nSeverity: HIGH\nTarget: scripts/Dockerfile.jekyll"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e56261bc8b34eee3", "name": "AWS-0164: Instances in a subnet should not receive a public IP address by default. \u2014 tests/fixtures/languages/hcl/test.t", "shortDescription": {"text": "AWS-0164: Instances in a subnet should not receive a public IP address by default. \u2014 tests/fixtures/languages/hcl/test.tf"}, "fullDescription": {"text": "Instances in a subnet should not receive a public IP address by default.\n\nSubnet associates public IP address.\n\nRule: AWS-0164\nSeverity: HIGH\nTarget: tests/fixtures/languages/hcl/test.tf"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e7ce2c3f34bd6745", "name": "AWS-0178: VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from netw", "shortDescription": {"text": "AWS-0178: VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Log"}, "fullDescription": {"text": "VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packet \"Rejects\" for VPCs.\n\nVPC does not have VPC Flow Logs enabled.\n\nRule: AWS-0178\nSeverity: MEDIUM\nTarget: tests/fixtures/languages/hcl/test.tf"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0ed12862caf5eed9", "name": "Agent authority lacks a verifier contract: aider/website/docs/llms/gemini.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: aider/website/docs/llms/gemini.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2187ef211aa54d2d", "name": "Agent authority lacks a verifier contract: aider/website/assets/sample.aider.conf.yml", "shortDescription": {"text": "Agent authority lacks a verifier contract: aider/website/assets/sample.aider.conf.yml"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-783bcbc1b0882a0d", "name": "Privileged port 69 in use", "shortDescription": {"text": "Privileged port 69 in use"}, "fullDescription": {"text": "Port 69 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-01422cb15edf6282", "name": "Privileged port 12 in use", "shortDescription": {"text": "Privileged port 12 in use"}, "fullDescription": {"text": "Port 12 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-47ce292071ac0add", "name": "Privileged port 15 in use", "shortDescription": {"text": "Privileged port 15 in use"}, "fullDescription": {"text": "Port 15 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f49bfa5ea1bed281", "name": "Privileged port 10 in use", "shortDescription": {"text": "Privileged port 10 in use"}, "fullDescription": {"text": "Port 10 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f1a2d41f26dcfee0", "name": "Privileged port 179 in use", "shortDescription": {"text": "Privileged port 179 in use"}, "fullDescription": {"text": "Port 179 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d323bd16c4f94e60", "name": "Privileged port 197 in use", "shortDescription": {"text": "Privileged port 197 in use"}, "fullDescription": {"text": "Port 197 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aee7cb8a0f6ef289", "name": "Privileged port 16 in use", "shortDescription": {"text": "Privileged port 16 in use"}, "fullDescription": {"text": "Port 16 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-abaeb90a4273ac32", "name": "Privileged port 18 in use", "shortDescription": {"text": "Privileged port 18 in use"}, "fullDescription": {"text": "Port 18 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-af5c7b6d9726bf3a", "name": "Privileged port 52 in use", "shortDescription": {"text": "Privileged port 52 in use"}, "fullDescription": {"text": "Port 52 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-41f442b0acdcd1a0", "name": "Privileged port 54 in use", "shortDescription": {"text": "Privileged port 54 in use"}, "fullDescription": {"text": "Port 54 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf828b0c570aeddb", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim-bookworm", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim-bookworm"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f1743df07a3b826", "name": "Dockerfile runs as root: benchmark/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: benchmark/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d1d94d9ecc6ca6e", "name": "Docker base image is tag-pinned but not digest-pinned: buildpack-deps:jammy", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: buildpack-deps:jammy"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-986306f7fa5c3b9d", "name": "Dockerfile ADD downloads remote content without checksum", "shortDescription": {"text": "Dockerfile ADD downloads remote content without checksum"}, "fullDescription": {"text": "Remote build inputs can change or be replaced upstream. Use Dockerfile ADD --checksum or download with an explicit digest/signature verification step."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-60b7de709b976ae3", "name": "Dockerfile pipes a remote installer into a shell", "shortDescription": {"text": "Dockerfile pipes a remote installer into a shell"}, "fullDescription": {"text": "Executing downloaded code during image build gives the remote endpoint build-time code execution. Prefer pinned packages or verify downloaded installers by checksum/signature."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "high", "confidence": 1.0}}, {"id": "scanner-83bedd7ecb0d5b81", "name": "Insecure pattern 'python_os_system' in benchmark/README.md:26", "shortDescription": {"text": "Insecure pattern 'python_os_system' in benchmark/README.md:26"}, "fullDescription": {"text": "Found a known-risky pattern (python_os_system). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-caea3c603d83a47f", "name": "Insecure pattern 'subprocess_shell_true' in aider/commands.py:974", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in aider/commands.py:974"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-20c97f6727de8943", "name": "Possible secret in aider/analytics.py", "shortDescription": {"text": "Possible secret in aider/analytics.py"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-fe008ed296073ea4", "name": "Insecure pattern 'subprocess_shell_true' in aider/editor.py:134", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in aider/editor.py:134"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-58fd62fb4ab3d05e", "name": "Insecure pattern 'subprocess_shell_true' in aider/run_cmd.py:62", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in aider/run_cmd.py:62"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-14f48e7f3ec0ddf3", "name": "Insecure pattern 'subprocess_shell_true' in aider/io.py:1093", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in aider/io.py:1093"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2ab56aeee5200b89", "name": "Insecure pattern 'tls_verify_false' in aider/main.py:524", "shortDescription": {"text": "Insecure pattern 'tls_verify_false' in aider/main.py:524"}, "fullDescription": {"text": "Found a known-risky pattern (tls_verify_false). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4abd753c6ae0b98a", "name": "Insecure pattern 'direct_innerhtml_assignment' in aider/website/index.html:487", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in aider/website/index.html:487"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-69cab9a95b6dfe57", "name": "Insecure pattern 'direct_innerhtml_assignment' in aider/website/assets/asciinema/asciinema-player.min.js:1", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in aider/website/assets/asciinema/asciinema-player.min.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b16454efb682f356", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-38ffbb45595ebcf6", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-python@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5af2dfac961b2a63", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7f53977ac969d336", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e4f658c0c00de0d4", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-448d8837178ae57a", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ac6791bc39b6f1ed", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-python@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dfed46d3cd02ed24", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-python@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-61a1a61a5214d62e", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "mdeweerd/logToCheckStyle@v2025.1.1 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0b5dfc76335f6e29", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e7233df63113af9b", "name": "Very large file: tests/basic/test_commands.py (2226 lines)", "shortDescription": {"text": "Very large file: tests/basic/test_commands.py (2226 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-414cc4d0acc78cf3", "name": "Very large file: tests/basic/test_coder.py (1438 lines)", "shortDescription": {"text": "Very large file: tests/basic/test_coder.py (1438 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-98bebdca48fb15bd", "name": "Very large file: tests/basic/test_main.py (1483 lines)", "shortDescription": {"text": "Very large file: tests/basic/test_main.py (1483 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b076997d485f1ae9", "name": "Very large file: aider/commands.py (1712 lines)", "shortDescription": {"text": "Very large file: aider/commands.py (1712 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ec73f4768bc4be64", "name": "Very large file: aider/website/install.sh (1832 lines)", "shortDescription": {"text": "Very large file: aider/website/install.sh (1832 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aae4159bbbf1ae92", "name": "Very large file: aider/coders/base_coder.py (2485 lines)", "shortDescription": {"text": "Very large file: aider/coders/base_coder.py (2485 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 433 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 48 placeholder/mock markers across 11 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-20085855cb053abb", "name": "Legacy-named symbol `TestDeprecated` in tests/basic/test_deprecated.py:13", "shortDescription": {"text": "Legacy-named symbol `TestDeprecated` in tests/basic/test_deprecated.py:13"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a0e25dfac65c46c", "name": "Legacy-named symbol `test_cmd_copy` in tests/basic/test_commands.py:50", "shortDescription": {"text": "Legacy-named symbol `test_cmd_copy` in tests/basic/test_commands.py:50"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-16d087cdae0fda85", "name": "Commented-code block (5 lines) in tests/basic/test_coder.py:327", "shortDescription": {"text": "Commented-code block (5 lines) in tests/basic/test_coder.py:327"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e0f5ca4690fee5f5", "name": "Commented-code block (5 lines) in tests/basic/test_repo.py:557", "shortDescription": {"text": "Commented-code block (5 lines) in tests/basic/test_repo.py:557"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-274d8923c2512039", "name": "Legacy-named symbol `litellm_entry_copy` in scripts/clean_metadata.py:186", "shortDescription": {"text": "Legacy-named symbol `litellm_entry_copy` in scripts/clean_metadata.py:186"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4bd802b667cd0c39", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/update-history.py:36", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/update-history.py:36"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8945a05fc8c681cd", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/yank-old-versions.py:8", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/yank-old-versions.py:8"}, "fullDescription": {"text": "`requests.get(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a72328a9b743c2e4", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/versionbump.py:15", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/versionbump.py:15"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7c3b241b857b82b4", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/blame.py:84", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/blame.py:84"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fbd7af20b7fd2afc", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/dl_icons.py:33", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/dl_icons.py:33"}, "fullDescription": {"text": "`requests.get(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b066bc7202119a17", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/issues.py:16", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/issues.py:16"}, "fullDescription": {"text": "`requests.get(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2bdc8115f6a16295", "name": "Network/subprocess call without timeout or try/except \u2014 benchmark/rungrid.py:56", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 benchmark/rungrid.py:56"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-73a91ecd7488025e", "name": "Stub function `save_tags_cache` (body is just `pass`/`return`) \u2014 aider/repomap.py:224", "shortDescription": {"text": "Stub function `save_tags_cache` (body is just `pass`/`return`) \u2014 aider/repomap.py:224"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2311bb1f1e3fb334", "name": "Legacy-named symbol `cmd_copy` in aider/commands.py:1528", "shortDescription": {"text": "Legacy-named symbol `cmd_copy` in aider/commands.py:1528"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b5a1652bbc69b884", "name": "Stub function `do_settings_tab` (body is just `pass`/`return`) \u2014 aider/gui.py:166", "shortDescription": {"text": "Stub function `do_settings_tab` (body is just `pass`/`return`) \u2014 aider/gui.py:166"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a04e4413e42980ea", "name": "Network/subprocess call without timeout or try/except \u2014 aider/run_cmd.py:62", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 aider/run_cmd.py:62"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e8cf017681708a62", "name": "Network/subprocess call without timeout or try/except \u2014 aider/models.py:966", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 aider/models.py:966"}, "fullDescription": {"text": "`requests.get(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f44433c17e776337", "name": "Commented-code block (6 lines) in aider/main.py:270", "shortDescription": {"text": "Commented-code block (6 lines) in aider/main.py:270"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0cb3786e91f91902", "name": "Commented-code block (5 lines) in aider/waiting.py:153", "shortDescription": {"text": "Commented-code block (5 lines) in aider/waiting.py:153"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e40b7050b8c0c8a2", "name": "`fetch()` without try/.catch or AbortSignal \u2014 aider/website/assets/asciinema/asciinema-player.min.js:1", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 aider/website/assets/asciinema/asciinema-player.min.js:1"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0de8c923580d5121", "name": "Stub function `reply_completed` (body is just `pass`/`return`) \u2014 aider/coders/base_coder.py:1625", "shortDescription": {"text": "Stub function `reply_completed` (body is just `pass`/`return`) \u2014 aider/coders/base_coder.py:1625"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-95bdfc7cc16f845f", "name": "Stub function `check_for_file_mentions` (body is just `pass`/`return`) \u2014 aider/coders/context_coder.py:52", "shortDescription": {"text": "Stub function `check_for_file_mentions` (body is just `pass`/`return`) \u2014 aider/coders/context_coder.py:52"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-00392e3296540d83", "name": "Stub function `apply_edits` (body is just `pass`/`return`) \u2014 aider/coders/help_coder.py:15", "shortDescription": {"text": "Stub function `apply_edits` (body is just `pass`/`return`) \u2014 aider/coders/help_coder.py:15"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbenchmark/over_time.py:plot_model_series, benchmark/over_time.py:plot\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\naider/args_formatter.py:start_section, aider/args_formatter.py:start_section, aider/args_formatter.py:start_section\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/30733"}, "properties": {"repository": "Aider-AI/aider", "repoUrl": "https://github.com/Aider-AI/aider.git", "branch": "main"}, "results": [{"ruleId": "MINED115", "level": "warning", "message": {"text": "[MINED115] Action `mdeweerd/logToCheckStyle` pinned to mutable ref `@v2025.1.1`: `uses: mdeweerd/logToCheckStyle@v2025.1.1` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 469558, "scanner": "repobility-supply-chain", "fingerprint": "2434da25aafdc414b01d41875bf29badb0e8b622c7e42f790026d7052d9954d6", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|2434da25aafdc414b01d41875bf29badb0e8b622c7e42f790026d7052d9954d6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pre-commit.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "MINED115", "level": "warning", "message": {"text": "[MINED115] Action `ruby/setup-ruby` pinned to mutable ref `@v1`: `uses: ruby/setup-ruby@v1` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 469547, "scanner": "repobility-supply-chain", "fingerprint": "ff7103d121a9e57f9c7c845efcdf92d9274459824e23247b4b0342b2a79791d5", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|ff7103d121a9e57f9c7c845efcdf92d9274459824e23247b4b0342b2a79791d5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 44}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "[MINED124] requirements.txt: `google-cloud-bigquery` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins."}, "properties": {"repobilityId": 469531, "scanner": "repobility-supply-chain", "fingerprint": "4964fe946a92ca876ff2a6280e8c4cc0e3a93d5983b85ac6299ed3dc10af44ab", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|4964fe946a92ca876ff2a6280e8c4cc0e3a93d5983b85ac6299ed3dc10af44ab"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements/requirements-dev.in"}, "region": {"startLine": 15}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "[MINED124] requirements.txt: `uv` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins."}, "properties": {"repobilityId": 469530, "scanner": "repobility-supply-chain", "fingerprint": "5eba4eb1cfabdde3f213189079c9585efff5570765b0439b61916525a1d2ee96", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|5eba4eb1cfabdde3f213189079c9585efff5570765b0439b61916525a1d2ee96"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements/requirements-dev.in"}, "region": {"startLine": 14}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "[MINED124] requirements.txt: `codespell` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins."}, "properties": {"repobilityId": 469529, "scanner": "repobility-supply-chain", "fingerprint": "efd153fcf9f80956b4a7bc0d65568ae228ed8cf6f3ee6518e3873c77cf2b2fb4", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|efd153fcf9f80956b4a7bc0d65568ae228ed8cf6f3ee6518e3873c77cf2b2fb4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements/requirements-dev.in"}, "region": {"startLine": 13}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "[MINED124] requirements.txt: `semver` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins."}, "properties": {"repobilityId": 469528, "scanner": "repobility-supply-chain", "fingerprint": "c3e14e2e345998e28e89b395b851a5c139df2d88f5e627245bede882ba905f5f", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|c3e14e2e345998e28e89b395b851a5c139df2d88f5e627245bede882ba905f5f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements/requirements-dev.in"}, "region": {"startLine": 12}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "[MINED124] requirements.txt: `cogapp` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins."}, "properties": {"repobilityId": 469527, "scanner": "repobility-supply-chain", "fingerprint": "3cd7412a61c737077768dfa3f5ffe6d2cf8a64371a6462167100d2835dd62a25", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|3cd7412a61c737077768dfa3f5ffe6d2cf8a64371a6462167100d2835dd62a25"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements/requirements-dev.in"}, "region": {"startLine": 11}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "[MINED124] requirements.txt: `pre-commit` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins."}, "properties": {"repobilityId": 469526, "scanner": "repobility-supply-chain", "fingerprint": "f33342367b7feb3ad1d30d7837b925466ee03820582dc862e5d42cc07c5cfe5b", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|f33342367b7feb3ad1d30d7837b925466ee03820582dc862e5d42cc07c5cfe5b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements/requirements-dev.in"}, "region": {"startLine": 10}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "[MINED124] requirements.txt: `imgcat` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins."}, "properties": {"repobilityId": 469525, "scanner": "repobility-supply-chain", "fingerprint": "e241cd4882890a10506e0ac54577852e84fc4e5cf4f042e05446bf5dec3112fc", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|e241cd4882890a10506e0ac54577852e84fc4e5cf4f042e05446bf5dec3112fc"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements/requirements-dev.in"}, "region": {"startLine": 9}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "[MINED124] requirements.txt: `typer` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins."}, "properties": {"repobilityId": 469524, "scanner": "repobility-supply-chain", "fingerprint": "0f08c7537b48965deca23b92fb3a141ee4bfe10c3d25ce7a4d7a8d87946701fd", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|0f08c7537b48965deca23b92fb3a141ee4bfe10c3d25ce7a4d7a8d87946701fd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements/requirements-dev.in"}, "region": {"startLine": 8}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "[MINED124] requirements.txt: `pandas` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins."}, "properties": {"repobilityId": 469523, "scanner": "repobility-supply-chain", "fingerprint": "3f4320bc61ca94426a7e2aa55c164a6d2839b80778d8ddd66e171c5b889fdd87", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|3f4320bc61ca94426a7e2aa55c164a6d2839b80778d8ddd66e171c5b889fdd87"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements/requirements-dev.in"}, "region": {"startLine": 7}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "[MINED124] requirements.txt: `matplotlib` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins."}, "properties": {"repobilityId": 469522, "scanner": "repobility-supply-chain", "fingerprint": "8433bbcd6f7b3e133b8dd06bc7414bf1eac99ba4ae5469546a25491bff478c8b", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|8433bbcd6f7b3e133b8dd06bc7414bf1eac99ba4ae5469546a25491bff478c8b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements/requirements-dev.in"}, "region": {"startLine": 6}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "[MINED124] requirements.txt: `lox` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins."}, "properties": {"repobilityId": 469521, "scanner": "repobility-supply-chain", "fingerprint": "76daa08f8aed07f67826e15d35abb77429ec0516c513226ebd434bb844309639", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|76daa08f8aed07f67826e15d35abb77429ec0516c513226ebd434bb844309639"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements/requirements-dev.in"}, "region": {"startLine": 5}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "[MINED124] requirements.txt: `pip-tools` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins."}, "properties": {"repobilityId": 469520, "scanner": "repobility-supply-chain", "fingerprint": "8552c4971dac39a7f04de0ad36879a8bbae09250969de8ccd83b00dea82014db", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|8552c4971dac39a7f04de0ad36879a8bbae09250969de8ccd83b00dea82014db"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements/requirements-dev.in"}, "region": {"startLine": 4}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "[MINED124] requirements.txt: `pytest-env` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins."}, "properties": {"repobilityId": 469519, "scanner": "repobility-supply-chain", "fingerprint": "18105c6ddc836f791ced7cf7a2505607ce974ccb06615b039297f12fbf5687e6", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|18105c6ddc836f791ced7cf7a2505607ce974ccb06615b039297f12fbf5687e6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements/requirements-dev.in"}, "region": {"startLine": 3}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "[MINED124] requirements.txt: `pytest-cov` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins."}, "properties": {"repobilityId": 469518, "scanner": "repobility-supply-chain", "fingerprint": "bba0066b8108937073df7093d8e801fbdfa0b3bb6f8c630ff8f26583698a8acd", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|bba0066b8108937073df7093d8e801fbdfa0b3bb6f8c630ff8f26583698a8acd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements/requirements-dev.in"}, "region": {"startLine": 2}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "[MINED124] requirements.txt: `pytest` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins."}, "properties": {"repobilityId": 469517, "scanner": "repobility-supply-chain", "fingerprint": "282d849b1fd6f6a9039ff733aed1fe6df65961a9f1697a5b34fab00cd3c93838", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|282d849b1fd6f6a9039ff733aed1fe6df65961a9f1697a5b34fab00cd3c93838"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements/requirements-dev.in"}, "region": {"startLine": 1}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "[MINED124] requirements.txt: `numpy<2; python_version < \"3.11\"` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins."}, "properties": {"repobilityId": 469516, "scanner": "repobility-supply-chain", "fingerprint": "3eb7da9325cf41af65681bea09d29bad3e2adadf3d3e6d943ee2a2d0592ab776", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|3eb7da9325cf41af65681bea09d29bad3e2adadf3d3e6d943ee2a2d0592ab776"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements/requirements-help.in"}, "region": {"startLine": 4}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "[MINED124] requirements.txt: `llama-index-embeddings-huggingface` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins."}, "properties": {"repobilityId": 469515, "scanner": "repobility-supply-chain", "fingerprint": "559e6b396700e72b9f1589c86c168b092403be3203a8c0a3846eefa68103ffc8", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|559e6b396700e72b9f1589c86c168b092403be3203a8c0a3846eefa68103ffc8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements/requirements-help.in"}, "region": {"startLine": 1}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "[MINED124] requirements.txt: `playwright` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins."}, "properties": {"repobilityId": 469514, "scanner": "repobility-supply-chain", "fingerprint": "defbebc38093a58c20e7b4c6cb0274e1bc56333ae821a08de2c10d97e0e6febf", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|defbebc38093a58c20e7b4c6cb0274e1bc56333ae821a08de2c10d97e0e6febf"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements/requirements-playwright.in"}, "region": {"startLine": 1}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "[MINED124] requirements.txt: `streamlit` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins."}, "properties": {"repobilityId": 469513, "scanner": "repobility-supply-chain", "fingerprint": "9d6169f5c4e41d303e22ed510e125af49a81784efc1c48c17501e071cf3a5359", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|9d6169f5c4e41d303e22ed510e125af49a81784efc1c48c17501e071cf3a5359"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements/requirements-browser.in"}, "region": {"startLine": 1}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "[MINED124] requirements.txt: `scipy<1.16; python_version < \"3.11\"` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins."}, "properties": {"repobilityId": 469510, "scanner": "repobility-supply-chain", "fingerprint": "f15e7c99f8f834cd67f49bad6e9fdfa6086660655b11009482d31e85e1b1d3d4", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|f15e7c99f8f834cd67f49bad6e9fdfa6086660655b11009482d31e85e1b1d3d4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements.txt"}, "region": {"startLine": 486}}}]}, {"ruleId": "MINED124", "level": "warning", "message": {"text": "[MINED124] requirements.txt: `numpy<2; python_version < \"3.11\"` has no version pin: Unpinned pip requirement means every fresh install may resolve a different version. Newer releases can introduce malicious code (typosquats, account compromises). Reproducible installs need exact pins."}, "properties": {"repobilityId": 469509, "scanner": "repobility-supply-chain", "fingerprint": "d620180fc95ff9e03412208c6a534be8210424046ef9285618b79d1593e340ff", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "unpinned-pip-requirement", "owasp": null, "cwe_ids": ["CWE-1357"], "languages": ["python"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|d620180fc95ff9e03412208c6a534be8210424046ef9285618b79d1593e340ff"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "requirements.txt"}, "region": {"startLine": 478}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose."}, "properties": {"repobilityId": 469503, "scanner": "repobility-ast-engine", "fingerprint": "b0a3562eb717bc56afcda3bfee0088a3677d470fc7e08bdb803bd22f8acc13ab", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|b0a3562eb717bc56afcda3bfee0088a3677d470fc7e08bdb803bd22f8acc13ab"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/coders/base_coder.py"}, "region": {"startLine": 2038}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose."}, "properties": {"repobilityId": 469469, "scanner": "repobility-ast-engine", "fingerprint": "b82252cb93240c64feb85ecf09f80f4751f220af2c85262c920e5d7511b5b3f0", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|b82252cb93240c64feb85ecf09f80f4751f220af2c85262c920e5d7511b5b3f0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/report.py"}, "region": {"startLine": 138}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose."}, "properties": {"repobilityId": 469467, "scanner": "repobility-ast-engine", "fingerprint": "2cb26f77375128e39976db2c954166ba781db0107fa4f8f3db1b5d9c673e0482", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|2cb26f77375128e39976db2c954166ba781db0107fa4f8f3db1b5d9c673e0482"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/main.py"}, "region": {"startLine": 1267}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose."}, "properties": {"repobilityId": 469465, "scanner": "repobility-ast-engine", "fingerprint": "92463cedfa4ed8694f34207355c1199d4bccc3725b0e3270408b054b5d9a603d", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|92463cedfa4ed8694f34207355c1199d4bccc3725b0e3270408b054b5d9a603d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/scrape.py"}, "region": {"startLine": 29}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose."}, "properties": {"repobilityId": 469462, "scanner": "repobility-ast-engine", "fingerprint": "6090fa9bb84840eac32ace1a3989062a97d0ec73aae63299b675e444d31aee3b", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|6090fa9bb84840eac32ace1a3989062a97d0ec73aae63299b675e444d31aee3b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/io.py"}, "region": {"startLine": 1099}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose."}, "properties": {"repobilityId": 469461, "scanner": "repobility-ast-engine", "fingerprint": "e361d643646205cb746679a0a5bae74c99d1b45ee523cf701a537ddfaf4febc8", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|e361d643646205cb746679a0a5bae74c99d1b45ee523cf701a537ddfaf4febc8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/io.py"}, "region": {"startLine": 140}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose."}, "properties": {"repobilityId": 469460, "scanner": "repobility-ast-engine", "fingerprint": "37708f1dd1df413bfd0a0ddadbfa82cfdcb8cdc08ea6fea8393eb4ed7f59ad0b", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|37708f1dd1df413bfd0a0ddadbfa82cfdcb8cdc08ea6fea8393eb4ed7f59ad0b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/models.py"}, "region": {"startLine": 256}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose."}, "properties": {"repobilityId": 469458, "scanner": "repobility-ast-engine", "fingerprint": "3e10771483ebc129383afdd2e0cd7d3d9ce61f6d9fc1cbb602de9a4e747ba7f8", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|3e10771483ebc129383afdd2e0cd7d3d9ce61f6d9fc1cbb602de9a4e747ba7f8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/linter.py"}, "region": {"startLine": 216}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose."}, "properties": {"repobilityId": 469457, "scanner": "repobility-ast-engine", "fingerprint": "610806e9292461f324dd88d1704942c200b93b1bccf6e6c3270f6370a9da6dd7", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|610806e9292461f324dd88d1704942c200b93b1bccf6e6c3270f6370a9da6dd7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/voice.py"}, "region": {"startLine": 172}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose."}, "properties": {"repobilityId": 469456, "scanner": "repobility-ast-engine", "fingerprint": "567f09c3b32c0c4dd8d1c7ff51bc296964558fa0b87ac71d6fef9575930d417b", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|567f09c3b32c0c4dd8d1c7ff51bc296964558fa0b87ac71d6fef9575930d417b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/watch.py"}, "region": {"startLine": 118}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose."}, "properties": {"repobilityId": 469439, "scanner": "repobility-ast-engine", "fingerprint": "bf38628745acee665be3e4e9e99f8f727471eac7d80f2436429507dad6d62a57", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|bf38628745acee665be3e4e9e99f8f727471eac7d80f2436429507dad6d62a57"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/__init__.py"}, "region": {"startLine": 17}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose."}, "properties": {"repobilityId": 469438, "scanner": "repobility-ast-engine", "fingerprint": "50c913bab1195854784015b4bfbd0488c3248f7fa5b0813379755c0a41230c32", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|50c913bab1195854784015b4bfbd0488c3248f7fa5b0813379755c0a41230c32"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/__init__.py"}, "region": {"startLine": 8}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose."}, "properties": {"repobilityId": 469437, "scanner": "repobility-ast-engine", "fingerprint": "81dcaf0e20c9fccaaae426aa190401639855bca573825cad27abcc645732eb35", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|81dcaf0e20c9fccaaae426aa190401639855bca573825cad27abcc645732eb35"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/history.py"}, "region": {"startLine": 120}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose."}, "properties": {"repobilityId": 469436, "scanner": "repobility-ast-engine", "fingerprint": "0a853f2e42f3183ae7c22b962ffdeff344c3f218416c8d759011ef8b537b7fcd", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|0a853f2e42f3183ae7c22b962ffdeff344c3f218416c8d759011ef8b537b7fcd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/repomap.py"}, "region": {"startLine": 349}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose."}, "properties": {"repobilityId": 469435, "scanner": "repobility-ast-engine", "fingerprint": "a934e6cb643a1a1cabce06592548871e831725c6b8c84ed381fac76bd7e997f9", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|a934e6cb643a1a1cabce06592548871e831725c6b8c84ed381fac76bd7e997f9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/repomap.py"}, "region": {"startLine": 287}}}]}, {"ruleId": "JRN012", "level": "warning", "message": {"text": "Runtime environment contract is missing referenced variables"}, "properties": {"repobilityId": 469423, "scanner": "repobility-journey-contract", "fingerprint": "ef8a789b1043ec39396d7ad963c5455703b1d029f8d15210d04d49996b3186dd", "category": "quality", "severity": "medium", "confidence": 0.72, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Source code references runtime environment variables that are absent from env templates or deployment docs.", "evidence": {"rule_id": "JRN012", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "correlation_key": "fp|ef8a789b1043ec39396d7ad963c5455703b1d029f8d15210d04d49996b3186dd", "missing_env_vars": ["AIDER_BENCHMARK_DIR", "AIDER_CACHE_KEEPALIVE_DELAY", "AIDER_DOCKER_IMAGE", "AIDER_SANITY_CHECK_TURNS", "AWS_PROFILE", "EDITOR", "GITHUB_TOKEN", "GIT_AUTHOR_NAME", "GIT_COMMITTER_NAME", "NO_COLOR", "OPENAI_API_KEY", "OPENROUTER_API_KEY", "PEPY_API_KEY", "SHELL", "USE_BIGQUERY", "VISUAL"], "documented_env_vars": ["HISTORY", "SOLAR_FIELDS", "THANK"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/issues.py"}, "region": {"startLine": 67}}}]}, {"ruleId": "JRN011", "level": "warning", "message": {"text": "Mutation journey appears local-only with no backend write"}, "properties": {"repobilityId": 469422, "scanner": "repobility-journey-contract", "fingerprint": "ba8c598b7bb7ac5be704aaa07d1bcd6b366f0b0f39891f79490bbe78a9789e94", "category": "quality", "severity": "medium", "confidence": 0.69, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Mutation UI and local state writes are present without fetch/axios/API/server-action evidence.", "evidence": {"rule_id": "JRN011", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "correlation_key": "fp|ba8c598b7bb7ac5be704aaa07d1bcd6b366f0b0f39891f79490bbe78a9789e94"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/website/index.html"}, "region": {"startLine": 469}}}]}, {"ruleId": "JRN010", "level": "warning", "message": {"text": "Critical user action appears to be handled by a no-op or placeholder"}, "properties": {"repobilityId": 469421, "scanner": "repobility-journey-contract", "fingerprint": "c5a38b8b09dd8b202ddd552ae739b1547c9c83498af67df8cecf6f27d4bff8a0", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Action wording appears near alert/console/not-implemented placeholder behavior without a nearby backend call.", "evidence": {"rule_id": "JRN010", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "correlation_key": "fp|c5a38b8b09dd8b202ddd552ae739b1547c9c83498af67df8cecf6f27d4bff8a0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/website/_includes/recording.js"}, "region": {"startLine": 323}}}]}, {"ruleId": "JRN010", "level": "warning", "message": {"text": "Critical user action appears to be handled by a no-op or placeholder"}, "properties": {"repobilityId": 469420, "scanner": "repobility-journey-contract", "fingerprint": "4b6538e2214c7a798afd50d826392902e80822c8813c3f71cbe6f0eedae38168", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Action wording appears near alert/console/not-implemented placeholder behavior without a nearby backend call.", "evidence": {"rule_id": "JRN010", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "correlation_key": "fp|4b6538e2214c7a798afd50d826392902e80822c8813c3f71cbe6f0eedae38168"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/website/_includes/recording.js"}, "region": {"startLine": 318}}}]}, {"ruleId": "JRN010", "level": "warning", "message": {"text": "Critical user action appears to be handled by a no-op or placeholder"}, "properties": {"repobilityId": 469419, "scanner": "repobility-journey-contract", "fingerprint": "679e18ae7061a7fcf959549613538a12142c7bbab6300d100bc590432a0642af", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Action wording appears near alert/console/not-implemented placeholder behavior without a nearby backend call.", "evidence": {"rule_id": "JRN010", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "correlation_key": "fp|679e18ae7061a7fcf959549613538a12142c7bbab6300d100bc590432a0642af"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/website/_includes/recording.js"}, "region": {"startLine": 309}}}]}, {"ruleId": "JRN010", "level": "warning", "message": {"text": "Critical user action appears to be handled by a no-op or placeholder"}, "properties": {"repobilityId": 469418, "scanner": "repobility-journey-contract", "fingerprint": "da41c1b7624b89a2eb707dcc6eb5b501d9a231229ba93c1ad95dbcc8d7ae31e6", "category": "quality", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Action wording appears near alert/console/not-implemented placeholder behavior without a nearby backend call.", "evidence": {"rule_id": "JRN010", "scanner": "repobility-journey-contract", "references": ["https://repobility.com/library/authorization/"], "correlation_key": "fp|da41c1b7624b89a2eb707dcc6eb5b501d9a231229ba93c1ad95dbcc8d7ae31e6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/website/_includes/recording.js"}, "region": {"startLine": 305}}}]}, {"ruleId": "AUC001", "level": "warning", "message": {"text": "[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation."}, "properties": {"repobilityId": 469417, "scanner": "repobility-access-control", "fingerprint": "f1305052c3ba1e6c1cdb5dccc19e58a8168cf78b176658f32b1fc823df3e9d10", "category": "auth", "severity": "medium", "confidence": 0.92, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"scanner": "repobility-access-control", "frameworks": ["Django", "FastAPI"], "expected_files": [".repobility/access.yml", ".repobility/access.yaml", ".repobility/access.json", ".repobility/authorization.yml"], "correlation_key": "fp|f1305052c3ba1e6c1cdb5dccc19e58a8168cf78b176658f32b1fc823df3e9d10"}}}, {"ruleId": "DKR001", "level": "warning", "message": {"text": "Docker final stage has no non-root USER"}, "properties": {"repobilityId": 469416, "scanner": "repobility-docker", "fingerprint": "c4c5708feb4b505883785442dc737d840c19174b115529ef05fd6152b4fd95a9", "category": "docker", "severity": "medium", "confidence": 0.82, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "No USER directive was found in the final runtime stage.", "evidence": {"rule_id": "DKR001", "scanner": "repobility-docker", "final_base": "bretfisher/jekyll-serve", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|c4c5708feb4b505883785442dc737d840c19174b115529ef05fd6152b4fd95a9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/Dockerfile.jekyll"}, "region": {"startLine": 2}}}]}, {"ruleId": "DKR002", "level": "warning", "message": {"text": "Dockerfile base image has no explicit tag"}, "properties": {"repobilityId": 469413, "scanner": "repobility-docker", "fingerprint": "db0407a26e324d2203d3ca6083ff10f85cdb8f74f449d21bf2f444eabee4b6d3", "category": "docker", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Image reference has no tag or digest.", "evidence": {"image": "bretfisher/jekyll-serve", "rule_id": "DKR002", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/scout/policy/", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|db0407a26e324d2203d3ca6083ff10f85cdb8f74f449d21bf2f444eabee4b6d3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/Dockerfile.jekyll"}, "region": {"startLine": 2}}}]}, {"ruleId": "DKR014", "level": "warning", "message": {"text": "Dockerfile copies broad context with incomplete .dockerignore"}, "properties": {"repobilityId": 469412, "scanner": "repobility-docker", "fingerprint": "d3e90180519d5957a6f921fcca71d382a8deead471721ce03e5c1bbde66ba176", "category": "docker", "severity": "medium", "confidence": 0.76, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Broad context copy found and .dockerignore misses sensitive defaults.", "evidence": {"rule_id": "DKR014", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/"], "correlation_key": "fp|d3e90180519d5957a6f921fcca71d382a8deead471721ce03e5c1bbde66ba176", "missing_patterns": [".git", "id_rsa", "*.pem", "*.key"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker/Dockerfile"}, "region": {"startLine": 63}}}]}, {"ruleId": "DKR014", "level": "warning", "message": {"text": "Dockerfile copies broad context with incomplete .dockerignore"}, "properties": {"repobilityId": 469411, "scanner": "repobility-docker", "fingerprint": "f1ec54d5ee1d7f50fd5d6471318762045e01ce473e247c9d50c0b5b295db7a6b", "category": "docker", "severity": "medium", "confidence": 0.76, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Broad context copy found and .dockerignore misses sensitive defaults.", "evidence": {"rule_id": "DKR014", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/"], "correlation_key": "fp|f1ec54d5ee1d7f50fd5d6471318762045e01ce473e247c9d50c0b5b295db7a6b", "missing_patterns": [".git", "id_rsa", "*.pem", "*.key"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker/Dockerfile"}, "region": {"startLine": 39}}}]}, {"ruleId": "DKR001", "level": "warning", "message": {"text": "Docker final stage has no non-root USER"}, "properties": {"repobilityId": 469409, "scanner": "repobility-docker", "fingerprint": "542db68997c0143d64f49637e6400516e00023d892fe15c936b66c6028c94bf8", "category": "docker", "severity": "medium", "confidence": 0.82, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "No USER directive was found in the final runtime stage.", "evidence": {"rule_id": "DKR001", "scanner": "repobility-docker", "final_base": "buildpack-deps:jammy", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|542db68997c0143d64f49637e6400516e00023d892fe15c936b66c6028c94bf8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmark/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "DKR014", "level": "warning", "message": {"text": "Dockerfile copies broad context with incomplete .dockerignore"}, "properties": {"repobilityId": 469408, "scanner": "repobility-docker", "fingerprint": "d3ad31c78897639c3d582ae1fd255c722cb2c71f26fb77aecf58c567dc4452e0", "category": "docker", "severity": "medium", "confidence": 0.76, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Broad context copy found and .dockerignore misses sensitive defaults.", "evidence": {"rule_id": "DKR014", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/"], "correlation_key": "fp|d3ad31c78897639c3d582ae1fd255c722cb2c71f26fb77aecf58c567dc4452e0", "missing_patterns": [".git", "id_rsa", "*.pem", "*.key"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmark/Dockerfile"}, "region": {"startLine": 60}}}]}, {"ruleId": "DKR013", "level": "warning", "message": {"text": "Dockerfile ADD downloads remote content"}, "properties": {"repobilityId": 469405, "scanner": "repobility-docker", "fingerprint": "d8e4843bf6e9171e97af961fc78b384ac3deca38ffd5a44c0c46ebb245501005", "category": "docker", "severity": "medium", "confidence": 0.84, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "ADD instruction references a remote URL.", "evidence": {"rule_id": "DKR013", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|d8e4843bf6e9171e97af961fc78b384ac3deca38ffd5a44c0c46ebb245501005"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmark/Dockerfile"}, "region": {"startLine": 38}}}]}, {"ruleId": "AGT015", "level": "warning", "message": {"text": "Remote install command pipes network code directly to a shell"}, "properties": {"repobilityId": 469403, "scanner": "repobility-agent-runtime", "fingerprint": "e65f91d9b8920d46cec23d939e16378ec41434b0ffb0dbd50cd7672622846fd7", "category": "dependency", "severity": "medium", "confidence": 0.7, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "File contains a remote download piped directly to a shell without visible checksum or signature verification.", "evidence": {"rule_id": "AGT015", "scanner": "repobility-agent-runtime", "references": [], "correlation_key": "fp|e65f91d9b8920d46cec23d939e16378ec41434b0ffb0dbd50cd7672622846fd7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/website/docs/install.md"}, "region": {"startLine": 36}}}]}, {"ruleId": "AGT015", "level": "warning", "message": {"text": "Remote install command pipes network code directly to a shell"}, "properties": {"repobilityId": 469402, "scanner": "repobility-agent-runtime", "fingerprint": "076cd6e960652ce492ccb4628e42a107e9fdc2e43a70c867347fdfb1553d3939", "category": "dependency", "severity": "medium", "confidence": 0.7, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "File contains a remote download piped directly to a shell without visible checksum or signature verification.", "evidence": {"rule_id": "AGT015", "scanner": "repobility-agent-runtime", "references": [], "correlation_key": "fp|076cd6e960652ce492ccb4628e42a107e9fdc2e43a70c867347fdfb1553d3939"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/website/_posts/2025-01-15-uv.md"}, "region": {"startLine": 25}}}]}, {"ruleId": "AIC017", "level": "warning", "message": {"text": "Shipping source still contains a stub implementation"}, "properties": {"repobilityId": 469401, "scanner": "repobility-ai-code-hygiene", "fingerprint": "2ef04a7e35a9fee2809867c2d45106ae5db78e7aea7a4289b7fc082642166aac", "category": "quality", "severity": "medium", "confidence": 0.76, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Non-test source contains an executable stub marker.", "evidence": {"rule_id": "AIC017", "scanner": "repobility-ai-code-hygiene", "references": ["https://arxiv.org/abs/2601.15195"], "correlation_key": "fp|2ef04a7e35a9fee2809867c2d45106ae5db78e7aea7a4289b7fc082642166aac"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/repomap.py"}, "region": {"startLine": 223}}}]}, {"ruleId": "AIC017", "level": "warning", "message": {"text": "Shipping source still contains a stub implementation"}, "properties": {"repobilityId": 469400, "scanner": "repobility-ai-code-hygiene", "fingerprint": "f668ea0e6b9c3998d4188b4d8f9f88bd3586457e81c8cc5540f5d0df9317e809", "category": "quality", "severity": "medium", "confidence": 0.76, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Non-test source contains an executable stub marker.", "evidence": {"rule_id": "AIC017", "scanner": "repobility-ai-code-hygiene", "references": ["https://arxiv.org/abs/2601.15195"], "correlation_key": "fp|f668ea0e6b9c3998d4188b4d8f9f88bd3586457e81c8cc5540f5d0df9317e809"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/gui.py"}, "region": {"startLine": 165}}}]}, {"ruleId": "AIC017", "level": "warning", "message": {"text": "Shipping source still contains a stub implementation"}, "properties": {"repobilityId": 469399, "scanner": "repobility-ai-code-hygiene", "fingerprint": "bbf6efe469f47ba41f464fb4f951bc9688b5d44d95ce306521dceda3f594acf9", "category": "quality", "severity": "medium", "confidence": 0.76, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Non-test source contains an executable stub marker.", "evidence": {"rule_id": "AIC017", "scanner": "repobility-ai-code-hygiene", "references": ["https://arxiv.org/abs/2601.15195"], "correlation_key": "fp|bbf6efe469f47ba41f464fb4f951bc9688b5d44d95ce306521dceda3f594acf9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/coders/help_coder.py"}, "region": {"startLine": 14}}}]}, {"ruleId": "AIC017", "level": "warning", "message": {"text": "Shipping source still contains a stub implementation"}, "properties": {"repobilityId": 469398, "scanner": "repobility-ai-code-hygiene", "fingerprint": "7f6b08863386482d9e551e4728ae2c0af7487ad12c71a69796665d2eedfa4d7e", "category": "quality", "severity": "medium", "confidence": 0.76, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Non-test source contains an executable stub marker.", "evidence": {"rule_id": "AIC017", "scanner": "repobility-ai-code-hygiene", "references": ["https://arxiv.org/abs/2601.15195"], "correlation_key": "fp|7f6b08863386482d9e551e4728ae2c0af7487ad12c71a69796665d2eedfa4d7e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/coders/context_coder.py"}, "region": {"startLine": 51}}}]}, {"ruleId": "AIC017", "level": "warning", "message": {"text": "Shipping source still contains a stub implementation"}, "properties": {"repobilityId": 469397, "scanner": "repobility-ai-code-hygiene", "fingerprint": "b8d8fe8534f364641fdb1e74e719972ea2e28f3a77c99c30aae14d35357a712b", "category": "quality", "severity": "medium", "confidence": 0.76, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Non-test source contains an executable stub marker.", "evidence": {"rule_id": "AIC017", "scanner": "repobility-ai-code-hygiene", "references": ["https://arxiv.org/abs/2601.15195"], "correlation_key": "fp|b8d8fe8534f364641fdb1e74e719972ea2e28f3a77c99c30aae14d35357a712b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/coders/base_coder.py"}, "region": {"startLine": 1624}}}]}, {"ruleId": "ERR001", "level": "warning", "message": {"text": "[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level."}, "properties": {"repobilityId": 469371, "scanner": "repobility-threat-engine", "fingerprint": "c182c651881cb7daccc8257aaa76f34644ff9eca981e80fe0e9166fd17db09cd", "category": "error_handling", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "except Exception:\n        pass", "reason": "Pattern matched with no mitigating context found", "rule_id": "ERR001", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|c182c651881cb7daccc8257aaa76f34644ff9eca981e80fe0e9166fd17db09cd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/utils.py"}, "region": {"startLine": 221}}}]}, {"ruleId": "ERR001", "level": "warning", "message": {"text": "[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level."}, "properties": {"repobilityId": 469370, "scanner": "repobility-threat-engine", "fingerprint": "aab137c8477d5c3485db8a144b9a24faa740b61e60142d5663872654d4ac9a87", "category": "error_handling", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "except Exception:\n        pass", "reason": "Pattern matched with no mitigating context found", "rule_id": "ERR001", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|aab137c8477d5c3485db8a144b9a24faa740b61e60142d5663872654d4ac9a87"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/report.py"}, "region": {"startLine": 81}}}]}, {"ruleId": "ERR001", "level": "warning", "message": {"text": "[ERR001] Silent Exception Swallowing: Silently swallowing all exceptions hides bugs. Even in cleanup code, log at DEBUG level."}, "properties": {"repobilityId": 469369, "scanner": "repobility-threat-engine", "fingerprint": "a405bb48488252ebf699bc8319a0f8e5a21f13e216d5b0dc7a0faee7ecb04a2f", "category": "error_handling", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "except Exception:\n                pass", "reason": "Pattern matched with no mitigating context found", "rule_id": "ERR001", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|a405bb48488252ebf699bc8319a0f8e5a21f13e216d5b0dc7a0faee7ecb04a2f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/mdstream.py"}, "region": {"startLine": 146}}}]}, {"ruleId": "SEC136", "level": "warning", "message": {"text": "[SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all exception block that silently returns success or no-ops. AI agents reach for this pattern when a flaky test or an unfamiliar API throws \u2014 wrap, swallow, return success. Real bugs are masked, observability is destroyed, and callers think the operation worked. CWE-396 (improperly-generalized exception). Distinct from intentional fallback because there's no log line and the success value is fabricated."}, "properties": {"repobilityId": 469368, "scanner": "repobility-threat-engine", "fingerprint": "cc6ca27e9bdd1dd9bbfeba2f5a38ae409a26e520df18e9585723631f1bfd772b", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "try:\n        current_process = psutil.Process()\n        while True:\n            parent = current_pro", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC136", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|cc6ca27e9bdd1dd9bbfeba2f5a38ae409a26e520df18e9585723631f1bfd772b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/run_cmd.py"}, "region": {"startLine": 27}}}]}, {"ruleId": "SEC136", "level": "warning", "message": {"text": "[SEC136] AI-typical over-broad exception handler swallowing all errors: Catch-all exception block that silently returns success or no-ops. AI agents reach for this pattern when a flaky test or an unfamiliar API throws \u2014 wrap, swallow, return success. Real bugs are masked, observability is destroyed, and callers think the operation worked. CWE-396 (improperly-generalized exception). Distinct from intentional fallback because there's no log line and the success value is fabricated."}, "properties": {"repobilityId": 469367, "scanner": "repobility-threat-engine", "fingerprint": "083f265a00176a1444865f767562738edfb8a05e007b9952570f04fb0cb7139a", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "except Exception:\n                pass  # Ignore", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC136", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|083f265a00176a1444865f767562738edfb8a05e007b9952570f04fb0cb7139a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/mdstream.py"}, "region": {"startLine": 146}}}]}, {"ruleId": "SEC017", "level": "warning", "message": {"text": "[SEC017] Unbounded Input to LLM/External API: User input is passed to an LLM or external AI API (OpenAI, Anthropic, etc.) without any visible length or size validation. This creates two risks: (1) Cost abuse \u2014 an attacker can send extremely long inputs to burn through your API credits (a single 128K-token request to GPT-4 costs ~$4, and automated attacks can drain budgets in minutes). (2) Context stuffing \u2014 oversized inputs can push your system prompt out of the context window, effectively disab"}, "properties": {"repobilityId": 469365, "scanner": "repobility-threat-engine", "fingerprint": "00b84e46b07f826274b1af7df7424c2c4f207dbae68e5e5d7f795c51030d5d6f", "category": "llm_injection", "severity": "medium", "confidence": 0.8, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "This file sends user input to an LLM with no visible length check or rate limit. Risks: (1) cost abuse \u2014 automated long inputs drain API budget ($4/request at 128K tokens on GPT-4), (2) context stuffing \u2014 oversized input pushes system prompt out of context window, disabling safety rules. Add input length validation before the API call.", "evidence": {"reason": "This file sends user input to an LLM with no visible length check or rate limit. Risks: (1) cost abuse \u2014 automated long inputs drain API budget ($4/request at 128K tokens on GPT-4), (2) context stuffing \u2014 oversized input pushes system prompt out of context window, disabling safety rules. Add input length validation before the API call.", "rule_id": "SEC017", "scanner": "repobility-threat-engine", "confidence": 0.8, "correlation_key": "fp|00b84e46b07f826274b1af7df7424c2c4f207dbae68e5e5d7f795c51030d5d6f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/format_settings.py"}, "region": {"startLine": 5}}}]}, {"ruleId": "SEC005", "level": "warning", "message": {"text": "[SEC005] Command Injection Risk: Unsafe shell execution or eval of user input."}, "properties": {"repobilityId": 469361, "scanner": "repobility-threat-engine", "fingerprint": "294bffd102c44cb8f598c1221fa81b9bf9275ec0d5611558e734d4000fdf7855", "category": "injection", "severity": "medium", "confidence": 0.5, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "shell=True detected \u2014 verify command source is not user-controllable", "evidence": {"match": "subprocess.Popen(\n            command,\n            stdout=subprocess.PIPE,\n            stderr=subpro", "reason": "shell=True detected \u2014 verify command source is not user-controllable", "rule_id": "SEC005", "scanner": "repobility-threat-engine", "confidence": 0.5, "correlation_key": "code|injection|aider/run_cmd.py|62|sec005"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/run_cmd.py"}, "region": {"startLine": 62}}}]}, {"ruleId": "SEC005", "level": "warning", "message": {"text": "[SEC005] Command Injection Risk: Unsafe shell execution or eval of user input."}, "properties": {"repobilityId": 469360, "scanner": "repobility-threat-engine", "fingerprint": "8ac09acce6878b154d964ea583a337fdca9e4a625582a94861a5c4e76c272195", "category": "injection", "severity": "medium", "confidence": 0.5, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "shell=True detected \u2014 verify command source is not user-controllable", "evidence": {"match": "subprocess.call(command_str, shell=True", "reason": "shell=True detected \u2014 verify command source is not user-controllable", "rule_id": "SEC005", "scanner": "repobility-threat-engine", "confidence": 0.5, "correlation_key": "code|injection|aider/editor.py|134|sec005"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/editor.py"}, "region": {"startLine": 134}}}]}, {"ruleId": "COMP001", "level": "warning", "message": {"text": "[COMP001] High cognitive complexity: Function `_format_action` has cognitive complexity 18 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion all weigh in. Breakdown: break=1, else=2, for=2, if=9, nested_bonus=4."}, "properties": {"repobilityId": 469346, "scanner": "repobility-threat-engine", "fingerprint": "ad9ae1537d364a3a22cb86e7daa3cc79d03e569fca3594d2fb718e88bb9d9371", "category": "quality", "severity": "medium", "confidence": 0.95, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "AST-derived cognitive complexity score = 18 (severity threshold for medium: 15+).", "evidence": {"scanner": "repobility-threat-engine", "function": "_format_action", "breakdown": {"if": 9, "for": 2, "else": 2, "break": 1, "nested_bonus": 4}, "complexity": 18, "correlation_key": "fp|ad9ae1537d364a3a22cb86e7daa3cc79d03e569fca3594d2fb718e88bb9d9371"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/args_formatter.py"}, "region": {"startLine": 187}}}]}, {"ruleId": "COMP001", "level": "warning", "message": {"text": "[COMP001] High cognitive complexity: Function `_format_action` has cognitive complexity 25 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion all weigh in. Breakdown: break=1, elif=6, else=3, for=1, if=10, nested_bonus=3, ternary=1."}, "properties": {"repobilityId": 469345, "scanner": "repobility-threat-engine", "fingerprint": "8c5eec5624956449a94d63679733fa35e1dc146f2ff13d6e75ec7b3760ccf1ee", "category": "quality", "severity": "medium", "confidence": 0.95, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "AST-derived cognitive complexity score = 25 (severity threshold for medium: 15+).", "evidence": {"scanner": "repobility-threat-engine", "function": "_format_action", "breakdown": {"if": 10, "for": 1, "elif": 6, "else": 3, "break": 1, "ternary": 1, "nested_bonus": 3}, "complexity": 25, "correlation_key": "fp|8c5eec5624956449a94d63679733fa35e1dc146f2ff13d6e75ec7b3760ccf1ee"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/args_formatter.py"}, "region": {"startLine": 105}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/setup-python` pinned to mutable ref `@v5`: `uses: actions/setup-python@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 469562, "scanner": "repobility-supply-chain", "fingerprint": "6d9599837d8210097f738d0515c5511c74b097b2127693eea13db2af5717c334", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|6d9599837d8210097f738d0515c5511c74b097b2127693eea13db2af5717c334"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/windows-tests.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 469561, "scanner": "repobility-supply-chain", "fingerprint": "3ce158e886c30f6dda6356554a7548f70f2026705018a733d2dc9b14fd82c4e6", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|3ce158e886c30f6dda6356554a7548f70f2026705018a733d2dc9b14fd82c4e6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/windows-tests.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/upload-artifact` pinned to mutable ref `@v4`: `uses: actions/upload-artifact@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 469560, "scanner": "repobility-supply-chain", "fingerprint": "d53f6f535a3900728fb1ac63529950307a3582fada1c4cc62d67ab60edf89702", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|d53f6f535a3900728fb1ac63529950307a3582fada1c4cc62d67ab60edf89702"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pre-commit.yml"}, "region": {"startLine": 41}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/cache/save` pinned to mutable ref `@v4`: `uses: actions/cache/save@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 469559, "scanner": "repobility-supply-chain", "fingerprint": "2a53bc0a15026adf246d366e84f1402be7a2e9b29e5498dc4776fa849dbddb71", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|2a53bc0a15026adf246d366e84f1402be7a2e9b29e5498dc4776fa849dbddb71"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pre-commit.yml"}, "region": {"startLine": 35}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/cache/restore` pinned to mutable ref `@v4`: `uses: actions/cache/restore@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 469557, "scanner": "repobility-supply-chain", "fingerprint": "945c3df6972e554b66b64799d50d5b477ab8bdc1a459dd438a6cef8819306488", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|945c3df6972e554b66b64799d50d5b477ab8bdc1a459dd438a6cef8819306488"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pre-commit.yml"}, "region": {"startLine": 18}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 469556, "scanner": "repobility-supply-chain", "fingerprint": "5b843d475614111da4e90c027f986a7eccd9c47e5b938608c0c35cfc2e511570", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|5b843d475614111da4e90c027f986a7eccd9c47e5b938608c0c35cfc2e511570"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pre-commit.yml"}, "region": {"startLine": 16}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 469555, "scanner": "repobility-supply-chain", "fingerprint": "a8acd7a478b91b0c3e4bc50c4b17ac9fc68812f94a3e379da40c506a5955b189", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|a8acd7a478b91b0c3e4bc50c4b17ac9fc68812f94a3e379da40c506a5955b189"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/check_pypi_version.yml"}, "region": {"startLine": 53}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/setup-python` pinned to mutable ref `@v5`: `uses: actions/setup-python@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 469554, "scanner": "repobility-supply-chain", "fingerprint": "41d2a551b1bfdfbb50f92a241b12201e621a021bbce07b2adc22aa819b1585df", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|41d2a551b1bfdfbb50f92a241b12201e621a021bbce07b2adc22aa819b1585df"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/check_pypi_version.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/setup-python` pinned to mutable ref `@v4`: `uses: actions/setup-python@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 469553, "scanner": "repobility-supply-chain", "fingerprint": "c5ea289abd6754fd8b7062ba03dd79c271495f7584c58727a1816b01db656d94", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|c5ea289abd6754fd8b7062ba03dd79c271495f7584c58727a1816b01db656d94"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/issues.yml"}, "region": {"startLine": 17}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/checkout` pinned to mutable ref `@v3`: `uses: actions/checkout@v3` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 469552, "scanner": "repobility-supply-chain", "fingerprint": "71fce9c23becd145f82e4fbf460cb6a0eced68b381e57e6a95a1039935bb5bdf", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|71fce9c23becd145f82e4fbf460cb6a0eced68b381e57e6a95a1039935bb5bdf"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/issues.yml"}, "region": {"startLine": 14}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/setup-python` pinned to mutable ref `@v5`: `uses: actions/setup-python@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 469551, "scanner": "repobility-supply-chain", "fingerprint": "378dabbd08dc8524f203438fb9f741e3d32e5b4ef23f90fd13f25aeed64c3f69", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|378dabbd08dc8524f203438fb9f741e3d32e5b4ef23f90fd13f25aeed64c3f69"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 76}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/deploy-pages` pinned to mutable ref `@v4`: `uses: actions/deploy-pages@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 469550, "scanner": "repobility-supply-chain", "fingerprint": "7a092c2099c0caa29fb34146632b053d23773ba55f9996ca5333f7afbf13f661", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|7a092c2099c0caa29fb34146632b053d23773ba55f9996ca5333f7afbf13f661"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 73}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/upload-pages-artifact` pinned to mutable ref `@v3`: `uses: actions/upload-pages-artifact@v3` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 469549, "scanner": "repobility-supply-chain", "fingerprint": "e3c6fa5eefed6b55e0ecb443a1ec3ef6fff2480c677fd0d0b16d071d752170e4", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|e3c6fa5eefed6b55e0ecb443a1ec3ef6fff2480c677fd0d0b16d071d752170e4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 59}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/configure-pages` pinned to mutable ref `@v3`: `uses: actions/configure-pages@v3` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 469548, "scanner": "repobility-supply-chain", "fingerprint": "80ebae7e6304ffd0f87dd2fdd3113692a452e522fcac72dea9a838cb489e508d", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|80ebae7e6304ffd0f87dd2fdd3113692a452e522fcac72dea9a838cb489e508d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 52}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 469546, "scanner": "repobility-supply-chain", "fingerprint": "5c16c40adedd15d5c30d65b6637b8909512ad41f85af219fe4dc32e7d6502fd3", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|5c16c40adedd15d5c30d65b6637b8909512ad41f85af219fe4dc32e7d6502fd3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/setup-python` pinned to mutable ref `@v5`: `uses: actions/setup-python@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 469545, "scanner": "repobility-supply-chain", "fingerprint": "7804c0f2ea050b2ab3daa2572a51420585b97ac364f40f6de7564963b251232a", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|7804c0f2ea050b2ab3daa2572a51420585b97ac364f40f6de7564963b251232a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 469544, "scanner": "repobility-supply-chain", "fingerprint": "0f2ff7d96043d786446d2fdfa1671a103d207ed8a53a8ce6b0e61531e81d1e0a", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|0f2ff7d96043d786446d2fdfa1671a103d207ed8a53a8ce6b0e61531e81d1e0a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 14}}}]}, {"ruleId": "MINED116", "level": "note", "message": {"text": "[MINED116] Workflow references `secrets.DOCKERHUB_USERNAME` in a `pull_request` workflow: `pull_request` workflows from forks do not receive normal repository secrets, so `${ secrets.DOCKERHUB_USERNAME }` is usually empty for untrusted fork PRs. This is a reliability/intent signal, not direct fork-secret exfiltration. Keep high severity for pull_request_target or trusted-context jobs that run untrusted PR code with secrets."}, "properties": {"repobilityId": 469543, "scanner": "repobility-supply-chain", "fingerprint": "467fa2bfa41159cbaa9b34975832836dd7c66a675431d560001af337daa4afd6", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-pull-request-secrets", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|467fa2bfa41159cbaa9b34975832836dd7c66a675431d560001af337daa4afd6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-build-test.yml"}, "region": {"startLine": 84}}}]}, {"ruleId": "MINED116", "level": "note", "message": {"text": "[MINED116] Workflow references `secrets.DOCKERHUB_USERNAME` in a `pull_request` workflow: `pull_request` workflows from forks do not receive normal repository secrets, so `${ secrets.DOCKERHUB_USERNAME }` is usually empty for untrusted fork PRs. This is a reliability/intent signal, not direct fork-secret exfiltration. Keep high severity for pull_request_target or trusted-context jobs that run untrusted PR code with secrets."}, "properties": {"repobilityId": 469542, "scanner": "repobility-supply-chain", "fingerprint": "518fdf3af9a586bec6adbee87c637311f1af8993a9792984436b7c591dd4f220", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-pull-request-secrets", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|518fdf3af9a586bec6adbee87c637311f1af8993a9792984436b7c591dd4f220"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-build-test.yml"}, "region": {"startLine": 63}}}]}, {"ruleId": "MINED116", "level": "note", "message": {"text": "[MINED116] Workflow references `secrets.DOCKERHUB_PASSWORD` in a `pull_request` workflow: `pull_request` workflows from forks do not receive normal repository secrets, so `${ secrets.DOCKERHUB_PASSWORD }` is usually empty for untrusted fork PRs. This is a reliability/intent signal, not direct fork-secret exfiltration. Keep high severity for pull_request_target or trusted-context jobs that run untrusted PR code with secrets."}, "properties": {"repobilityId": 469541, "scanner": "repobility-supply-chain", "fingerprint": "41dcb3a4d9533aec91670030947b3edb03717a852c00e74fa5b2b0a693e0651e", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-pull-request-secrets", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|41dcb3a4d9533aec91670030947b3edb03717a852c00e74fa5b2b0a693e0651e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-build-test.yml"}, "region": {"startLine": 43}}}]}, {"ruleId": "MINED116", "level": "note", "message": {"text": "[MINED116] Workflow references `secrets.DOCKERHUB_USERNAME` in a `pull_request` workflow: `pull_request` workflows from forks do not receive normal repository secrets, so `${ secrets.DOCKERHUB_USERNAME }` is usually empty for untrusted fork PRs. This is a reliability/intent signal, not direct fork-secret exfiltration. Keep high severity for pull_request_target or trusted-context jobs that run untrusted PR code with secrets."}, "properties": {"repobilityId": 469540, "scanner": "repobility-supply-chain", "fingerprint": "f3e7ebeb8626c62a54afcc33f3faf15d57705945c1c3367811d68a06a5e8c91e", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-pull-request-secrets", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|f3e7ebeb8626c62a54afcc33f3faf15d57705945c1c3367811d68a06a5e8c91e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-build-test.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 469539, "scanner": "repobility-supply-chain", "fingerprint": "62cdc8a151b7c69e38db61e30666b87d549b2ce484aab02f83a53f39b707b0f2", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|62cdc8a151b7c69e38db61e30666b87d549b2ce484aab02f83a53f39b707b0f2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-build-test.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 469538, "scanner": "repobility-supply-chain", "fingerprint": "b5633c346de96fea1ce614e5bd230109f47a3828178da09b620ec585491d9534", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|b5633c346de96fea1ce614e5bd230109f47a3828178da09b620ec585491d9534"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-release.yml"}, "region": {"startLine": 14}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 469537, "scanner": "repobility-supply-chain", "fingerprint": "2536c96b12cabfa251e66e561bdff712948ab32909d0642ca98bb4d407556cd0", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|2536c96b12cabfa251e66e561bdff712948ab32909d0642ca98bb4d407556cd0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/windows_check_pypi_version.yml"}, "region": {"startLine": 56}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/setup-python` pinned to mutable ref `@v5`: `uses: actions/setup-python@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 469536, "scanner": "repobility-supply-chain", "fingerprint": "67a7f0c3878385b5d15a3a6c739a819f1b26be22507f0d6f517ce17b66baaddb", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|67a7f0c3878385b5d15a3a6c739a819f1b26be22507f0d6f517ce17b66baaddb"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/windows_check_pypi_version.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/setup-python` pinned to mutable ref `@v5`: `uses: actions/setup-python@v5` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 469535, "scanner": "repobility-supply-chain", "fingerprint": "f0d4094f2d442156db33be034700369bb640a09d37a0fb7043385100ef05da99", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|f0d4094f2d442156db33be034700369bb640a09d37a0fb7043385100ef05da99"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ubuntu-tests.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "MINED115", "level": "note", "message": {"text": "[MINED115] Action `actions/checkout` pinned to mutable ref `@v4`: `uses: actions/checkout@v4` resolves at workflow-run time. Tags and branches can be re-pushed by the action owner; that made the tj-actions/changed-files compromise (2025) instantly affect many repos. Treat official first-party action tags as lower risk, but pin security-sensitive third-party actions to a 40-char commit SHA + lock with Dependabot or renovate."}, "properties": {"repobilityId": 469534, "scanner": "repobility-supply-chain", "fingerprint": "5de4ea6f3247a0495b3baedeb0547389ef948733520008feb9e6271dacae6a1e", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "gha-mutable-ref", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|5de4ea6f3247a0495b3baedeb0547389ef948733520008feb9e6271dacae6a1e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ubuntu-tests.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "DKR011", "level": "note", "message": {"text": "Dockerfile installs recommended OS packages"}, "properties": {"repobilityId": 469415, "scanner": "repobility-docker", "fingerprint": "301a1363b493767bff73e2bb58b7d6f2b9e04376793058cbbbfb1cf120670d33", "category": "docker", "severity": "low", "confidence": 0.72, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "apt install appears without --no-install-recommends.", "evidence": {"rule_id": "DKR011", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|301a1363b493767bff73e2bb58b7d6f2b9e04376793058cbbbfb1cf120670d33"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/Dockerfile.jekyll"}, "region": {"startLine": 10}}}]}, {"ruleId": "DKR010", "level": "note", "message": {"text": "Dockerfile leaves apt package indexes in the image layer"}, "properties": {"repobilityId": 469414, "scanner": "repobility-docker", "fingerprint": "73318b193d6f05b9cb64cc4c4619170156910288123366a03db778ef213831f0", "category": "docker", "severity": "low", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "apt update/install layer does not remove /var/lib/apt/lists.", "evidence": {"rule_id": "DKR010", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/"], "correlation_key": "fp|73318b193d6f05b9cb64cc4c4619170156910288123366a03db778ef213831f0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/Dockerfile.jekyll"}, "region": {"startLine": 10}}}]}, {"ruleId": "DKR008", "level": "note", "message": {"text": ".dockerignore misses sensitive defaults"}, "properties": {"repobilityId": 469410, "scanner": "repobility-docker", "fingerprint": "aea2ad92c68c4ee1f8432bb1ec25e7d45ac12c9e1790ac2d3fffe638b1acce12", "category": "docker", "severity": "low", "confidence": 0.72, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "A Docker build context should exclude secrets and repository metadata.", "evidence": {"rule_id": "DKR008", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/"], "correlation_key": "fp|aea2ad92c68c4ee1f8432bb1ec25e7d45ac12c9e1790ac2d3fffe638b1acce12", "missing_patterns": [".git", "id_rsa", "*.pem", "*.key"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".dockerignore"}, "region": {"startLine": 1}}}]}, {"ruleId": "DKR011", "level": "note", "message": {"text": "Dockerfile installs recommended OS packages"}, "properties": {"repobilityId": 469407, "scanner": "repobility-docker", "fingerprint": "8245a08f42d32ec260c4a2b198cba0ad302b7814a6ca84a6457f9ea96351532e", "category": "docker", "severity": "low", "confidence": 0.72, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "apt install appears without --no-install-recommends.", "evidence": {"rule_id": "DKR011", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|8245a08f42d32ec260c4a2b198cba0ad302b7814a6ca84a6457f9ea96351532e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmark/Dockerfile"}, "region": {"startLine": 43}}}]}, {"ruleId": "DKR011", "level": "note", "message": {"text": "Dockerfile installs recommended OS packages"}, "properties": {"repobilityId": 469404, "scanner": "repobility-docker", "fingerprint": "5c76b44df5dddc2076284b129d7c986334c69b33d62716229cb5f9bc2d9026bb", "category": "docker", "severity": "low", "confidence": 0.72, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "apt install appears without --no-install-recommends.", "evidence": {"rule_id": "DKR011", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|5c76b44df5dddc2076284b129d7c986334c69b33d62716229cb5f9bc2d9026bb"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmark/Dockerfile"}, "region": {"startLine": 4}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 469396, "scanner": "repobility-ai-code-hygiene", "fingerprint": "011b0d713a7169a7c192ac0cf70c2e06514eec49c1369edd594c7dc496b03a7a", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "aider/website/_includes/quant-chart.js", "duplicate_line": 5, "correlation_key": "fp|011b0d713a7169a7c192ac0cf70c2e06514eec49c1369edd594c7dc496b03a7a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/website/_includes/qwq-chart.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 469395, "scanner": "repobility-ai-code-hygiene", "fingerprint": "70a48e6797223484a0fc65a38a19c159d76f5deb6fa538669666d864a8eb0589", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "aider/website/_includes/code-in-json-benchmark.js", "duplicate_line": 27, "correlation_key": "fp|70a48e6797223484a0fc65a38a19c159d76f5deb6fa538669666d864a8eb0589"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/website/_includes/code-in-json-syntax.js"}, "region": {"startLine": 27}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 469394, "scanner": "repobility-ai-code-hygiene", "fingerprint": "3dc61457af7fcbff7d7375a7989d7118e62eba158556eaf4dd26a4b45bd78ad8", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "aider/coders/single_wholefile_func_coder.py", "duplicate_line": 52, "correlation_key": "fp|3dc61457af7fcbff7d7375a7989d7118e62eba158556eaf4dd26a4b45bd78ad8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/coders/wholefile_func_coder.py"}, "region": {"startLine": 73}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 469393, "scanner": "repobility-ai-code-hygiene", "fingerprint": "921790cbebb670df1e996518e271754c742080da9da6c88dfdba2c95a46b9c7d", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "aider/coders/editblock_fenced_prompts.py", "duplicate_line": 3, "correlation_key": "fp|921790cbebb670df1e996518e271754c742080da9da6c88dfdba2c95a46b9c7d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/coders/editblock_prompts.py"}, "region": {"startLine": 21}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 469392, "scanner": "repobility-ai-code-hygiene", "fingerprint": "5aed2e4c3578775c2fc23364af891b3e22618dfbe5f730b88777f9404ac61e41", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "aider/coders/architect_prompts.py", "duplicate_line": 14, "correlation_key": "fp|5aed2e4c3578775c2fc23364af891b3e22618dfbe5f730b88777f9404ac61e41"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/coders/context_prompts.py"}, "region": {"startLine": 29}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 469391, "scanner": "repobility-ai-code-hygiene", "fingerprint": "8ea724178320d59b7388c30e16dedf97874a5419bb33112899e06aa6ee663574", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "aider/coders/architect_prompts.py", "duplicate_line": 11, "correlation_key": "fp|8ea724178320d59b7388c30e16dedf97874a5419bb33112899e06aa6ee663574"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/coders/ask_prompts.py"}, "region": {"startLine": 12}}}]}, {"ruleId": "SEC124", "level": "note", "message": {"text": "[SEC124] TOCTOU file access (os.access then open): Check-then-use file pattern (access/exists then open) lets an attacker swap the file between check and use (symlink attack). `mktemp` is deprecated for the same reason."}, "properties": {"repobilityId": 469383, "scanner": "repobility-threat-engine", "fingerprint": "cc3953d0fed24bef0187ec0dbee75e76d1e08e385ca7e668a25538e798c5a03e", "category": "race_condition", "severity": "low", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "tempfile.mktemp(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC124", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|cc3953d0fed24bef0187ec0dbee75e76d1e08e385ca7e668a25538e798c5a03e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/voice.py"}, "region": {"startLine": 119}}}]}, {"ruleId": "COMP001", "level": "note", "message": {"text": "[COMP001] High cognitive complexity: Function `event` has cognitive complexity 13 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion all weigh in. Breakdown: else=1, except=2, for=1, if=6, nested_bonus=3."}, "properties": {"repobilityId": 469344, "scanner": "repobility-threat-engine", "fingerprint": "1796dea48dca3b8656b5ed25c0e1157fcda3bfb6d6af544e69b25deb97b0874d", "category": "quality", "severity": "low", "confidence": 0.95, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "AST-derived cognitive complexity score = 13 (severity threshold for low: 8+).", "evidence": {"scanner": "repobility-threat-engine", "function": "event", "breakdown": {"if": 6, "for": 1, "else": 1, "except": 2, "nested_bonus": 3}, "complexity": 13, "correlation_key": "fp|1796dea48dca3b8656b5ed25c0e1157fcda3bfb6d6af544e69b25deb97b0874d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/analytics.py"}, "region": {"startLine": 213}}}]}, {"ruleId": "MINED049", "level": "none", "message": {"text": "[MINED049] Print Pii: Logging password/token/email/ssn directly to stdout."}, "properties": {"repobilityId": 469389, "scanner": "repobility-threat-engine", "fingerprint": "942a9d6367e22757a0506b8d2c5d9ecec3c11adcc315d9733dd6ab0cc866cd37", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "print-pii", "owasp": "A09:2021", "cwe_ids": ["CWE-532"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348015+00:00", "triaged_in_corpus": 12, "observations_count": 676566, "ai_coder_pattern_id": 26}, "scanner": "repobility-threat-engine", "correlation_key": "fp|942a9d6367e22757a0506b8d2c5d9ecec3c11adcc315d9733dd6ab0cc866cd37"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/recording_audio.py"}, "region": {"startLine": 101}}}]}, {"ruleId": "SEC020", "level": "none", "message": {"text": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for troubleshooting."}, "properties": {"repobilityId": 469386, "scanner": "repobility-threat-engine", "fingerprint": "cf90ce377f5872fc10922f5e1f9b96a21d645c7854adecdd229cbd0d0f543d64", "category": "credential_exposure", "severity": "info", "confidence": 0.1, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Environment variable or config lookup (credentials loaded safely)", "evidence": {"match": "print(\"Error: OPENAI_API_KEY environment variable not set\")", "reason": "Environment variable or config lookup (credentials loaded safely)", "rule_id": "SEC020", "scanner": "repobility-threat-engine", "confidence": 0.1, "correlation_key": "secret|scripts/recording_audio.py|10|print error: openai_api_key environment variable not set"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/recording_audio.py"}, "region": {"startLine": 101}}}]}, {"ruleId": "MINED090", "level": "none", "message": {"text": "[MINED090] Python Tempfile Mktemp: tempfile.mktemp() is deprecated due to TOCTOU race."}, "properties": {"repobilityId": 469385, "scanner": "repobility-threat-engine", "fingerprint": "c01b0bbb0075280329d062e3674fdfb3d76a4f69a8910701fa2b770d7e61a695", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "python-tempfile-mktemp", "owasp": null, "cwe_ids": ["CWE-377"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348148+00:00", "triaged_in_corpus": 15, "observations_count": 483, "ai_coder_pattern_id": 121}, "scanner": "repobility-threat-engine", "correlation_key": "fp|c01b0bbb0075280329d062e3674fdfb3d76a4f69a8910701fa2b770d7e61a695"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/voice.py"}, "region": {"startLine": 119}}}]}, {"ruleId": "MINED072", "level": "none", "message": {"text": "[MINED072] Python Pass Only Class: class Foo: pass \u2014 stub waiting to be filled in."}, "properties": {"repobilityId": 469384, "scanner": "repobility-threat-engine", "fingerprint": "267f68dc89f999d8d94023275817c6bc5fa72ff9bb9e34bded4df2de26309e9e", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "python-pass-only-class", "owasp": null, "cwe_ids": ["CWE-1188"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348069+00:00", "triaged_in_corpus": 10, "observations_count": 14245, "ai_coder_pattern_id": 143}, "scanner": "repobility-threat-engine", "correlation_key": "fp|267f68dc89f999d8d94023275817c6bc5fa72ff9bb9e34bded4df2de26309e9e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/voice.py"}, "region": {"startLine": 29}}}]}, {"ruleId": "MINED055", "level": "none", "message": {"text": "[MINED055] Npm Install No Lockfile: Production image runs npm install (resolves new versions on every build) instead of npm ci."}, "properties": {"repobilityId": 469382, "scanner": "repobility-threat-engine", "fingerprint": "5b26361893f99642475855a164061ebe40077d364b502deca69c1ebe9e098573", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "npm-install-no-lockfile", "owasp": "A06:2021", "cwe_ids": ["CWE-1357"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348030+00:00", "triaged_in_corpus": 12, "observations_count": 317602, "ai_coder_pattern_id": 42}, "scanner": "repobility-threat-engine", "correlation_key": "fp|5b26361893f99642475855a164061ebe40077d364b502deca69c1ebe9e098573"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/utils.py"}, "region": {"startLine": 317}}}]}, {"ruleId": "MINED067", "level": "none", "message": {"text": "[MINED067] Python Requests No Timeout (and 3 more): Same pattern found in 3 additional files. Review if needed."}, "properties": {"repobilityId": 469381, "scanner": "repobility-threat-engine", "fingerprint": "22c0d567d696a6862689f7c9fd8c307213fa0bf7df0ff8c77916ef3d9279f800", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 3 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "python-requests-no-timeout", "owasp": null, "cwe_ids": ["CWE-400"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348058+00:00", "triaged_in_corpus": 12, "observations_count": 45429, "ai_coder_pattern_id": 122}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|22c0d567d696a6862689f7c9fd8c307213fa0bf7df0ff8c77916ef3d9279f800", "aggregated_count": 3}}}, {"ruleId": "MINED067", "level": "none", "message": {"text": "[MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang forever."}, "properties": {"repobilityId": 469380, "scanner": "repobility-threat-engine", "fingerprint": "907f5449e2cb6b2e0433114f246430d21b63dc72fce7ef4fd60db5d34122ee88", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "python-requests-no-timeout", "owasp": null, "cwe_ids": ["CWE-400"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348058+00:00", "triaged_in_corpus": 12, "observations_count": 45429, "ai_coder_pattern_id": 122}, "scanner": "repobility-threat-engine", "correlation_key": "fp|907f5449e2cb6b2e0433114f246430d21b63dc72fce7ef4fd60db5d34122ee88"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/dl_icons.py"}, "region": {"startLine": 33}}}]}, {"ruleId": "MINED067", "level": "none", "message": {"text": "[MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang forever."}, "properties": {"repobilityId": 469379, "scanner": "repobility-threat-engine", "fingerprint": "8c6faf12302f41fa45d5aa0cf06176f7a4f521d26893a21255fb2d680f8a8da3", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "python-requests-no-timeout", "owasp": null, "cwe_ids": ["CWE-400"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348058+00:00", "triaged_in_corpus": 12, "observations_count": 45429, "ai_coder_pattern_id": 122}, "scanner": "repobility-threat-engine", "correlation_key": "fp|8c6faf12302f41fa45d5aa0cf06176f7a4f521d26893a21255fb2d680f8a8da3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/versioncheck.py"}, "region": {"startLine": 78}}}]}, {"ruleId": "MINED067", "level": "none", "message": {"text": "[MINED067] Python Requests No Timeout: requests.get/post/etc. without timeout= can hang forever."}, "properties": {"repobilityId": 469378, "scanner": "repobility-threat-engine", "fingerprint": "cec22e3ae6997a2e9efd74969623226dcdbc375fd5b7c272158292a5f0e983b2", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "python-requests-no-timeout", "owasp": null, "cwe_ids": ["CWE-400"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348058+00:00", "triaged_in_corpus": 12, "observations_count": 45429, "ai_coder_pattern_id": 122}, "scanner": "repobility-threat-engine", "correlation_key": "fp|cec22e3ae6997a2e9efd74969623226dcdbc375fd5b7c272158292a5f0e983b2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/openrouter.py"}, "region": {"startLine": 116}}}]}, {"ruleId": "SEC078", "level": "none", "message": {"text": "[SEC078] Python: requests without timeout (and 3 more): Same pattern found in 3 additional files. Review if needed."}, "properties": {"repobilityId": 469377, "scanner": "repobility-threat-engine", "fingerprint": "4ad6f55494afe619cae3e4cf741803a5646a33d13c8bf832506da6d5a11f8beb", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 3 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 3 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC078", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|4ad6f55494afe619cae3e4cf741803a5646a33d13c8bf832506da6d5a11f8beb"}}}, {"ruleId": "MINED064", "level": "none", "message": {"text": "[MINED064] Python Input Call: input() blocks for stdin. Inappropriate in services."}, "properties": {"repobilityId": 469359, "scanner": "repobility-threat-engine", "fingerprint": "d0976ce838a636004ac730f14dfc01d77131c8ae85b51d81f9ba5a51a3ea955a", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "python-input-call", "owasp": null, "cwe_ids": [], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348050+00:00", "triaged_in_corpus": 12, "observations_count": 66378, "ai_coder_pattern_id": 124}, "scanner": "repobility-threat-engine", "correlation_key": "fp|d0976ce838a636004ac730f14dfc01d77131c8ae85b51d81f9ba5a51a3ea955a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/clean_metadata.py"}, "region": {"startLine": 228}}}]}, {"ruleId": "MINED064", "level": "none", "message": {"text": "[MINED064] Python Input Call: input() blocks for stdin. Inappropriate in services."}, "properties": {"repobilityId": 469358, "scanner": "repobility-threat-engine", "fingerprint": "a702ab3d86f275f10dc62283a1a8b028f9a2a1c11d009f278dba21a95543a05c", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "python-input-call", "owasp": null, "cwe_ids": [], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348050+00:00", "triaged_in_corpus": 12, "observations_count": 66378, "ai_coder_pattern_id": 124}, "scanner": "repobility-threat-engine", "correlation_key": "fp|a702ab3d86f275f10dc62283a1a8b028f9a2a1c11d009f278dba21a95543a05c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/report.py"}, "region": {"startLine": 71}}}]}, {"ruleId": "MINED064", "level": "none", "message": {"text": "[MINED064] Python Input Call: input() blocks for stdin. Inappropriate in services."}, "properties": {"repobilityId": 469357, "scanner": "repobility-threat-engine", "fingerprint": "ecd1e92e86a46d161395ae4a313e7b9db4c2af5f4ff9f06753f0429072ba43cc", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "python-input-call", "owasp": null, "cwe_ids": [], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348050+00:00", "triaged_in_corpus": 12, "observations_count": 66378, "ai_coder_pattern_id": 124}, "scanner": "repobility-threat-engine", "correlation_key": "fp|ecd1e92e86a46d161395ae4a313e7b9db4c2af5f4ff9f06753f0429072ba43cc"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/diffs.py"}, "region": {"startLine": 23}}}]}, {"ruleId": "MINED006", "level": "none", "message": {"text": "[MINED006] Overcatch Baseexception (and 1 more): Same pattern found in 1 additional files. Review if needed."}, "properties": {"repobilityId": 469356, "scanner": "repobility-threat-engine", "fingerprint": "f87ed9b6811675c97d18c0024fde96dcf647cce402a76a98ff5bf685ee8d2ef2", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 1 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "overcatch-baseexception", "owasp": null, "cwe_ids": ["CWE-705"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347911+00:00", "triaged_in_corpus": 15, "observations_count": 230624, "ai_coder_pattern_id": 8}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|f87ed9b6811675c97d18c0024fde96dcf647cce402a76a98ff5bf685ee8d2ef2", "aggregated_count": 1}}}, {"ruleId": "MINED043", "level": "none", "message": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "properties": {"repobilityId": 469352, "scanner": "repobility-threat-engine", "fingerprint": "725e488af719336f11afe02a8a4a48be929601d15214cb0d7e5edb0f9da42038", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "http-not-https", "owasp": "A02:2021", "cwe_ids": ["CWE-319"], "precision": 0.917, "promoted_at": "2026-05-18T14:01:32.347999+00:00", "triaged_in_corpus": 12, "observations_count": 4113831, "ai_coder_pattern_id": 15}, "scanner": "repobility-threat-engine", "correlation_key": "fp|725e488af719336f11afe02a8a4a48be929601d15214cb0d7e5edb0f9da42038"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/coders/help_prompts.py"}, "region": {"startLine": 15}}}]}, {"ruleId": "MINED050", "level": "none", "message": {"text": "[MINED050] Stub Only Function (and 8 more): Same pattern found in 8 additional files. Review if needed."}, "properties": {"repobilityId": 469351, "scanner": "repobility-threat-engine", "fingerprint": "26a20ec3af6c1bf844f4aaed7ed4016813a12e74cf2ca0c954b4690d78374bea", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 8 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "stub-only-function", "owasp": null, "cwe_ids": ["CWE-1188"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348017+00:00", "triaged_in_corpus": 12, "observations_count": 633513, "ai_coder_pattern_id": 2}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|26a20ec3af6c1bf844f4aaed7ed4016813a12e74cf2ca0c954b4690d78374bea", "aggregated_count": 8}}}, {"ruleId": "MINED050", "level": "none", "message": {"text": "[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment."}, "properties": {"repobilityId": 469350, "scanner": "repobility-threat-engine", "fingerprint": "c7b363c5f73cf22f4d7ad86aadf0db0456937692eeda41310f1d23c54f722bcf", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "stub-only-function", "owasp": null, "cwe_ids": ["CWE-1188"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348017+00:00", "triaged_in_corpus": 12, "observations_count": 633513, "ai_coder_pattern_id": 2}, "scanner": "repobility-threat-engine", "correlation_key": "fp|c7b363c5f73cf22f4d7ad86aadf0db0456937692eeda41310f1d23c54f722bcf"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/coders/help_coder.py"}, "region": {"startLine": 16}}}]}, {"ruleId": "MINED050", "level": "none", "message": {"text": "[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment."}, "properties": {"repobilityId": 469349, "scanner": "repobility-threat-engine", "fingerprint": "d6c3eadd825c1d324ef05b6e77916e92ee004ee68298d68b266765bf31056648", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "stub-only-function", "owasp": null, "cwe_ids": ["CWE-1188"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348017+00:00", "triaged_in_corpus": 12, "observations_count": 633513, "ai_coder_pattern_id": 2}, "scanner": "repobility-threat-engine", "correlation_key": "fp|d6c3eadd825c1d324ef05b6e77916e92ee004ee68298d68b266765bf31056648"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/coders/context_coder.py"}, "region": {"startLine": 53}}}]}, {"ruleId": "MINED050", "level": "none", "message": {"text": "[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment."}, "properties": {"repobilityId": 469348, "scanner": "repobility-threat-engine", "fingerprint": "c0887d0526d29ec766d8b652394de6b313894dbb6b9042269c9275a8b16f0285", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "stub-only-function", "owasp": null, "cwe_ids": ["CWE-1188"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348017+00:00", "triaged_in_corpus": 12, "observations_count": 633513, "ai_coder_pattern_id": 2}, "scanner": "repobility-threat-engine", "correlation_key": "fp|c0887d0526d29ec766d8b652394de6b313894dbb6b9042269c9275a8b16f0285"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/args_formatter.py"}, "region": {"startLine": 54}}}]}, {"ruleId": "COMP001", "level": "none", "message": {"text": "[COMP001] High cognitive complexity (and 58 more): Same pattern found in 58 additional files. Review if needed."}, "properties": {"repobilityId": 469347, "scanner": "repobility-threat-engine", "fingerprint": "22f461c791073aa366f63fb109eb764d2b4b27e2f3b53d00ef6d37d429cfdfb3", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 58 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"scanner": "repobility-threat-engine", "function": "event", "breakdown": {"if": 6, "for": 1, "else": 1, "except": 2, "nested_bonus": 3}, "aggregated": true, "complexity": 13, "correlation_key": "fp|22f461c791073aa366f63fb109eb764d2b4b27e2f3b53d00ef6d37d429cfdfb3", "aggregated_count": 58}}}, {"ruleId": "MINED001", "level": "none", "message": {"text": "[MINED001] Bare Except Pass (and 5 more): Same pattern found in 5 additional files. Review if needed."}, "properties": {"repobilityId": 469343, "scanner": "repobility-threat-engine", "fingerprint": "7fa035b085c0bd9a31a5276c49da091420eed1825fee6f01486426827fccfced", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 5 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "bare-except-pass", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347744+00:00", "triaged_in_corpus": 15, "observations_count": 1550824, "ai_coder_pattern_id": 6}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|7fa035b085c0bd9a31a5276c49da091420eed1825fee6f01486426827fccfced", "aggregated_count": 5}}}, {"ruleId": "SEC128", "level": "none", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake) (and 5 more): Same pattern found in 5 additional files. Review if needed."}, "properties": {"repobilityId": 469339, "scanner": "repobility-threat-engine", "fingerprint": "dfda4170aff520d17dd79e2ba83251ca47508d2ca8ba93d0fcc46ccc46e07c8c", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 5 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 5 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|dfda4170aff520d17dd79e2ba83251ca47508d2ca8ba93d0fcc46ccc46e07c8c"}}}, {"ruleId": "MINED118", "level": "error", "message": {"text": "[MINED118] Dockerfile FROM `python:3.12-slim-bookworm` not pinned by digest: `FROM python:3.12-slim-bookworm` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity."}, "properties": {"repobilityId": 469533, "scanner": "repobility-supply-chain", "fingerprint": "a08923c125f37aea35b33cdd013e213f62ce131e7262241f14c7afe3d06549e9", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|a08923c125f37aea35b33cdd013e213f62ce131e7262241f14c7afe3d06549e9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "MINED118", "level": "error", "message": {"text": "[MINED118] Dockerfile FROM `bretfisher/jekyll-serve (no tag)` not pinned by digest: `FROM bretfisher/jekyll-serve (no tag)` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity."}, "properties": {"repobilityId": 469532, "scanner": "repobility-supply-chain", "fingerprint": "7b8bfa38e918315615180d4b5569573aa0c7f68b115bb1a8c511f10e399d4b90", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|7b8bfa38e918315615180d4b5569573aa0c7f68b115bb1a8c511f10e399d4b90"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/Dockerfile.jekyll"}, "region": {"startLine": 2}}}]}, {"ruleId": "MINED119", "level": "error", "message": {"text": "[MINED119] Dockerfile `ADD https://sh.rustup.rs`: Dockerfile `ADD <url>` downloads a remote artifact into the image with no integrity check. If the host or DNS is compromised between layers \u2014 or if the URL serves a different file later \u2014 malicious content gets baked into the image."}, "properties": {"repobilityId": 469512, "scanner": "repobility-supply-chain", "fingerprint": "798aa0835461494d679835c64ce20eb543b3cd73dc91f12dee4a9a559a34f61a", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-add-remote-url", "owasp": "A08:2021", "cwe_ids": ["CWE-829", "CWE-494"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|798aa0835461494d679835c64ce20eb543b3cd73dc91f12dee4a9a559a34f61a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmark/Dockerfile"}, "region": {"startLine": 38}}}]}, {"ruleId": "MINED118", "level": "error", "message": {"text": "[MINED118] Dockerfile FROM `buildpack-deps:jammy` not pinned by digest: `FROM buildpack-deps:jammy` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity."}, "properties": {"repobilityId": 469511, "scanner": "repobility-supply-chain", "fingerprint": "604e381588737d3c00e830873e5fb8d54351673fa7b5ffeb52897fcdb4f9a00d", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|604e381588737d3c00e830873e5fb8d54351673fa7b5ffeb52897fcdb4f9a00d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmark/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "MINED131", "level": "error", "message": {"text": "[MINED131] pre-commit hook `https://github.com/codespell-project/codespell` pinned to mutable rev `v2.2.6`: `.pre-commit-config.yaml` references `https://github.com/codespell-project/codespell` at `rev: v2.2.6`. If `{rev}` is a branch or version tag, the repo owner can push new code there and `pre-commit install --install-hooks` will fetch it on every developer's machine."}, "properties": {"repobilityId": 469508, "scanner": "repobility-supply-chain", "fingerprint": "2d19e339ff655769c883d8a102123a3163c12a490070f1724bab76ccda6dbf5a", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "precommit-untrusted-repo", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|2d19e339ff655769c883d8a102123a3163c12a490070f1724bab76ccda6dbf5a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".pre-commit-config.yaml"}, "region": {"startLine": 17}}}]}, {"ruleId": "MINED131", "level": "error", "message": {"text": "[MINED131] pre-commit hook `https://github.com/pycqa/flake8` pinned to mutable rev `7.1.0`: `.pre-commit-config.yaml` references `https://github.com/pycqa/flake8` at `rev: 7.1.0`. If `{rev}` is a branch or version tag, the repo owner can push new code there and `pre-commit install --install-hooks` will fetch it on every developer's machine."}, "properties": {"repobilityId": 469507, "scanner": "repobility-supply-chain", "fingerprint": "f5a6e491333db763d660e190266be836f504ba76a0db897d81a2eb2b5eacf5f6", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "precommit-untrusted-repo", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|f5a6e491333db763d660e190266be836f504ba76a0db897d81a2eb2b5eacf5f6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".pre-commit-config.yaml"}, "region": {"startLine": 12}}}]}, {"ruleId": "MINED131", "level": "error", "message": {"text": "[MINED131] pre-commit hook `https://github.com/psf/black` pinned to mutable rev `23.3.0`: `.pre-commit-config.yaml` references `https://github.com/psf/black` at `rev: 23.3.0`. If `{rev}` is a branch or version tag, the repo owner can push new code there and `pre-commit install --install-hooks` will fetch it on every developer's machine."}, "properties": {"repobilityId": 469506, "scanner": "repobility-supply-chain", "fingerprint": "21bd1b816f725bb8175939c9e4653455f4e565b61de0a7af335b1d491968f283", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "precommit-untrusted-repo", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|21bd1b816f725bb8175939c9e4653455f4e565b61de0a7af335b1d491968f283"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".pre-commit-config.yaml"}, "region": {"startLine": 7}}}]}, {"ruleId": "MINED131", "level": "error", "message": {"text": "[MINED131] pre-commit hook `https://github.com/PyCQA/isort` pinned to mutable rev `5.12.0`: `.pre-commit-config.yaml` references `https://github.com/PyCQA/isort` at `rev: 5.12.0`. If `{rev}` is a branch or version tag, the repo owner can push new code there and `pre-commit install --install-hooks` will fetch it on every developer's machine."}, "properties": {"repobilityId": 469505, "scanner": "repobility-supply-chain", "fingerprint": "29111f00272e2c356a4672b2f36127328b851f93f30aff0cf7ba176019e72918", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "precommit-untrusted-repo", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["yaml"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|29111f00272e2c356a4672b2f36127328b851f93f30aff0cf7ba176019e72918"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".pre-commit-config.yaml"}, "region": {"startLine": 2}}}]}, {"ruleId": "MINED112", "level": "error", "message": {"text": "[MINED112] FastAPI PATCH webbrowser.open has no auth: Handler `test_git_index_version_greater_than_2` is registered with router/app.patch(...) but no Depends/Security parameter is declared and no auth marker appears in the function body."}, "properties": {"repobilityId": 469504, "scanner": "repobility-route-auth", "fingerprint": "ef2db536f8a866a2a652bbad5b0021454823c36f2792e430b3ff4f570572325b", "category": "quality", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "fastapi-destructive-unauth", "owasp": "A01:2021", "cwe_ids": ["CWE-306", "CWE-862"], "languages": ["python", "javascript"], "observations_count": 10455}, "scanner": "repobility-route-auth", "correlation_key": "fp|ef2db536f8a866a2a652bbad5b0021454823c36f2792e430b3ff4f570572325b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_sanity_check_repo.py"}, "region": {"startLine": 104}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_architect_coder_auto_accept_false_rejected: Test function `test_architect_coder_auto_accept_false_rejected` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 469498, "scanner": "repobility-ast-engine", "fingerprint": "37769d702eb1b9a3374856d769908e6346cc78cd28a9f5513a0214ad23e81971", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|37769d702eb1b9a3374856d769908e6346cc78cd28a9f5513a0214ad23e81971"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_coder.py"}, "region": {"startLine": 1404}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_architect_coder_auto_accept_false_confirmed: Test function `test_architect_coder_auto_accept_false_confirmed` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 469497, "scanner": "repobility-ast-engine", "fingerprint": "6baab12050468b9f3ce54facf8a0cd70f869c4a140ae452d21c4569c7129be5e", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|6baab12050468b9f3ce54facf8a0cd70f869c4a140ae452d21c4569c7129be5e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_coder.py"}, "region": {"startLine": 1365}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_architect_coder_auto_accept_true: Test function `test_architect_coder_auto_accept_true` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 469496, "scanner": "repobility-ast-engine", "fingerprint": "f4e57ec546e3dd519c4a5654d5e05bed1e2bcfd55b42bd02120c8fdac0405fc6", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|f4e57ec546e3dd519c4a5654d5e05bed1e2bcfd55b42bd02120c8fdac0405fc6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_coder.py"}, "region": {"startLine": 1330}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_detect_urls_enabled: Test function `test_detect_urls_enabled` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 469495, "scanner": "repobility-ast-engine", "fingerprint": "5783163d5a474a66d9c0b0855f0af2c7b764347ba5d85bb293edb169c9a5aa50", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|5783163d5a474a66d9c0b0855f0af2c7b764347ba5d85bb293edb169c9a5aa50"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_coder.py"}, "region": {"startLine": 1012}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_find_original_update_blocks_no_final_newline: Test function `test_find_original_update_blocks_no_final_newline` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 469494, "scanner": "repobility-ast-engine", "fingerprint": "ead8dbdcb3b6e71c10e018ff74f633aef1855c49a8909be940ec8d7af4930afd", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|ead8dbdcb3b6e71c10e018ff74f633aef1855c49a8909be940ec8d7af4930afd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_editblock.py"}, "region": {"startLine": 168}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_format_files_for_input_pretty_true_no_files: Test function `test_format_files_for_input_pretty_true_no_files` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 469492, "scanner": "repobility-ast-engine", "fingerprint": "ced288f2f5ac2a30f2fcdbff1771d3401aa7b57a596120f778cfcc28ea446404", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|ced288f2f5ac2a30f2fcdbff1771d3401aa7b57a596120f778cfcc28ea446404"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_io.py"}, "region": {"startLine": 518}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_verify_ssl_setting_before_cache_loading: Test function `test_verify_ssl_setting_before_cache_loading` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 469491, "scanner": "repobility-ast-engine", "fingerprint": "6748490bedc19a4ace6d07a77f675820aabdd5343c6841a40a3aa982ebc8e5f2", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|6748490bedc19a4ace6d07a77f675820aabdd5343c6841a40a3aa982ebc8e5f2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_model_info_manager.py"}, "region": {"startLine": 64}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_update_cache_respects_verify_ssl: Test function `test_update_cache_respects_verify_ssl` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 469490, "scanner": "repobility-ast-engine", "fingerprint": "279aff9a44e7f14a77eb3cf27604dc38e9f8dafa334cde00f93b659c221ab80e", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|279aff9a44e7f14a77eb3cf27604dc38e9f8dafa334cde00f93b659c221ab80e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_model_info_manager.py"}, "region": {"startLine": 26}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_cmd_load_with_switch_coder: Test function `test_cmd_load_with_switch_coder` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 469488, "scanner": "repobility-ast-engine", "fingerprint": "1a96d79d22db1752c66ad865b753c1979128d343a899519bbf22b2b242db4c33", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|1a96d79d22db1752c66ad865b753c1979128d343a899519bbf22b2b242db4c33"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_commands.py"}, "region": {"startLine": 2106}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_cmd_reasoning_effort: Test function `test_cmd_reasoning_effort` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 469487, "scanner": "repobility-ast-engine", "fingerprint": "0ffddbd1a715210d6ea12ce889880b8810bc876c98c23d43b1c740ae2b86523d", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|0ffddbd1a715210d6ea12ce889880b8810bc876c98c23d43b1c740ae2b86523d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_commands.py"}, "region": {"startLine": 1984}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_cmd_add_from_subdir_again: Test function `test_cmd_add_from_subdir_again` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 469486, "scanner": "repobility-ast-engine", "fingerprint": "c5933e7ef957dbbd71ee944636876e9d97fb92884badac61362490970d80c03a", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|c5933e7ef957dbbd71ee944636876e9d97fb92884badac61362490970d80c03a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_commands.py"}, "region": {"startLine": 423}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_cmd_add_bad_glob: Test function `test_cmd_add_bad_glob` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 469485, "scanner": "repobility-ast-engine", "fingerprint": "ade282d707225a5c91a935e78dff49699b303e222c5273b1cfa8aafb5070bb68", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|ade282d707225a5c91a935e78dff49699b303e222c5273b1cfa8aafb5070bb68"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_commands.py"}, "region": {"startLine": 148}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_cmd_copy_pyperclip_exception: Test function `test_cmd_copy_pyperclip_exception` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 469484, "scanner": "repobility-ast-engine", "fingerprint": "99908e84fd2b6455417b28388097983bb5cd73cce130911848cedc15947c72c5", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|99908e84fd2b6455417b28388097983bb5cd73cce130911848cedc15947c72c5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_commands.py"}, "region": {"startLine": 127}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_cmd_copy_with_cur_messages: Test function `test_cmd_copy_with_cur_messages` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 469483, "scanner": "repobility-ast-engine", "fingerprint": "45cd462e7f79403d7caf625d2bde4684c3941b9ff9937177001cf4b23bdd20c1", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|45cd462e7f79403d7caf625d2bde4684c3941b9ff9937177001cf4b23bdd20c1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_commands.py"}, "region": {"startLine": 80}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_cmd_copy: Test function `test_cmd_copy` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 469482, "scanner": "repobility-ast-engine", "fingerprint": "4d38e0d6613dded2e68b5feb059db9ef8e48e0795d950d71541c8d6196113842", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|4d38e0d6613dded2e68b5feb059db9ef8e48e0795d950d71541c8d6196113842"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_commands.py"}, "region": {"startLine": 50}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_litellm_exceptions: Test function `test_litellm_exceptions` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 469481, "scanner": "repobility-ast-engine", "fingerprint": "e8c304e6fca8a98d9b19d61293a23f466e30626a3cb99b0da3cdf1dc81a21430", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|e8c304e6fca8a98d9b19d61293a23f466e30626a3cb99b0da3cdf1dc81a21430"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_sendchat.py"}, "region": {"startLine": 18}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_request_timeout_from_extra_params: Test function `test_request_timeout_from_extra_params` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 469480, "scanner": "repobility-ast-engine", "fingerprint": "7f11a6f0175b1ea7d0178704c76bdfed7ba28ca6532168e13e3d360a4df883b4", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|7f11a6f0175b1ea7d0178704c76bdfed7ba28ca6532168e13e3d360a4df883b4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_models.py"}, "region": {"startLine": 511}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_request_timeout_default: Test function `test_request_timeout_default` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 469479, "scanner": "repobility-ast-engine", "fingerprint": "c04e6e61525c925f6e6006532fe58adc19631b0fab697ea77adc3f3df269495e", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|c04e6e61525c925f6e6006532fe58adc19631b0fab697ea77adc3f3df269495e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_models.py"}, "region": {"startLine": 497}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_ollama_uses_existing_num_ctx: Test function `test_ollama_uses_existing_num_ctx` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 469478, "scanner": "repobility-ast-engine", "fingerprint": "72cac3a8e14312d4c2d6a8a370c81e0cbfe9e643176653f85d5b40d05c23e177", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|72cac3a8e14312d4c2d6a8a370c81e0cbfe9e643176653f85d5b40d05c23e177"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_models.py"}, "region": {"startLine": 447}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_ollama_num_ctx_set_when_missing: Test function `test_ollama_num_ctx_set_when_missing` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 469477, "scanner": "repobility-ast-engine", "fingerprint": "496f08adfd229adb85eb1659339c3f7d813162a8443dc727d96a6188d5c5d10b", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|496f08adfd229adb85eb1659339c3f7d813162a8443dc727d96a6188d5c5d10b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_models.py"}, "region": {"startLine": 427}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_check_for_dependencies_other_model: Test function `test_check_for_dependencies_other_model` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 469476, "scanner": "repobility-ast-engine", "fingerprint": "79bdc1d58c0f8a68d9b3556a06a2193ff328a48dd130ee57c2dcb01e960cd73a", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|79bdc1d58c0f8a68d9b3556a06a2193ff328a48dd130ee57c2dcb01e960cd73a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_models.py"}, "region": {"startLine": 243}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_check_for_dependencies_vertex_ai: Test function `test_check_for_dependencies_vertex_ai` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 469475, "scanner": "repobility-ast-engine", "fingerprint": "340666218be6b276aaea6cbb01c408a362bbdac1d92a01bd2cf936f5e0212d42", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|340666218be6b276aaea6cbb01c408a362bbdac1d92a01bd2cf936f5e0212d42"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_models.py"}, "region": {"startLine": 223}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_check_for_dependencies_bedrock: Test function `test_check_for_dependencies_bedrock` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 469474, "scanner": "repobility-ast-engine", "fingerprint": "24aa29703af289f27e52037d2511e227103cdfb22b5e87dbb73812ed0b5aa195", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|24aa29703af289f27e52037d2511e227103cdfb22b5e87dbb73812ed0b5aa195"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_models.py"}, "region": {"startLine": 206}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_sanity_check_model_calls_check_dependencies: Test function `test_sanity_check_model_calls_check_dependencies` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 469473, "scanner": "repobility-ast-engine", "fingerprint": "734d094b336750e4e12c40bf222b5d0255f0e258fa085cd31edf475d4e1641e6", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|734d094b336750e4e12c40bf222b5d0255f0e258fa085cd31edf475d4e1641e6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_models.py"}, "region": {"startLine": 106}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_no_files: Test function `test_no_files` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 469472, "scanner": "repobility-ast-engine", "fingerprint": "6beeaba34d255bcdba70a3e708f66a8bab08578d8f2a4aa0ee88d2a602456ae5", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|6beeaba34d255bcdba70a3e708f66a8bab08578d8f2a4aa0ee88d2a602456ae5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_wholefile.py"}, "region": {"startLine": 27}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.messages` used but never assigned in __init__: Method `info` of class `GUI` reads `self.messages`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 469454, "scanner": "repobility-ast-engine", "fingerprint": "33d0c7ae89b5edebaada93433b057223d3751580f56c058b0db4df4e28f7f1fd", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|33d0c7ae89b5edebaada93433b057223d3751580f56c058b0db4df4e28f7f1fd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/gui.py"}, "region": {"startLine": 462}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.messages` used but never assigned in __init__: Method `process_chat` of class `GUI` reads `self.messages`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 469453, "scanner": "repobility-ast-engine", "fingerprint": "4d8fa223d1fa9a8c80b94e3efc2fa506c942cb8936ca264ad2e5d668df56a8bb", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|4d8fa223d1fa9a8c80b94e3efc2fa506c942cb8936ca264ad2e5d668df56a8bb"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/gui.py"}, "region": {"startLine": 421}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.num_reflections` used but never assigned in __init__: Method `process_chat` of class `GUI` reads `self.num_reflections`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 469452, "scanner": "repobility-ast-engine", "fingerprint": "f78be38bf3512ec877f16a722602d281f26b888956fcce5046d87a8b4cc943c1", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|f78be38bf3512ec877f16a722602d281f26b888956fcce5046d87a8b4cc943c1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/gui.py"}, "region": {"startLine": 429}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.max_reflections` used but never assigned in __init__: Method `process_chat` of class `GUI` reads `self.max_reflections`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 469451, "scanner": "repobility-ast-engine", "fingerprint": "dd7158b758a0980483cb366f9f13312990d45b59e697bb30805b32c3f1f3445e", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|dd7158b758a0980483cb366f9f13312990d45b59e697bb30805b32c3f1f3445e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/gui.py"}, "region": {"startLine": 428}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.num_reflections` used but never assigned in __init__: Method `process_chat` of class `GUI` reads `self.num_reflections`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 469450, "scanner": "repobility-ast-engine", "fingerprint": "034ac07db48fd7b9b246864df8a8a407814fdc20a3e9fb0118b0722083b9c889", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|034ac07db48fd7b9b246864df8a8a407814fdc20a3e9fb0118b0722083b9c889"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/gui.py"}, "region": {"startLine": 428}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.messages` used but never assigned in __init__: Method `process_chat` of class `GUI` reads `self.messages`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 469449, "scanner": "repobility-ast-engine", "fingerprint": "3093268e8864484da67adfbfc5a4356a162416aa669f0671184dfb86bc7910c3", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|3093268e8864484da67adfbfc5a4356a162416aa669f0671184dfb86bc7910c3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/gui.py"}, "region": {"startLine": 433}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.max_reflections` used but never assigned in __init__: Method `process_chat` of class `GUI` reads `self.max_reflections`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 469448, "scanner": "repobility-ast-engine", "fingerprint": "72f1ae0ffeb816855f4e9f88dbb36ca0287d3d84b5c17f9133cf9dbafc9654aa", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|72f1ae0ffeb816855f4e9f88dbb36ca0287d3d84b5c17f9133cf9dbafc9654aa"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/gui.py"}, "region": {"startLine": 418}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.num_reflections` used but never assigned in __init__: Method `process_chat` of class `GUI` reads `self.num_reflections`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 469447, "scanner": "repobility-ast-engine", "fingerprint": "e9221804f9c190f93037721b35d3a74e3539b53bc35de5fd97faa52c9caafabf", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|e9221804f9c190f93037721b35d3a74e3539b53bc35de5fd97faa52c9caafabf"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/gui.py"}, "region": {"startLine": 417}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.messages` used but never assigned in __init__: Method `do_messages_container` of class `GUI` reads `self.messages`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 469446, "scanner": "repobility-ast-engine", "fingerprint": "fa9ca304367c87db08291cf8a7c5e5a522d6a7bd22d3f03a82efdfd451f69b86", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|fa9ca304367c87db08291cf8a7c5e5a522d6a7bd22d3f03a82efdfd451f69b86"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/gui.py"}, "region": {"startLine": 319}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.messages` used but never assigned in __init__: Method `do_messages_container` of class `GUI` reads `self.messages`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 469445, "scanner": "repobility-ast-engine", "fingerprint": "a145dae5de21715596a9f1117126a91eed1e6f38feda6028e4ec73c69f570597", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|a145dae5de21715596a9f1117126a91eed1e6f38feda6028e4ec73c69f570597"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/gui.py"}, "region": {"startLine": 308}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.messages` used but never assigned in __init__: Method `do_messages_container` of class `GUI` reads `self.messages`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 469444, "scanner": "repobility-ast-engine", "fingerprint": "7a002a5fbaf8cbd182f66ef1455b8e5593e6769f489dcf56a88499d5018d796d", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|7a002a5fbaf8cbd182f66ef1455b8e5593e6769f489dcf56a88499d5018d796d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/gui.py"}, "region": {"startLine": 302}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.old_prompt` used but never assigned in __init__: Method `do_recent_msgs` of class `GUI` reads `self.old_prompt`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 469443, "scanner": "repobility-ast-engine", "fingerprint": "9f594de3115c0288d5ef620411cf6547650038ec33f7cf52e1d52d723ad5c4cf", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|9f594de3115c0288d5ef620411cf6547650038ec33f7cf52e1d52d723ad5c4cf"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/gui.py"}, "region": {"startLine": 299}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.old_prompt` used but never assigned in __init__: Method `do_recent_msgs` of class `GUI` reads `self.old_prompt`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 469442, "scanner": "repobility-ast-engine", "fingerprint": "5cdbfdf5e908e3e2a1bd25296c3b488c9a4484482536a1eeb0546910664893e8", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|5cdbfdf5e908e3e2a1bd25296c3b488c9a4484482536a1eeb0546910664893e8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/gui.py"}, "region": {"startLine": 298}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.old_prompt` used but never assigned in __init__: Method `do_recent_msgs` of class `GUI` reads `self.old_prompt`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 469441, "scanner": "repobility-ast-engine", "fingerprint": "98ea89135b90d69b61e26c5524b46f263be575e6f41a936fe9420cde04dd8029", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|98ea89135b90d69b61e26c5524b46f263be575e6f41a936fe9420cde04dd8029"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/gui.py"}, "region": {"startLine": 289}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.TAGS_CACHE` used but never assigned in __init__: Method `get_ranked_tags` of class `RepoMap` reads `self.TAGS_CACHE`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 469434, "scanner": "repobility-ast-engine", "fingerprint": "8597f8dca05be224a17c62accbe3950abc8929cdc5ba1e8d9e5643e9bec6b58a", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|8597f8dca05be224a17c62accbe3950abc8929cdc5ba1e8d9e5643e9bec6b58a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/repomap.py"}, "region": {"startLine": 389}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.TAGS_CACHE` used but never assigned in __init__: Method `get_ranked_tags` of class `RepoMap` reads `self.TAGS_CACHE`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 469433, "scanner": "repobility-ast-engine", "fingerprint": "5b5a57b704e5af063c1232e94f453428bd467decbc567fcf3a5ada443cb9b1e2", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|5b5a57b704e5af063c1232e94f453428bd467decbc567fcf3a5ada443cb9b1e2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/repomap.py"}, "region": {"startLine": 386}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.TAGS_CACHE` used but never assigned in __init__: Method `get_tags` of class `RepoMap` reads `self.TAGS_CACHE`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 469432, "scanner": "repobility-ast-engine", "fingerprint": "cbde58c2da16262e6924dab8bab9dcdfd39ea2b5b5134ffdd6f1beec8838b337", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|cbde58c2da16262e6924dab8bab9dcdfd39ea2b5b5134ffdd6f1beec8838b337"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/repomap.py"}, "region": {"startLine": 251}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.TAGS_CACHE` used but never assigned in __init__: Method `get_tags` of class `RepoMap` reads `self.TAGS_CACHE`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 469431, "scanner": "repobility-ast-engine", "fingerprint": "f3bbd8ebb0df8df4ee106af8b065656a21db302f91e3e46a3c7acffbf4e27454", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|f3bbd8ebb0df8df4ee106af8b065656a21db302f91e3e46a3c7acffbf4e27454"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/repomap.py"}, "region": {"startLine": 248}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.TAGS_CACHE` used but never assigned in __init__: Method `get_tags` of class `RepoMap` reads `self.TAGS_CACHE`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 469430, "scanner": "repobility-ast-engine", "fingerprint": "04af80309934b38b97a4467ef390db2ed8b1b1f366b9b5f27ce697ddb851a544", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|04af80309934b38b97a4467ef390db2ed8b1b1f366b9b5f27ce697ddb851a544"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/repomap.py"}, "region": {"startLine": 244}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.TAGS_CACHE` used but never assigned in __init__: Method `get_tags` of class `RepoMap` reads `self.TAGS_CACHE`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 469429, "scanner": "repobility-ast-engine", "fingerprint": "4b413b0efdce14a073e61cf76e8152bb124f1635ef25455ee99aa3171932dbab", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|4b413b0efdce14a073e61cf76e8152bb124f1635ef25455ee99aa3171932dbab"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/repomap.py"}, "region": {"startLine": 262}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.TAGS_CACHE` used but never assigned in __init__: Method `get_tags` of class `RepoMap` reads `self.TAGS_CACHE`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 469428, "scanner": "repobility-ast-engine", "fingerprint": "eb5d382ea0d1fd21f1f1549b03d996ad135cf9aa29709e7bb5b6aa54aa4870c9", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|eb5d382ea0d1fd21f1f1549b03d996ad135cf9aa29709e7bb5b6aa54aa4870c9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/repomap.py"}, "region": {"startLine": 241}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.TAGS_CACHE` used but never assigned in __init__: Method `get_tags` of class `RepoMap` reads `self.TAGS_CACHE`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 469427, "scanner": "repobility-ast-engine", "fingerprint": "3da1293b1ef3b152dc9bf857073892afaedc2b1ce2f9201495e725f6fe85ae5c", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|3da1293b1ef3b152dc9bf857073892afaedc2b1ce2f9201495e725f6fe85ae5c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/repomap.py"}, "region": {"startLine": 258}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.TAGS_CACHE` used but never assigned in __init__: Method `load_tags_cache` of class `RepoMap` reads `self.TAGS_CACHE`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 469426, "scanner": "repobility-ast-engine", "fingerprint": "a62c34e0fcc0cbb1e74c1c7b72855ac9d7d9a17353e536bf0ffc6f497b7cf791", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|a62c34e0fcc0cbb1e74c1c7b72855ac9d7d9a17353e536bf0ffc6f497b7cf791"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/repomap.py"}, "region": {"startLine": 220}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.TAGS_CACHE` used but never assigned in __init__: Method `tags_cache_error` of class `RepoMap` reads `self.TAGS_CACHE`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 469425, "scanner": "repobility-ast-engine", "fingerprint": "af48a86683c10af70c65a383066c0b3b97c2de51030393917d9d8a06c04c117e", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|af48a86683c10af70c65a383066c0b3b97c2de51030393917d9d8a06c04c117e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/repomap.py"}, "region": {"startLine": 204}}}]}, {"ruleId": "MINED108", "level": "error", "message": {"text": "[MINED108] `self.TAGS_CACHE` used but never assigned in __init__: Method `tags_cache_error` of class `RepoMap` reads `self.TAGS_CACHE`, but no assignment to it exists in __init__ (and no class-level fallback). This raises AttributeError the first time the method runs against an instance."}, "properties": {"repobilityId": 469424, "scanner": "repobility-ast-engine", "fingerprint": "81759c1d7b3e8a7383fff412e56debbf7dc8131c0603fa387720f4703f4652bf", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "self-attr-never-set", "owasp": null, "cwe_ids": ["CWE-476"], "languages": ["python"], "observations_count": 25998}, "scanner": "repobility-ast-engine", "correlation_key": "fp|81759c1d7b3e8a7383fff412e56debbf7dc8131c0603fa387720f4703f4652bf"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/repomap.py"}, "region": {"startLine": 215}}}]}, {"ruleId": "DKR006", "level": "error", "message": {"text": "Dockerfile pipes a remote script into a shell"}, "properties": {"repobilityId": 469406, "scanner": "repobility-docker", "fingerprint": "650b73c4bff96cba4c71ba5f726d5d7c34f0fcc0097ac2d847d2893951bb352b", "category": "docker", "severity": "high", "confidence": 0.92, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "RUN instruction contains curl/wget piped into a shell.", "evidence": {"rule_id": "DKR006", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|650b73c4bff96cba4c71ba5f726d5d7c34f0fcc0097ac2d847d2893951bb352b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmark/Dockerfile"}, "region": {"startLine": 43}}}]}, {"ruleId": "SEC013", "level": "error", "message": {"text": "[SEC013] Path Traversal \u2014 User Input in File Path: User-controlled input used in file path without sanitization. Allows reading arbitrary files."}, "properties": {"repobilityId": 469390, "scanner": "repobility-threat-engine", "fingerprint": "81d4bff63cd088a069c1668597d38c94fdedfd24674a09c63894ef10ca70bdcc", "category": "path_traversal", "severity": "high", "confidence": 0.8, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "User-controlled input detected in file path construction", "evidence": {"match": "open(input", "reason": "User-controlled input detected in file path construction", "rule_id": "SEC013", "scanner": "repobility-threat-engine", "confidence": 0.8, "correlation_key": "code|path_traversal|scripts/redact-cast.py|20|sec013"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/redact-cast.py"}, "region": {"startLine": 20}}}]}, {"ruleId": "SEC103", "level": "error", "message": {"text": "[SEC103] LDAP injection \u2014 non-constant search filter: User input concatenated into an LDAP search filter. Attackers inject `*)(uid=*` style payloads to bypass auth or enumerate accounts."}, "properties": {"repobilityId": 469388, "scanner": "repobility-threat-engine", "fingerprint": "9890a14d05af25fc1ef9e9ae934f68ffc4102e94a7a9769f633c1076fbda4aec", "category": "injection", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".search(r\"### Aider v(\\d+\\.\\d+\\.\\d+)", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC103", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|scripts/update-history.py|17|sec103"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/update-history.py"}, "region": {"startLine": 17}}}]}, {"ruleId": "SEC103", "level": "error", "message": {"text": "[SEC103] LDAP injection \u2014 non-constant search filter: User input concatenated into an LDAP search filter. Attackers inject `*)(uid=*` style payloads to bypass auth or enumerate accounts."}, "properties": {"repobilityId": 469387, "scanner": "repobility-threat-engine", "fingerprint": "b5497452fc5a90b728171bc82ecc2290715e5b853c3502ec60c237b3cf686544", "category": "injection", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".search(r\"## Commentary\\s+(.*?)", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC103", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|scripts/recording_audio.py|39|sec103"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/recording_audio.py"}, "region": {"startLine": 39}}}]}, {"ruleId": "SEC078", "level": "error", "message": {"text": "[SEC078] Python: requests without timeout: requests.get/post without a timeout will hang indefinitely on a non-responsive server, causing thread exhaustion and ReDoS. Ported from bandit B113 (Apache-2.0). NOTE: this regex is heuristic; a real AST check is preferred for accuracy."}, "properties": {"repobilityId": 469376, "scanner": "repobility-threat-engine", "fingerprint": "c7473eccd047fbf5f0b13892984bae6a7e279bf9d106dbaaf2665b0262651b09", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "requests.post(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC078", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|c7473eccd047fbf5f0b13892984bae6a7e279bf9d106dbaaf2665b0262651b09"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/recording_audio.py"}, "region": {"startLine": 109}}}]}, {"ruleId": "SEC078", "level": "error", "message": {"text": "[SEC078] Python: requests without timeout: requests.get/post without a timeout will hang indefinitely on a non-responsive server, causing thread exhaustion and ReDoS. Ported from bandit B113 (Apache-2.0). NOTE: this regex is heuristic; a real AST check is preferred for accuracy."}, "properties": {"repobilityId": 469375, "scanner": "repobility-threat-engine", "fingerprint": "d3269672697597a4a013ea8e67667b6cbf69088cb7f0be60a737d8a7d5af9ca2", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "requests.get(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC078", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|d3269672697597a4a013ea8e67667b6cbf69088cb7f0be60a737d8a7d5af9ca2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/dl_icons.py"}, "region": {"startLine": 33}}}]}, {"ruleId": "SEC078", "level": "error", "message": {"text": "[SEC078] Python: requests without timeout: requests.get/post without a timeout will hang indefinitely on a non-responsive server, causing thread exhaustion and ReDoS. Ported from bandit B113 (Apache-2.0). NOTE: this regex is heuristic; a real AST check is preferred for accuracy."}, "properties": {"repobilityId": 469374, "scanner": "repobility-threat-engine", "fingerprint": "d97054c6a4c41969c6cb2a34c9ab50e432a01c435373bd55f15dac8c7c9f1041", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "requests.get(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC078", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|d97054c6a4c41969c6cb2a34c9ab50e432a01c435373bd55f15dac8c7c9f1041"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/versioncheck.py"}, "region": {"startLine": 78}}}]}, {"ruleId": "SEC029", "level": "error", "message": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches."}, "properties": {"repobilityId": 469373, "scanner": "repobility-threat-engine", "fingerprint": "f37889aa6726ac4725acb47503ee1b7b330d9787d290864becaac0b8fb4bf8b1", "category": "ssrf", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "requests.get(api_url", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC029", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|f37889aa6726ac4725acb47503ee1b7b330d9787d290864becaac0b8fb4bf8b1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/tsl_pack_langs.py"}, "region": {"startLine": 15}}}]}, {"ruleId": "SEC029", "level": "error", "message": {"text": "[SEC029] Server-Side Request Forgery (SSRF) \u2014 outbound HTTP from user input: Outbound HTTP request to a user-controlled URL without allowlist validation. Attackers can probe internal services (169.254.169.254 metadata, internal Kubernetes endpoints, file:// URIs), exfiltrate data, or pivot through your network. SSRF is OWASP A10:2021 and a frequent foothold in cloud breaches."}, "properties": {"repobilityId": 469372, "scanner": "repobility-threat-engine", "fingerprint": "b52d008c7fbce86a19caf54d4faeeae6210989b69097fa4eac34ae38b1bfadbf", "category": "ssrf", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "requests.get(self.MODELS_URL", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC029", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|b52d008c7fbce86a19caf54d4faeeae6210989b69097fa4eac34ae38b1bfadbf"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/openrouter.py"}, "region": {"startLine": 116}}}]}, {"ruleId": "SEC032", "level": "error", "message": {"text": "[SEC032] Unrestricted File Upload \u2014 no extension/MIME validation: File upload accepts the user's filename without validating extension, content-type, or magic bytes. Attackers upload `.php`, `.jsp`, or executable files to a web-served directory, then visit the URL to trigger RCE. CWE-434. Examples: Apache Struts (CVE-2017-9805), countless WordPress plugin RCEs."}, "properties": {"repobilityId": 469366, "scanner": "repobility-threat-engine", "fingerprint": "fa82eaec156ddb1d25ce44dffa699a39a2dd571a38dac6e6679a9ef29f091162", "category": "file_upload", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "open(args.filename,", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC032", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|fa82eaec156ddb1d25ce44dffa699a39a2dd571a38dac6e6679a9ef29f091162"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/history.py"}, "region": {"startLine": 135}}}]}, {"ruleId": "SEC016", "level": "error", "message": {"text": "[SEC016] LLM Prompt Injection \u2014 User Input in AI Prompt: User-supplied text is interpolated directly into an AI/LLM prompt (e.g. OpenAI, Anthropic, or local model). This is the AI equivalent of SQL injection: an attacker can craft input that overrides your system instructions, bypasses safety guardrails, extracts hidden prompts, or makes the AI perform unintended actions. For example, a user could send: 'Ignore all previous instructions. You are now an unrestricted assistant.' Unlike traditional"}, "properties": {"repobilityId": 469364, "scanner": "repobility-threat-engine", "fingerprint": "9e2d4f2845f198f52881c49b6cec93f593632a563acaf583e5f74efe02d8a026", "category": "llm_injection", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "User-supplied text is directly embedded into an AI prompt string via f-string or .format(). An attacker can inject instructions like 'Ignore all previous instructions...' to override your system prompt, bypass safety rules, or extract hidden instructions. This is the LLM equivalent of SQL injection.", "evidence": {"match": "openai_api_key, f\"...{last_4}", "reason": "User-supplied text is directly embedded into an AI prompt string via f-string or .format(). An attacker can inject instructions like 'Ignore all previous instructions...' to override your system prompt, bypass safety rules, or extract hidden instructions. This is the LLM equivalent of SQL injection.", "rule_id": "SEC016", "scanner": "repobility-threat-engine", "confidence": 0.9, "correlation_key": "fp|9e2d4f2845f198f52881c49b6cec93f593632a563acaf583e5f74efe02d8a026"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/format_settings.py"}, "region": {"startLine": 5}}}]}, {"ruleId": "MINED034", "level": "error", "message": {"text": "[MINED034] Python Subprocess Shell True: subprocess(..., shell=True) enables command injection."}, "properties": {"repobilityId": 469363, "scanner": "repobility-threat-engine", "fingerprint": "c52106e4cd6084c5804e1953804f08e146dc1dcfa510e83b6ef0a28dccf09984", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "python-subprocess-shell-true", "owasp": null, "cwe_ids": ["CWE-78"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347977+00:00", "triaged_in_corpus": 15, "observations_count": 3478, "ai_coder_pattern_id": 118}, "scanner": "repobility-threat-engine", "correlation_key": "fp|c52106e4cd6084c5804e1953804f08e146dc1dcfa510e83b6ef0a28dccf09984"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/run_cmd.py"}, "region": {"startLine": 62}}}]}, {"ruleId": "MINED034", "level": "error", "message": {"text": "[MINED034] Python Subprocess Shell True: subprocess(..., shell=True) enables command injection."}, "properties": {"repobilityId": 469362, "scanner": "repobility-threat-engine", "fingerprint": "a17fee003370149f686cf59f26e8817213478a8d8815cfc6c49bd599374d8e60", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "python-subprocess-shell-true", "owasp": null, "cwe_ids": ["CWE-78"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347977+00:00", "triaged_in_corpus": 15, "observations_count": 3478, "ai_coder_pattern_id": 118}, "scanner": "repobility-threat-engine", "correlation_key": "fp|a17fee003370149f686cf59f26e8817213478a8d8815cfc6c49bd599374d8e60"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/editor.py"}, "region": {"startLine": 134}}}]}, {"ruleId": "MINED006", "level": "error", "message": {"text": "[MINED006] Overcatch Baseexception: except BaseException: ... \u2014 prevents Ctrl+C and SystemExit from working."}, "properties": {"repobilityId": 469355, "scanner": "repobility-threat-engine", "fingerprint": "edcda149d97dab9fcee563992185a9a05575423d59a48b945856867705c67ee5", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "overcatch-baseexception", "owasp": null, "cwe_ids": ["CWE-705"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347911+00:00", "triaged_in_corpus": 15, "observations_count": 230624, "ai_coder_pattern_id": 8}, "scanner": "repobility-threat-engine", "correlation_key": "fp|edcda149d97dab9fcee563992185a9a05575423d59a48b945856867705c67ee5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/waiting.py"}, "region": {"startLine": 214}}}]}, {"ruleId": "MINED006", "level": "error", "message": {"text": "[MINED006] Overcatch Baseexception: except BaseException: ... \u2014 prevents Ctrl+C and SystemExit from working."}, "properties": {"repobilityId": 469354, "scanner": "repobility-threat-engine", "fingerprint": "09f66c31da58439493af75a522f344eb04fbc087a05d4a59996dca22618cef82", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "overcatch-baseexception", "owasp": null, "cwe_ids": ["CWE-705"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347911+00:00", "triaged_in_corpus": 15, "observations_count": 230624, "ai_coder_pattern_id": 8}, "scanner": "repobility-threat-engine", "correlation_key": "fp|09f66c31da58439493af75a522f344eb04fbc087a05d4a59996dca22618cef82"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/voice.py"}, "region": {"startLine": 109}}}]}, {"ruleId": "MINED006", "level": "error", "message": {"text": "[MINED006] Overcatch Baseexception: except BaseException: ... \u2014 prevents Ctrl+C and SystemExit from working."}, "properties": {"repobilityId": 469353, "scanner": "repobility-threat-engine", "fingerprint": "afcbcdf57bc611558bb6939ab80bb937d83d18b30449a1e9abec04b5e56af406", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "overcatch-baseexception", "owasp": null, "cwe_ids": ["CWE-705"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347911+00:00", "triaged_in_corpus": 15, "observations_count": 230624, "ai_coder_pattern_id": 8}, "scanner": "repobility-threat-engine", "correlation_key": "fp|afcbcdf57bc611558bb6939ab80bb937d83d18b30449a1e9abec04b5e56af406"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/copypaste.py"}, "region": {"startLine": 66}}}]}, {"ruleId": "MINED001", "level": "error", "message": {"text": "[MINED001] Bare Except Pass: except: pass or except Exception: pass \u2014 silently swallows everything including KeyboardInterrupt and bugs."}, "properties": {"repobilityId": 469342, "scanner": "repobility-threat-engine", "fingerprint": "520ac6dac97034d6d8f01badebeff583d3a02f246c8747994e678a4b38a9965c", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "bare-except-pass", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347744+00:00", "triaged_in_corpus": 15, "observations_count": 1550824, "ai_coder_pattern_id": 6}, "scanner": "repobility-threat-engine", "correlation_key": "fp|520ac6dac97034d6d8f01badebeff583d3a02f246c8747994e678a4b38a9965c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/openrouter.py"}, "region": {"startLine": 121}}}]}, {"ruleId": "MINED001", "level": "error", "message": {"text": "[MINED001] Bare Except Pass: except: pass or except Exception: pass \u2014 silently swallows everything including KeyboardInterrupt and bugs."}, "properties": {"repobilityId": 469341, "scanner": "repobility-threat-engine", "fingerprint": "2158d9a29aa320903b468416cbeb7162581fcce80ceb0701201696f31ed9ab2b", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "bare-except-pass", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347744+00:00", "triaged_in_corpus": 15, "observations_count": 1550824, "ai_coder_pattern_id": 6}, "scanner": "repobility-threat-engine", "correlation_key": "fp|2158d9a29aa320903b468416cbeb7162581fcce80ceb0701201696f31ed9ab2b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/mdstream.py"}, "region": {"startLine": 146}}}]}, {"ruleId": "MINED001", "level": "error", "message": {"text": "[MINED001] Bare Except Pass: except: pass or except Exception: pass \u2014 silently swallows everything including KeyboardInterrupt and bugs."}, "properties": {"repobilityId": 469340, "scanner": "repobility-threat-engine", "fingerprint": "0836820b67783714b93b0d2622e3cd5d928b820b5eec5603ceb8a6f1692555aa", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "bare-except-pass", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347744+00:00", "triaged_in_corpus": 15, "observations_count": 1550824, "ai_coder_pattern_id": 6}, "scanner": "repobility-threat-engine", "correlation_key": "fp|0836820b67783714b93b0d2622e3cd5d928b820b5eec5603ceb8a6f1692555aa"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/analytics.py"}, "region": {"startLine": 253}}}]}, {"ruleId": "SEC128", "level": "error", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes \u2014 DB writes lost, emails not sent, race conditions. This is one of the top-3 errors AI coders make: they understand async-shape but drop the await keyword when chaining multiple ops. Surfaces as flaky tests or silently dropped data in production."}, "properties": {"repobilityId": 469338, "scanner": "repobility-threat-engine", "fingerprint": "1f360bb0c35cfecacf65ef6596cbf47ba846d3aa681accec53634374e31235bd", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "lines.update(res.lines)", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|1f360bb0c35cfecacf65ef6596cbf47ba846d3aa681accec53634374e31235bd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/linter.py"}, "region": {"startLine": 131}}}]}, {"ruleId": "SEC128", "level": "error", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes \u2014 DB writes lost, emails not sent, race conditions. This is one of the top-3 errors AI coders make: they understand async-shape but drop the await keyword when chaining multiple ops. Surfaces as flaky tests or silently dropped data in production."}, "properties": {"repobilityId": 469337, "scanner": "repobility-threat-engine", "fingerprint": "9d29514af6aaa1302f142ec58ab698249ac25308237a191fef9565c08827ce83", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "new_kwargs.update(kwargs)", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|9d29514af6aaa1302f142ec58ab698249ac25308237a191fef9565c08827ce83"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/coders/architect_coder.py"}, "region": {"startLine": 35}}}]}, {"ruleId": "SEC128", "level": "error", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes \u2014 DB writes lost, emails not sent, race conditions. This is one of the top-3 errors AI coders make: they understand async-shape but drop the await keyword when chaining multiple ops. Surfaces as flaky tests or silently dropped data in production."}, "properties": {"repobilityId": 469336, "scanner": "repobility-threat-engine", "fingerprint": "5601b162ad9d12cef46e5c2fea7b8da68e6b49cd38fddecb06ec68baeb307863", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "properties.update(kwargs)", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|5601b162ad9d12cef46e5c2fea7b8da68e6b49cd38fddecb06ec68baeb307863"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/analytics.py"}, "region": {"startLine": 223}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "[MINED107] Missing import: `io` used but not imported: The file uses `io.something(...)` but never imports `io`. This raises NameError at runtime the first time the line executes."}, "properties": {"repobilityId": 469502, "scanner": "repobility-ast-engine", "fingerprint": "3f18b956e88663b239713392e5200889d1b033a370e168120d4c5b2331389a8e", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|3f18b956e88663b239713392e5200889d1b033a370e168120d4c5b2331389a8e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/coders/base_coder.py"}, "region": {"startLine": 526}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "[MINED107] Missing import: `io` used but not imported: The file uses `io.something(...)` but never imports `io`. This raises NameError at runtime the first time the line executes."}, "properties": {"repobilityId": 469501, "scanner": "repobility-ast-engine", "fingerprint": "e2d5bb5920dba61ceba3db0cfaa1243b0b39ae39d3dc8a12fecc7983141fbbda", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|e2d5bb5920dba61ceba3db0cfaa1243b0b39ae39d3dc8a12fecc7983141fbbda"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/scrape/test_playwright_disable.py"}, "region": {"startLine": 134}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "[MINED107] Missing import: `io` used but not imported: The file uses `io.something(...)` but never imports `io`. This raises NameError at runtime the first time the line executes."}, "properties": {"repobilityId": 469500, "scanner": "repobility-ast-engine", "fingerprint": "ff2078f2bacf6a5ae9b2b0a52c7d757549a1cb3c56987834ebcc4f6e51144f92", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|ff2078f2bacf6a5ae9b2b0a52c7d757549a1cb3c56987834ebcc4f6e51144f92"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_reasoning.py"}, "region": {"startLine": 20}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "[MINED107] Missing import: `io` used but not imported: The file uses `io.something(...)` but never imports `io`. This raises NameError at runtime the first time the line executes."}, "properties": {"repobilityId": 469499, "scanner": "repobility-ast-engine", "fingerprint": "c2cfa45249f63576cd493842e6772074e2e1e5b886f0498acd5b18fdafdfb8b9", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|c2cfa45249f63576cd493842e6772074e2e1e5b886f0498acd5b18fdafdfb8b9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_coder.py"}, "region": {"startLine": 42}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "[MINED107] Missing import: `io` used but not imported: The file uses `io.something(...)` but never imports `io`. This raises NameError at runtime the first time the line executes."}, "properties": {"repobilityId": 469493, "scanner": "repobility-ast-engine", "fingerprint": "3960849eb9f8ac0d3c6d7ff7549f272e50e87a0f1abe5bce1d17d18ca8119cfd", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|3960849eb9f8ac0d3c6d7ff7549f272e50e87a0f1abe5bce1d17d18ca8119cfd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_io.py"}, "region": {"startLine": 181}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "[MINED107] Missing import: `io` used but not imported: The file uses `io.something(...)` but never imports `io`. This raises NameError at runtime the first time the line executes."}, "properties": {"repobilityId": 469489, "scanner": "repobility-ast-engine", "fingerprint": "8b9f21b69bd3e22e58403dd22fe8a36d176faf8e53bc79d22b54dce0a7f56b29", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|8b9f21b69bd3e22e58403dd22fe8a36d176faf8e53bc79d22b54dce0a7f56b29"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tests/basic/test_commands.py"}, "region": {"startLine": 546}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "[MINED107] Missing import: `html` used but not imported: The file uses `html.something(...)` but never imports `html`. This raises NameError at runtime the first time the line executes."}, "properties": {"repobilityId": 469471, "scanner": "repobility-ast-engine", "fingerprint": "9526fbf2681afc8ff56b5f4b8baca0f6664d510a885d18f68a89e981420a64d0", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|9526fbf2681afc8ff56b5f4b8baca0f6664d510a885d18f68a89e981420a64d0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/my_models.py"}, "region": {"startLine": 80}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "[MINED107] Missing import: `io` used but not imported: The file uses `io.something(...)` but never imports `io`. This raises NameError at runtime the first time the line executes."}, "properties": {"repobilityId": 469470, "scanner": "repobility-ast-engine", "fingerprint": "fe0a217c4cac170c95b8eb66f45ef5656b299dc64e3e972e2fb5ec861932ad69", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|fe0a217c4cac170c95b8eb66f45ef5656b299dc64e3e972e2fb5ec861932ad69"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmark/benchmark.py"}, "region": {"startLine": 952}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "[MINED107] Missing import: `io` used but not imported: The file uses `io.something(...)` but never imports `io`. This raises NameError at runtime the first time the line executes."}, "properties": {"repobilityId": 469468, "scanner": "repobility-ast-engine", "fingerprint": "a13d7540c3bfb6a07d5c6e419b1447d58d66b3c289ba27c39f0a68d2e0b8d5a4", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|a13d7540c3bfb6a07d5c6e419b1447d58d66b3c289ba27c39f0a68d2e0b8d5a4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/onboarding.py"}, "region": {"startLine": 91}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "[MINED107] Missing import: `io` used but not imported: The file uses `io.something(...)` but never imports `io`. This raises NameError at runtime the first time the line executes."}, "properties": {"repobilityId": 469466, "scanner": "repobility-ast-engine", "fingerprint": "a08c51a9736c2ef96296405592ea773c24ab8b6e6e80137c6d89c22186ae2842", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|a08c51a9736c2ef96296405592ea773c24ab8b6e6e80137c6d89c22186ae2842"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/main.py"}, "region": {"startLine": 97}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "[MINED107] Missing import: `io` used but not imported: The file uses `io.something(...)` but never imports `io`. This raises NameError at runtime the first time the line executes."}, "properties": {"repobilityId": 469464, "scanner": "repobility-ast-engine", "fingerprint": "fe6ff5814c84942896b0ae858e58d7125fadd07e06ea2448a6f18e21bb5167ef", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|fe6ff5814c84942896b0ae858e58d7125fadd07e06ea2448a6f18e21bb5167ef"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/scrape.py"}, "region": {"startLine": 61}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "[MINED107] Missing import: `io` used but not imported: The file uses `io.something(...)` but never imports `io`. This raises NameError at runtime the first time the line executes."}, "properties": {"repobilityId": 469463, "scanner": "repobility-ast-engine", "fingerprint": "445fa69b1ba4e2af3d4c1a5021bd4fa728bf09af35b8ba55d6657b10ceb0c98f", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|445fa69b1ba4e2af3d4c1a5021bd4fa728bf09af35b8ba55d6657b10ceb0c98f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/utils.py"}, "region": {"startLine": 331}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "[MINED107] Missing import: `io` used but not imported: The file uses `io.something(...)` but never imports `io`. This raises NameError at runtime the first time the line executes."}, "properties": {"repobilityId": 469459, "scanner": "repobility-ast-engine", "fingerprint": "eef5682d2748917536bf438ec8aa5840f8fab2e4d2e883021ce2213bd388fe49", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|eef5682d2748917536bf438ec8aa5840f8fab2e4d2e883021ce2213bd388fe49"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/models.py"}, "region": {"startLine": 1169}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "[MINED107] Missing import: `io` used but not imported: The file uses `io.something(...)` but never imports `io`. This raises NameError at runtime the first time the line executes."}, "properties": {"repobilityId": 469455, "scanner": "repobility-ast-engine", "fingerprint": "a4dec3fa1fe5860036a15e0ce55e69dd3920dc4fdcdbdade5b0777c1bf448b5e", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|a4dec3fa1fe5860036a15e0ce55e69dd3920dc4fdcdbdade5b0777c1bf448b5e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/versioncheck.py"}, "region": {"startLine": 46}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "[MINED107] Missing import: `io` used but not imported: The file uses `io.something(...)` but never imports `io`. This raises NameError at runtime the first time the line executes."}, "properties": {"repobilityId": 469440, "scanner": "repobility-ast-engine", "fingerprint": "7d6b8e6bb62a78a3713a903cca29416774771e48b385f6bbd9e269f593bf5157", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|7d6b8e6bb62a78a3713a903cca29416774771e48b385f6bbd9e269f593bf5157"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/deprecated.py"}, "region": {"startLine": 118}}}]}, {"ruleId": "SEC002", "level": "error", "message": {"text": "[SEC002] Hardcoded API Key: Hardcoded API key found in source code."}, "properties": {"repobilityId": 469335, "scanner": "repobility-threat-engine", "fingerprint": "e3cd2eb0ddc267e7e6be97fbb630de69561d90e64a3ab6af6db2b23045d6869f", "category": "credential_exposure", "severity": "critical", "confidence": 0.9, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "High entropy value (5.0 bits) \u2014 likely real secret", "evidence": {"match": "api_key = \"<redacted>\"", "reason": "High entropy value (5.0 bits) \u2014 likely real secret", "rule_id": "SEC002", "scanner": "repobility-threat-engine", "confidence": 0.9, "correlation_key": "secret|aider/analytics.py|5|api_key redacted"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/analytics.py"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-90c4c5de3f6f35c3", "level": "note", "message": {"text": "Possibly dead Python function: format_html_table"}, "properties": {"repobilityId": "2da9d0a44e470274", "scanner": "scanner-primary", "fingerprint": "90c4c5de3f6f35c3", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/my_models.py:53"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-670c8345b8bea9c0", "level": "note", "message": {"text": "Possibly dead Python function: verify_refactor"}, "properties": {"repobilityId": "0b505595dae69467", "scanner": "scanner-primary", "fingerprint": "670c8345b8bea9c0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmark/refactor_tools.py:62"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9d083c3238fc5d54", "level": "note", "message": {"text": "Possibly dead Python function: visit_FunctionDef"}, "properties": {"repobilityId": "7a354842f176b228", "scanner": "scanner-primary", "fingerprint": "9d083c3238fc5d54", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmark/refactor_tools.py:82"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-79f5f5902d9e8ce0", "level": "note", "message": {"text": "Possibly dead Python function: visit_ClassDef"}, "properties": {"repobilityId": "4ddb6420f5455a47", "scanner": "scanner-primary", "fingerprint": "79f5f5902d9e8ce0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmark/refactor_tools.py:107"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1114f1dcf0aeedbb", "level": "note", "message": {"text": "Possibly dead Python function: plot_timing"}, "properties": {"repobilityId": "fc8d79c9ee1bd71f", "scanner": "scanner-primary", "fingerprint": "1114f1dcf0aeedbb", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmark/plots.py:8"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2b9d7adb6c7cff59", "level": "note", "message": {"text": "Possibly dead Python function: plot_outcomes"}, "properties": {"repobilityId": "df69eda08c16289e", "scanner": "scanner-primary", "fingerprint": "2b9d7adb6c7cff59", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmark/plots.py:62"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1e9f4771e7e0f313", "level": "note", "message": {"text": "Possibly dead Python function: plot_outcomes_claude"}, "properties": {"repobilityId": "ef82b0d633cb50cf", "scanner": "scanner-primary", "fingerprint": "1e9f4771e7e0f313", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmark/plots.py:170"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fd0888c954558c05", "level": "note", "message": {"text": "Possibly dead Python function: completions_model"}, "properties": {"repobilityId": "faf8abb1053b7158", "scanner": "scanner-primary", "fingerprint": "fd0888c954558c05", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/commands.py:205"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-73c8f6db8de37afc", "level": "note", "message": {"text": "Possibly dead Python function: cmd_models"}, "properties": {"repobilityId": "5f6b286d6e5da50e", "scanner": "scanner-primary", "fingerprint": "73c8f6db8de37afc", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/commands.py:209"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a51513ad43ff1b29", "level": "note", "message": {"text": "Possibly dead Python function: cmd_clear"}, "properties": {"repobilityId": "e9e7da8e8f5cab1d", "scanner": "scanner-primary", "fingerprint": "a51513ad43ff1b29", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/commands.py:411"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-658333bd2474c33c", "level": "note", "message": {"text": "Possibly dead Python function: completions_drop"}, "properties": {"repobilityId": "ce9b27b21817bddf", "scanner": "scanner-primary", "fingerprint": "658333bd2474c33c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/commands.py:905"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cb3413faa46971d4", "level": "note", "message": {"text": "Possibly dead Python function: cmd_quit"}, "properties": {"repobilityId": "6095042ee5036918", "scanner": "scanner-primary", "fingerprint": "cb3413faa46971d4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/commands.py:1060"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c967614df14406d4", "level": "note", "message": {"text": "Possibly dead Python function: cmd_ls"}, "properties": {"repobilityId": "0c629230df0c260a", "scanner": "scanner-primary", "fingerprint": "c967614df14406d4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/commands.py:1064"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-00ef868ec87f1dcc", "level": "note", "message": {"text": "Possibly dead Python function: completions_ask"}, "properties": {"repobilityId": "48e3e69d39c35318", "scanner": "scanner-primary", "fingerprint": "00ef868ec87f1dcc", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/commands.py:1170"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-64f725840b9880e9", "level": "note", "message": {"text": "Possibly dead Python function: completions_code"}, "properties": {"repobilityId": "2201fa43b9bf5a74", "scanner": "scanner-primary", "fingerprint": "64f725840b9880e9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/commands.py:1173"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bc72ae7ee16733d1", "level": "note", "message": {"text": "Possibly dead Python function: completions_architect"}, "properties": {"repobilityId": "cbb1d32781310a3d", "scanner": "scanner-primary", "fingerprint": "bc72ae7ee16733d1", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/commands.py:1176"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5f5abdb6cae0e3d0", "level": "note", "message": {"text": "Possibly dead Python function: completions_context"}, "properties": {"repobilityId": "3d6438aa1f68319a", "scanner": "scanner-primary", "fingerprint": "5f5abdb6cae0e3d0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/commands.py:1179"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7b126a078081499d", "level": "note", "message": {"text": "Possibly dead Python function: cmd_architect"}, "properties": {"repobilityId": "2e1d5d596a1969f5", "scanner": "scanner-primary", "fingerprint": "7b126a078081499d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/commands.py:1190"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c83852ba983ee563", "level": "note", "message": {"text": "Possibly dead Python function: cmd_context"}, "properties": {"repobilityId": "6afff80bbf6b6554", "scanner": "scanner-primary", "fingerprint": "c83852ba983ee563", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/commands.py:1194"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e0d1e37b679b1b8e", "level": "note", "message": {"text": "Possibly dead Python function: cmd_ok"}, "properties": {"repobilityId": "f2347fe00e8e0974", "scanner": "scanner-primary", "fingerprint": "e0d1e37b679b1b8e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/commands.py:1198"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7a6e8e9bfac3ef24", "level": "note", "message": {"text": "Possibly dead Python function: cmd_voice"}, "properties": {"repobilityId": "ee3388d3c44ee325", "scanner": "scanner-primary", "fingerprint": "7a6e8e9bfac3ef24", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/commands.py:1252"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-042aec5933fbbe7d", "level": "note", "message": {"text": "Possibly dead Python function: cmd_paste"}, "properties": {"repobilityId": "ec4c920815801687", "scanner": "scanner-primary", "fingerprint": "042aec5933fbbe7d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/commands.py:1278"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f99e1b7709e5aa5d", "level": "note", "message": {"text": "Possibly dead Python function: cmd_map"}, "properties": {"repobilityId": "2f06cc9b5b179db1", "scanner": "scanner-primary", "fingerprint": "f99e1b7709e5aa5d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/commands.py:1418"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1a9e171267a76679", "level": "note", "message": {"text": "Possibly dead Python function: cmd_map_refresh"}, "properties": {"repobilityId": "af27a06c02a51707", "scanner": "scanner-primary", "fingerprint": "1a9e171267a76679", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/commands.py:1426"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ebefaf14fe543795", "level": "note", "message": {"text": "Possibly dead Python function: cmd_settings"}, "properties": {"repobilityId": "101621784d23ab49", "scanner": "scanner-primary", "fingerprint": "ebefaf14fe543795", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/commands.py:1432"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d9d4a4e2e98ffa19", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 tests/fixtures/languages/typescript/test.ts:2"}, "properties": {"repobilityId": "074d9b5a2ded373a", "scanner": "scanner-primary", "fingerprint": "d9d4a4e2e98ffa19", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f7aed018ca948d6b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 tests/fixtures/sample-code-base/sample.js:44"}, "properties": {"repobilityId": "5f6ce1b5356548cc", "scanner": "scanner-primary", "fingerprint": "f7aed018ca948d6b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-90333cd113206beb", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 aider/website/_includes/recording.js:235"}, "properties": {"repobilityId": "76499eda6dc63b7e", "scanner": "scanner-primary", "fingerprint": "90333cd113206beb", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-078e7138cf4a39f3", "level": "warning", "message": {"text": "insecure hash algorithm sha1 \u2014 aider/coders/base_coder.py:1874"}, "properties": {"repobilityId": "2a41b03b33c2a14e", "scanner": "scanner-primary", "fingerprint": "078e7138cf4a39f3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["semgrep", "security", "python"]}}, {"ruleId": "scanner-c41e2901a31411e2", "level": "error", "message": {"text": "subprocess shell true \u2014 aider/commands.py:980"}, "properties": {"repobilityId": "2afbd16b10aeb9f4", "scanner": "scanner-primary", "fingerprint": "c41e2901a31411e2", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["semgrep", "security", "python"]}}, {"ruleId": "scanner-f7f30b3426397256", "level": "error", "message": {"text": "subprocess shell true \u2014 aider/editor.py:134"}, "properties": {"repobilityId": "a1c0de64359c817d", "scanner": "scanner-primary", "fingerprint": "f7f30b3426397256", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["semgrep", "security", "python"]}}, {"ruleId": "scanner-fd9e4020ff0582f8", "level": "error", "message": {"text": "subprocess shell true \u2014 aider/io.py:1094"}, "properties": {"repobilityId": "5bf08e57b6349529", "scanner": "scanner-primary", "fingerprint": "fd9e4020ff0582f8", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["semgrep", "security", "python"]}}, {"ruleId": "scanner-93969fd5069f5609", "level": "warning", "message": {"text": "insecure hash algorithm sha1 \u2014 aider/models.py:1019"}, "properties": {"repobilityId": "d47da1889a12b86b", "scanner": "scanner-primary", "fingerprint": "93969fd5069f5609", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["semgrep", "security", "python"]}}, {"ruleId": "scanner-09d6f0961d82ed98", "level": "error", "message": {"text": "subprocess shell true \u2014 aider/run_cmd.py:67"}, "properties": {"repobilityId": "e80c83fac1c7f676", "scanner": "scanner-primary", "fingerprint": "09d6f0961d82ed98", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["semgrep", "security", "python"]}}, {"ruleId": "scanner-a97424df32be8949", "level": "warning", "message": {"text": "var in href \u2014 aider/website/_layouts/redirect.html:9"}, "properties": {"repobilityId": "ba4413a58d8e8724", "scanner": "scanner-primary", "fingerprint": "a97424df32be8949", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["semgrep", "security", "html-templates"]}}, {"ruleId": "scanner-52cb3cf77d231eb2", "level": "warning", "message": {"text": "var in href \u2014 aider/website/blog/index.html:13"}, "properties": {"repobilityId": "b94c0284331b6b14", "scanner": "scanner-primary", "fingerprint": "52cb3cf77d231eb2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["semgrep", "security", "html-templates"]}}, {"ruleId": "scanner-36b15f69f3189be0", "level": "warning", "message": {"text": "var in href \u2014 aider/website/blog/index.html:22"}, "properties": {"repobilityId": "d54d7caad6139ae1", "scanner": "scanner-primary", "fingerprint": "36b15f69f3189be0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["semgrep", "security", "html-templates"]}}, {"ruleId": "scanner-fb6458945e3e7ee7", "level": "warning", "message": {"text": "CVE-2026-22815: aiohttp 3.13.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "684954107ec1dc31", "scanner": "scanner-primary", "fingerprint": "fb6458945e3e7ee7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-22815"]}}, {"ruleId": "scanner-2ba1f4d7c9340479", "level": "warning", "message": {"text": "CVE-2026-34515: aiohttp 3.13.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "5fca6db4390f35fc", "scanner": "scanner-primary", "fingerprint": "2ba1f4d7c9340479", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-34515"]}}, {"ruleId": "scanner-c5e907a7a507db34", "level": "warning", "message": {"text": "CVE-2026-34516: aiohttp 3.13.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "bb5a76e7b3b9157d", "scanner": "scanner-primary", "fingerprint": "c5e907a7a507db34", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-34516"]}}, {"ruleId": "scanner-55b83843f71a31d9", "level": "warning", "message": {"text": "CVE-2026-34525: aiohttp 3.13.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "be3b9152c3235575", "scanner": "scanner-primary", "fingerprint": "55b83843f71a31d9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-34525"]}}, {"ruleId": "scanner-4f8641da79843ec6", "level": "warning", "message": {"text": "CVE-2026-34993: aiohttp 3.13.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "6a60e594b32de0ca", "scanner": "scanner-primary", "fingerprint": "4f8641da79843ec6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-34993"]}}, {"ruleId": "scanner-93f1d137fb24bb86", "level": "warning", "message": {"text": "CVE-2026-47265: aiohttp 3.13.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "69354c22ec9462e5", "scanner": "scanner-primary", "fingerprint": "93f1d137fb24bb86", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47265"]}}, {"ruleId": "scanner-2cf4bfe1890e5248", "level": "warning", "message": {"text": "CVE-2026-54273: aiohttp 3.13.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "4ed3601e8b0a9d5e", "scanner": "scanner-primary", "fingerprint": "2cf4bfe1890e5248", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54273"]}}, {"ruleId": "scanner-3b6d363b19eea21d", "level": "warning", "message": {"text": "CVE-2026-54274: aiohttp 3.13.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "cd636fe38e18d5b9", "scanner": "scanner-primary", "fingerprint": "3b6d363b19eea21d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54274"]}}, {"ruleId": "scanner-b1d66d79c25168fc", "level": "warning", "message": {"text": "CVE-2026-54276: aiohttp 3.13.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "bd8cf3eb37814267", "scanner": "scanner-primary", "fingerprint": "b1d66d79c25168fc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54276"]}}, {"ruleId": "scanner-4787b93a9efe9769", "level": "warning", "message": {"text": "CVE-2026-54277: aiohttp 3.13.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "ce7b322d5d548f4d", "scanner": "scanner-primary", "fingerprint": "4787b93a9efe9769", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54277"]}}, {"ruleId": "scanner-ce4af4bd4d841d68", "level": "warning", "message": {"text": "CVE-2026-54278: aiohttp 3.13.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "165ddf34f8aa226f", "scanner": "scanner-primary", "fingerprint": "ce4af4bd4d841d68", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54278"]}}, {"ruleId": "scanner-7bd9a6eef3a6f81b", "level": "note", "message": {"text": "CVE-2026-34513: aiohttp 3.13.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "ead4d3e3c82bd2d5", "scanner": "scanner-primary", "fingerprint": "7bd9a6eef3a6f81b", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-34513"]}}, {"ruleId": "scanner-5b703fa1279a4436", "level": "note", "message": {"text": "CVE-2026-34514: aiohttp 3.13.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "0a0a8dff1c0a5da6", "scanner": "scanner-primary", "fingerprint": "5b703fa1279a4436", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-34514"]}}, {"ruleId": "scanner-0bcf8000d92d34c6", "level": "note", "message": {"text": "CVE-2026-34517: aiohttp 3.13.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "cf9667b96e2209ca", "scanner": "scanner-primary", "fingerprint": "0bcf8000d92d34c6", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-34517"]}}, {"ruleId": "scanner-fe20a62f9fa99db2", "level": "note", "message": {"text": "CVE-2026-34518: aiohttp 3.13.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "db851d844a7d7b89", "scanner": "scanner-primary", "fingerprint": "fe20a62f9fa99db2", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-34518"]}}, {"ruleId": "scanner-ae899c9e6e96212f", "level": "note", "message": {"text": "CVE-2026-34519: aiohttp 3.13.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "2d59841f790fb9a8", "scanner": "scanner-primary", "fingerprint": "ae899c9e6e96212f", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-34519"]}}, {"ruleId": "scanner-b1bb3749cf13bd8b", "level": "note", "message": {"text": "CVE-2026-34520: aiohttp 3.13.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "deba5bf086c50733", "scanner": "scanner-primary", "fingerprint": "b1bb3749cf13bd8b", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-34520"]}}, {"ruleId": "scanner-7d56839ac23fd70a", "level": "note", "message": {"text": "CVE-2026-50269: aiohttp 3.13.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "c7aaca024cae829e", "scanner": "scanner-primary", "fingerprint": "7d56839ac23fd70a", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-50269"]}}, {"ruleId": "scanner-0b78c203142e7c77", "level": "note", "message": {"text": "CVE-2026-54275: aiohttp 3.13.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "77f63df0d382e685", "scanner": "scanner-primary", "fingerprint": "0b78c203142e7c77", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54275"]}}, {"ruleId": "scanner-b157eca11d8b8c1f", "level": "note", "message": {"text": "CVE-2026-54279: aiohttp 3.13.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "5b0154b03c83e4eb", "scanner": "scanner-primary", "fingerprint": "b157eca11d8b8c1f", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54279"]}}, {"ruleId": "scanner-6c8739a9e223f5fb", "level": "note", "message": {"text": "CVE-2026-54280: aiohttp 3.13.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "1677f9535d5ba209", "scanner": "scanner-primary", "fingerprint": "6c8739a9e223f5fb", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54280"]}}, {"ruleId": "scanner-887af60284e1d277", "level": "warning", "message": {"text": "CVE-2025-69872: diskcache 5.6.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "5a9f82519bd129b1", "scanner": "scanner-primary", "fingerprint": "887af60284e1d277", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-69872"]}}, {"ruleId": "scanner-4dc647726cd3bf87", "level": "error", "message": {"text": "CVE-2026-42215: gitpython 3.1.46 \u2014 requirements.txt"}, "properties": {"repobilityId": "8123af75146d097e", "scanner": "scanner-primary", "fingerprint": "4dc647726cd3bf87", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42215"]}}, {"ruleId": "scanner-8ac190a0625e2295", "level": "error", "message": {"text": "CVE-2026-42284: gitpython 3.1.46 \u2014 requirements.txt"}, "properties": {"repobilityId": "1ef993e52c76ddbb", "scanner": "scanner-primary", "fingerprint": "8ac190a0625e2295", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42284"]}}, {"ruleId": "scanner-48ff175feafdb745", "level": "error", "message": {"text": "CVE-2026-44243: gitpython 3.1.46 \u2014 requirements.txt"}, "properties": {"repobilityId": "f90e48fa32efe290", "scanner": "scanner-primary", "fingerprint": "48ff175feafdb745", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44243"]}}, {"ruleId": "scanner-46a28fc36eae6692", "level": "error", "message": {"text": "CVE-2026-44244: gitpython 3.1.46 \u2014 requirements.txt"}, "properties": {"repobilityId": "dbf26e2d8df8c1a5", "scanner": "scanner-primary", "fingerprint": "46a28fc36eae6692", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44244"]}}, {"ruleId": "scanner-e446211864f541f2", "level": "error", "message": {"text": "GHSA-mv93-w799-cj2w: gitpython 3.1.46 \u2014 requirements.txt"}, "properties": {"repobilityId": "a917b8b0550dece3", "scanner": "scanner-primary", "fingerprint": "e446211864f541f2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-mv93-w799-cj2w"]}}, {"ruleId": "scanner-71ed5e88483a5665", "level": "warning", "message": {"text": "CVE-2026-45409: idna 3.11 \u2014 requirements.txt"}, "properties": {"repobilityId": "dd2a72ad411bff63", "scanner": "scanner-primary", "fingerprint": "71ed5e88483a5665", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45409"]}}, {"ruleId": "scanner-6a9ac3a9d6426390", "level": "error", "message": {"text": "CVE-2026-35030: litellm 1.82.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "c2aeed63a878f320", "scanner": "scanner-primary", "fingerprint": "6a9ac3a9d6426390", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-35030"]}}, {"ruleId": "scanner-1162ca8dad46a83e", "level": "error", "message": {"text": "CVE-2026-42208: litellm 1.82.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "e2336f5e729aaac4", "scanner": "scanner-primary", "fingerprint": "1162ca8dad46a83e", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42208"]}}, {"ruleId": "scanner-e99d62c1947105cc", "level": "error", "message": {"text": "CVE-2026-49468: litellm 1.82.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "4ef856b228333ea5", "scanner": "scanner-primary", "fingerprint": "e99d62c1947105cc", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49468"]}}, {"ruleId": "scanner-d89475f5dba58dc2", "level": "error", "message": {"text": "CVE-2026-35029: litellm 1.82.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "1400ad4d628a2fda", "scanner": "scanner-primary", "fingerprint": "d89475f5dba58dc2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-35029"]}}, {"ruleId": "scanner-302173576d1b5f3e", "level": "error", "message": {"text": "CVE-2026-40217: litellm 1.82.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "2d3532452a453ced", "scanner": "scanner-primary", "fingerprint": "302173576d1b5f3e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40217"]}}, {"ruleId": "scanner-924c1dcdaeeb8337", "level": "error", "message": {"text": "CVE-2026-42203: litellm 1.82.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "dd1e53032e748267", "scanner": "scanner-primary", "fingerprint": "924c1dcdaeeb8337", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42203"]}}, {"ruleId": "scanner-3bc4daf87ed556aa", "level": "error", "message": {"text": "CVE-2026-42271: litellm 1.82.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "3e20e0dd63d183a3", "scanner": "scanner-primary", "fingerprint": "3bc4daf87ed556aa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42271"]}}, {"ruleId": "scanner-a7c0f5716236aa90", "level": "error", "message": {"text": "CVE-2026-47101: litellm 1.82.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "c21ba7eec0688ccf", "scanner": "scanner-primary", "fingerprint": "a7c0f5716236aa90", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47101"]}}, {"ruleId": "scanner-5b7ee1c6f394711e", "level": "error", "message": {"text": "CVE-2026-47102: litellm 1.82.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "f84cd93a310deb0e", "scanner": "scanner-primary", "fingerprint": "5b7ee1c6f394711e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-47102"]}}, {"ruleId": "scanner-857c628bd7f43971", "level": "error", "message": {"text": "GHSA-69x8-hrgq-fjj8: litellm 1.82.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "ffe44b275108490c", "scanner": "scanner-primary", "fingerprint": "857c628bd7f43971", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-69x8-hrgq-fjj8"]}}, {"ruleId": "scanner-468763ae62469f4a", "level": "error", "message": {"text": "CVE-2026-40192: pillow 12.1.1 \u2014 requirements.txt"}, "properties": {"repobilityId": "18740aca2144b23c", "scanner": "scanner-primary", "fingerprint": "468763ae62469f4a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40192"]}}, {"ruleId": "scanner-a55fa3a9369befbd", "level": "error", "message": {"text": "CVE-2026-42311: pillow 12.1.1 \u2014 requirements.txt"}, "properties": {"repobilityId": "75e6a442014e442b", "scanner": "scanner-primary", "fingerprint": "a55fa3a9369befbd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42311"]}}, {"ruleId": "scanner-20af473dd99d8219", "level": "warning", "message": {"text": "CVE-2026-42308: pillow 12.1.1 \u2014 requirements.txt"}, "properties": {"repobilityId": "bfeb1c532c2426a0", "scanner": "scanner-primary", "fingerprint": "20af473dd99d8219", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42308"]}}, {"ruleId": "scanner-04fb100fc1a6f595", "level": "warning", "message": {"text": "CVE-2026-42309: pillow 12.1.1 \u2014 requirements.txt"}, "properties": {"repobilityId": "d176960783244a9d", "scanner": "scanner-primary", "fingerprint": "04fb100fc1a6f595", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42309"]}}, {"ruleId": "scanner-fab9a6c7be2d9f53", "level": "warning", "message": {"text": "CVE-2026-42310: pillow 12.1.1 \u2014 requirements.txt"}, "properties": {"repobilityId": "d9b081341d3147df", "scanner": "scanner-primary", "fingerprint": "fab9a6c7be2d9f53", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42310"]}}, {"ruleId": "scanner-b1139d497cb05874", "level": "note", "message": {"text": "CVE-2026-4539: pygments 2.19.2 \u2014 requirements.txt"}, "properties": {"repobilityId": "16da6f1eecb04368", "scanner": "scanner-primary", "fingerprint": "b1139d497cb05874", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4539"]}}, {"ruleId": "scanner-4785a66b36a6ab25", "level": "warning", "message": {"text": "CVE-2026-25645: requests 2.32.5 \u2014 requirements.txt"}, "properties": {"repobilityId": "f69ee098051840b3", "scanner": "scanner-primary", "fingerprint": "4785a66b36a6ab25", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25645"]}}, {"ruleId": "scanner-0992560bd606b471", "level": "error", "message": {"text": "CVE-2026-48818: starlette 0.52.1 \u2014 requirements.txt"}, "properties": {"repobilityId": "f345e484eb5ba1a0", "scanner": "scanner-primary", "fingerprint": "0992560bd606b471", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48818"]}}, {"ruleId": "scanner-03cc15e44fbbe8be", "level": "error", "message": {"text": "CVE-2026-54283: starlette 0.52.1 \u2014 requirements.txt"}, "properties": {"repobilityId": "75bdfea48591bec0", "scanner": "scanner-primary", "fingerprint": "03cc15e44fbbe8be", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54283"]}}, {"ruleId": "scanner-3b38dcb1690c4878", "level": "warning", "message": {"text": "CVE-2026-48710: starlette 0.52.1 \u2014 requirements.txt"}, "properties": {"repobilityId": "2517ddc2a0247d9a", "scanner": "scanner-primary", "fingerprint": "3b38dcb1690c4878", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48710"]}}, {"ruleId": "scanner-5b42b30388f1c186", "level": "warning", "message": {"text": "CVE-2026-48817: starlette 0.52.1 \u2014 requirements.txt"}, "properties": {"repobilityId": "6d74c9456b243aac", "scanner": "scanner-primary", "fingerprint": "5b42b30388f1c186", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48817"]}}, {"ruleId": "scanner-f393e29313e5fba0", "level": "note", "message": {"text": "CVE-2026-54282: starlette 0.52.1 \u2014 requirements.txt"}, "properties": {"repobilityId": "dbd485308202e7a2", "scanner": "scanner-primary", "fingerprint": "f393e29313e5fba0", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-54282"]}}, {"ruleId": "scanner-5cc8616e7a55f65d", "level": "error", "message": {"text": "CVE-2026-44431: urllib3 2.6.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "26bc213a5b3d0410", "scanner": "scanner-primary", "fingerprint": "5cc8616e7a55f65d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44431"]}}, {"ruleId": "scanner-6f6cfe72bc08eed0", "level": "error", "message": {"text": "CVE-2026-44432: urllib3 2.6.3 \u2014 requirements.txt"}, "properties": {"repobilityId": "0d106c2fac4b899e", "scanner": "scanner-primary", "fingerprint": "6f6cfe72bc08eed0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44432"]}}, {"ruleId": "scanner-bfa757f6d525ec29", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 benchmark/Dockerfile"}, "properties": {"repobilityId": "304b38ddaa85b259", "scanner": "scanner-primary", "fingerprint": "bfa757f6d525ec29", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-f899882982e03461", "level": "warning", "message": {"text": "DS-0013: 'RUN cd ...' to change directory \u2014 benchmark/Dockerfile"}, "properties": {"repobilityId": "2fc45b708a892692", "scanner": "scanner-primary", "fingerprint": "f899882982e03461", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-c007c19137f03fe0", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 benchmark/Dockerfile"}, "properties": {"repobilityId": "79bdfc7b9803ccbb", "scanner": "scanner-primary", "fingerprint": "c007c19137f03fe0", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-62b13431c8a173b2", "level": "error", "message": {"text": "DS-0029: 'apt-get' missing '--no-install-recommends' \u2014 benchmark/Dockerfile"}, "properties": {"repobilityId": "6f6957bde8c9daa6", "scanner": "scanner-primary", "fingerprint": "62b13431c8a173b2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-62b13431c8a173b2", "level": "error", "message": {"text": "DS-0029: 'apt-get' missing '--no-install-recommends' \u2014 benchmark/Dockerfile"}, "properties": {"repobilityId": "6f6957bde8c9daa6", "scanner": "scanner-primary", "fingerprint": "62b13431c8a173b2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-055d03fec591276a", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 docker/Dockerfile"}, "properties": {"repobilityId": "2554eb2133f8c3ad", "scanner": "scanner-primary", "fingerprint": "055d03fec591276a", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-1279c2ca76399c43", "level": "warning", "message": {"text": "DS-0001: ':latest' tag used \u2014 scripts/Dockerfile.jekyll"}, "properties": {"repobilityId": "d62ab50b421abf0e", "scanner": "scanner-primary", "fingerprint": "1279c2ca76399c43", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-d183543a11c5064e", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 scripts/Dockerfile.jekyll"}, "properties": {"repobilityId": "985c432072c784b7", "scanner": "scanner-primary", "fingerprint": "d183543a11c5064e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-388db0918c55764f", "level": "error", "message": {"text": "DS-0021: 'apt-get' missing '-y' to avoid manual input \u2014 scripts/Dockerfile.jekyll"}, "properties": {"repobilityId": "ccdad28042e67011", "scanner": "scanner-primary", "fingerprint": "388db0918c55764f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-e83161658379bf2a", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 scripts/Dockerfile.jekyll"}, "properties": {"repobilityId": "6a1ea5a178fb7c0b", "scanner": "scanner-primary", "fingerprint": "e83161658379bf2a", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-7ffc6ccdd58f1857", "level": "error", "message": {"text": "DS-0029: 'apt-get' missing '--no-install-recommends' \u2014 scripts/Dockerfile.jekyll"}, "properties": {"repobilityId": "fa78b4184fd570ad", "scanner": "scanner-primary", "fingerprint": "7ffc6ccdd58f1857", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-e56261bc8b34eee3", "level": "error", "message": {"text": "AWS-0164: Instances in a subnet should not receive a public IP address by default. \u2014 tests/fixtures/languages/hcl/test.tf"}, "properties": {"repobilityId": "65fbc4d1507c18d3", "scanner": "scanner-primary", "fingerprint": "e56261bc8b34eee3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-e7ce2c3f34bd6745", "level": "warning", "message": {"text": "AWS-0178: VPC Flow Logs is a feature that enables you to capture information about the IP traffic going to and from network interfaces in your VPC. After you've created a flow log, you can view and retrieve its data in Amazon CloudWatch Logs. It is recommended that VPC Flow Logs be enabled for packe"}, "properties": {"repobilityId": "082e19817fceec4d", "scanner": "scanner-primary", "fingerprint": "e7ce2c3f34bd6745", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-0ed12862caf5eed9", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: aider/website/docs/llms/gemini.md"}, "properties": {"repobilityId": "a15b0ecef957891e", "scanner": "scanner-primary", "fingerprint": "0ed12862caf5eed9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "gemini_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/website/docs/llms/gemini.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2187ef211aa54d2d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: aider/website/assets/sample.aider.conf.yml"}, "properties": {"repobilityId": "9e6263dc4502c115", "scanner": "scanner-primary", "fingerprint": "2187ef211aa54d2d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agent_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/website/assets/sample.aider.conf.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-783bcbc1b0882a0d", "level": "warning", "message": {"text": "Privileged port 69 in use"}, "properties": {"repobilityId": "1effa2e6319f4133", "scanner": "scanner-primary", "fingerprint": "783bcbc1b0882a0d", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/website/_data/blame.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-01422cb15edf6282", "level": "warning", "message": {"text": "Privileged port 12 in use"}, "properties": {"repobilityId": "65e7eefa33f2def4", "scanner": "scanner-primary", "fingerprint": "01422cb15edf6282", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/website/_data/blame.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-47ce292071ac0add", "level": "warning", "message": {"text": "Privileged port 15 in use"}, "properties": {"repobilityId": "3340f9a170f285cd", "scanner": "scanner-primary", "fingerprint": "47ce292071ac0add", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/website/_data/blame.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f49bfa5ea1bed281", "level": "warning", "message": {"text": "Privileged port 10 in use"}, "properties": {"repobilityId": "735372d6b5594915", "scanner": "scanner-primary", "fingerprint": "f49bfa5ea1bed281", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/website/_data/blame.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f1a2d41f26dcfee0", "level": "warning", "message": {"text": "Privileged port 179 in use"}, "properties": {"repobilityId": "e2a967367e84635b", "scanner": "scanner-primary", "fingerprint": "f1a2d41f26dcfee0", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/website/_data/blame.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d323bd16c4f94e60", "level": "warning", "message": {"text": "Privileged port 197 in use"}, "properties": {"repobilityId": "65750ece2a1864d6", "scanner": "scanner-primary", "fingerprint": "d323bd16c4f94e60", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/website/_data/blame.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aee7cb8a0f6ef289", "level": "warning", "message": {"text": "Privileged port 16 in use"}, "properties": {"repobilityId": "d31009168c502ace", "scanner": "scanner-primary", "fingerprint": "aee7cb8a0f6ef289", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/website/_data/blame.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-abaeb90a4273ac32", "level": "warning", "message": {"text": "Privileged port 18 in use"}, "properties": {"repobilityId": "2d7b5e7d9c158e43", "scanner": "scanner-primary", "fingerprint": "abaeb90a4273ac32", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/website/_data/blame.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-af5c7b6d9726bf3a", "level": "warning", "message": {"text": "Privileged port 52 in use"}, "properties": {"repobilityId": "2b6877fa37212075", "scanner": "scanner-primary", "fingerprint": "af5c7b6d9726bf3a", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/website/_data/blame.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-41f442b0acdcd1a0", "level": "warning", "message": {"text": "Privileged port 54 in use"}, "properties": {"repobilityId": "cfa860c24fdc3eef", "scanner": "scanner-primary", "fingerprint": "41f442b0acdcd1a0", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/website/_data/blame.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cf828b0c570aeddb", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-slim-bookworm"}, "properties": {"repobilityId": "787aa737d3d9cf61", "scanner": "scanner-primary", "fingerprint": "cf828b0c570aeddb", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1f1743df07a3b826", "level": "warning", "message": {"text": "Dockerfile runs as root: benchmark/Dockerfile"}, "properties": {"repobilityId": "a16bca39fcc3af40", "scanner": "scanner-primary", "fingerprint": "1f1743df07a3b826", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-2d1d94d9ecc6ca6e", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: buildpack-deps:jammy"}, "properties": {"repobilityId": "2fb24d31c1e4de44", "scanner": "scanner-primary", "fingerprint": "2d1d94d9ecc6ca6e", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmark/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-986306f7fa5c3b9d", "level": "warning", "message": {"text": "Dockerfile ADD downloads remote content without checksum"}, "properties": {"repobilityId": "cc4c41aaae134c0e", "scanner": "scanner-primary", "fingerprint": "986306f7fa5c3b9d", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "docker", "checksum"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmark/Dockerfile"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-60b7de709b976ae3", "level": "error", "message": {"text": "Dockerfile pipes a remote installer into a shell"}, "properties": {"repobilityId": "497318728446c5da", "scanner": "scanner-primary", "fingerprint": "60b7de709b976ae3", "layer": "hardware", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "docker", "remote-installer"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmark/Dockerfile"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-83bedd7ecb0d5b81", "level": "error", "message": {"text": "Insecure pattern 'python_os_system' in benchmark/README.md:26"}, "properties": {"repobilityId": "ac4a19c05c76d502", "scanner": "scanner-primary", "fingerprint": "83bedd7ecb0d5b81", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "python_os_system"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "benchmark/README.md"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-caea3c603d83a47f", "level": "error", "message": {"text": "Insecure pattern 'subprocess_shell_true' in aider/commands.py:974"}, "properties": {"repobilityId": "5aa509b779707e6a", "scanner": "scanner-primary", "fingerprint": "caea3c603d83a47f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/commands.py"}, "region": {"startLine": 974}}}]}, {"ruleId": "scanner-20c97f6727de8943", "level": "error", "message": {"text": "Possible secret in aider/analytics.py"}, "properties": {"repobilityId": "5cd09dae4e3e686e", "scanner": "scanner-primary", "fingerprint": "20c97f6727de8943", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/analytics.py"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-fe008ed296073ea4", "level": "error", "message": {"text": "Insecure pattern 'subprocess_shell_true' in aider/editor.py:134"}, "properties": {"repobilityId": "ea5dce4e963929b5", "scanner": "scanner-primary", "fingerprint": "fe008ed296073ea4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/editor.py"}, "region": {"startLine": 134}}}]}, {"ruleId": "scanner-58fd62fb4ab3d05e", "level": "error", "message": {"text": "Insecure pattern 'subprocess_shell_true' in aider/run_cmd.py:62"}, "properties": {"repobilityId": "7e3711ba178a3a87", "scanner": "scanner-primary", "fingerprint": "58fd62fb4ab3d05e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/run_cmd.py"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-14f48e7f3ec0ddf3", "level": "error", "message": {"text": "Insecure pattern 'subprocess_shell_true' in aider/io.py:1093"}, "properties": {"repobilityId": "6cc3144d3bd0d2f2", "scanner": "scanner-primary", "fingerprint": "14f48e7f3ec0ddf3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/io.py"}, "region": {"startLine": 1093}}}]}, {"ruleId": "scanner-2ab56aeee5200b89", "level": "error", "message": {"text": "Insecure pattern 'tls_verify_false' in aider/main.py:524"}, "properties": {"repobilityId": "75d3ff9297515bd8", "scanner": "scanner-primary", "fingerprint": "2ab56aeee5200b89", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "tls_verify_false"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/main.py"}, "region": {"startLine": 524}}}]}, {"ruleId": "scanner-4abd753c6ae0b98a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in aider/website/index.html:487"}, "properties": {"repobilityId": "144896e1bf543ede", "scanner": "scanner-primary", "fingerprint": "4abd753c6ae0b98a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/website/index.html"}, "region": {"startLine": 487}}}]}, {"ruleId": "scanner-69cab9a95b6dfe57", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in aider/website/assets/asciinema/asciinema-player.min.js:1"}, "properties": {"repobilityId": "f0cb40bba25212bb", "scanner": "scanner-primary", "fingerprint": "69cab9a95b6dfe57", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "aider/website/assets/asciinema/asciinema-player.min.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b16454efb682f356", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5dcaf9fbbe16c7a7", "scanner": "scanner-primary", "fingerprint": "b16454efb682f356", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ubuntu-tests.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-b16454efb682f356", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5bd8529b3ed13f36", "scanner": "scanner-primary", "fingerprint": "b16454efb682f356", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ubuntu-tests.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-38ffbb45595ebcf6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "06cd3fe42a16df40", "scanner": "scanner-primary", "fingerprint": "38ffbb45595ebcf6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/windows_check_pypi_version.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-38ffbb45595ebcf6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "88238866ead359b1", "scanner": "scanner-primary", "fingerprint": "38ffbb45595ebcf6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/windows_check_pypi_version.yml"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-5af2dfac961b2a63", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fd17382537d0b6cc", "scanner": "scanner-primary", "fingerprint": "5af2dfac961b2a63", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-release.yml"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-5af2dfac961b2a63", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "129293f46c47062e", "scanner": "scanner-primary", "fingerprint": "5af2dfac961b2a63", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-release.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-5af2dfac961b2a63", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1ae791856d0688bd", "scanner": "scanner-primary", "fingerprint": "5af2dfac961b2a63", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-release.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-5af2dfac961b2a63", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "aba230f59e1426f6", "scanner": "scanner-primary", "fingerprint": "5af2dfac961b2a63", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-release.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-5af2dfac961b2a63", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7bf806bd73951e7e", "scanner": "scanner-primary", "fingerprint": "5af2dfac961b2a63", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-release.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-5af2dfac961b2a63", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7bf806bd73951e7e", "scanner": "scanner-primary", "fingerprint": "5af2dfac961b2a63", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-release.yml"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-7f53977ac969d336", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d68910b037d2aff9", "scanner": "scanner-primary", "fingerprint": "7f53977ac969d336", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-build-test.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-7f53977ac969d336", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "678d41dbf73d623f", "scanner": "scanner-primary", "fingerprint": "7f53977ac969d336", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-build-test.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-7f53977ac969d336", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "14b484b9859c7d2f", "scanner": "scanner-primary", "fingerprint": "7f53977ac969d336", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-build-test.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-7f53977ac969d336", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b61b8f116295976b", "scanner": "scanner-primary", "fingerprint": "7f53977ac969d336", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-build-test.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-7f53977ac969d336", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "98ce65a8ce2cfef8", "scanner": "scanner-primary", "fingerprint": "7f53977ac969d336", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-build-test.yml"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-7f53977ac969d336", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "98ce65a8ce2cfef8", "scanner": "scanner-primary", "fingerprint": "7f53977ac969d336", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-build-test.yml"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-7f53977ac969d336", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "98ce65a8ce2cfef8", "scanner": "scanner-primary", "fingerprint": "7f53977ac969d336", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-build-test.yml"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-7f53977ac969d336", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "98ce65a8ce2cfef8", "scanner": "scanner-primary", "fingerprint": "7f53977ac969d336", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker-build-test.yml"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2644034c718fb80d", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0ad86557a2848db6", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0fb8c24a130cdd0a", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e25428e297c40fda", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "de6c1bde6ef8422b", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7b2f6f2d816930a2", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "25e1fa3783e7cb32", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "730a51498ce24e23", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 76}}}]}, {"ruleId": "scanner-448d8837178ae57a", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "13af6451e15656fc", "scanner": "scanner-primary", "fingerprint": "448d8837178ae57a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ac6791bc39b6f1ed", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "22194382a7198449", "scanner": "scanner-primary", "fingerprint": "ac6791bc39b6f1ed", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/issues.yml"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-dfed46d3cd02ed24", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1f29117a2dc5c0d2", "scanner": "scanner-primary", "fingerprint": "dfed46d3cd02ed24", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/check_pypi_version.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-dfed46d3cd02ed24", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "921b84cfc30d9f2f", "scanner": "scanner-primary", "fingerprint": "dfed46d3cd02ed24", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/check_pypi_version.yml"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-61a1a61a5214d62e", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c4d0185531a06190", "scanner": "scanner-primary", "fingerprint": "61a1a61a5214d62e", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pre-commit.yml"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-61a1a61a5214d62e", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f1835f67e460b845", "scanner": "scanner-primary", "fingerprint": "61a1a61a5214d62e", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pre-commit.yml"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-0b5dfc76335f6e29", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a18ba82f57567af1", "scanner": "scanner-primary", "fingerprint": "0b5dfc76335f6e29", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/windows-tests.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-0b5dfc76335f6e29", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "fcd55cae355236cb", "scanner": "scanner-primary", "fingerprint": "0b5dfc76335f6e29", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/windows-tests.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-e7233df63113af9b", "level": "note", "message": {"text": "Very large file: tests/basic/test_commands.py (2226 lines)"}, "properties": {"repobilityId": "98ace9b96a1bcec4", "scanner": "scanner-primary", "fingerprint": "e7233df63113af9b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-414cc4d0acc78cf3", "level": "note", "message": {"text": "Very large file: tests/basic/test_coder.py (1438 lines)"}, "properties": {"repobilityId": "d4927050e250b5fe", "scanner": "scanner-primary", "fingerprint": "414cc4d0acc78cf3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-98bebdca48fb15bd", "level": "note", "message": {"text": "Very large file: tests/basic/test_main.py (1483 lines)"}, "properties": {"repobilityId": "7abb5b980e99e02d", "scanner": "scanner-primary", "fingerprint": "98bebdca48fb15bd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b076997d485f1ae9", "level": "note", "message": {"text": "Very large file: aider/commands.py (1712 lines)"}, "properties": {"repobilityId": "67e0c836d4aae5c1", "scanner": "scanner-primary", "fingerprint": "b076997d485f1ae9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ec73f4768bc4be64", "level": "note", "message": {"text": "Very large file: aider/website/install.sh (1832 lines)"}, "properties": {"repobilityId": "fcdb4e0c867e7b1f", "scanner": "scanner-primary", "fingerprint": "ec73f4768bc4be64", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-aae4159bbbf1ae92", "level": "note", "message": {"text": "Very large file: aider/coders/base_coder.py (2485 lines)"}, "properties": {"repobilityId": "027179e43909e09c", "scanner": "scanner-primary", "fingerprint": "aae4159bbbf1ae92", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "62153e7fb817c26e", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "749494f32c54c157", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "02ea28870e79072b", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "87ed699bf89af0a1", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "28587ba37cc1a5e1", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-20085855cb053abb", "level": "note", "message": {"text": "Legacy-named symbol `TestDeprecated` in tests/basic/test_deprecated.py:13"}, "properties": {"repobilityId": "b7aed11a497a9cb1", "scanner": "scanner-primary", "fingerprint": "20085855cb053abb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7a0e25dfac65c46c", "level": "note", "message": {"text": "Legacy-named symbol `test_cmd_copy` in tests/basic/test_commands.py:50"}, "properties": {"repobilityId": "fe423498d8e31423", "scanner": "scanner-primary", "fingerprint": "7a0e25dfac65c46c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-16d087cdae0fda85", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/basic/test_coder.py:327"}, "properties": {"repobilityId": "68d5c618ed7462e5", "scanner": "scanner-primary", "fingerprint": "16d087cdae0fda85", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e0f5ca4690fee5f5", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/basic/test_repo.py:557"}, "properties": {"repobilityId": "aaa389d4853cbc4d", "scanner": "scanner-primary", "fingerprint": "e0f5ca4690fee5f5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-274d8923c2512039", "level": "note", "message": {"text": "Legacy-named symbol `litellm_entry_copy` in scripts/clean_metadata.py:186"}, "properties": {"repobilityId": "4e49c8bf7c1d9ef1", "scanner": "scanner-primary", "fingerprint": "274d8923c2512039", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-4bd802b667cd0c39", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/update-history.py:36"}, "properties": {"repobilityId": "42206aef2a35ce9f", "scanner": "scanner-primary", "fingerprint": "4bd802b667cd0c39", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-8945a05fc8c681cd", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/yank-old-versions.py:8"}, "properties": {"repobilityId": "0534844ae36ba6b5", "scanner": "scanner-primary", "fingerprint": "8945a05fc8c681cd", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a72328a9b743c2e4", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/versionbump.py:15"}, "properties": {"repobilityId": "44b7812bb8db894f", "scanner": "scanner-primary", "fingerprint": "a72328a9b743c2e4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-7c3b241b857b82b4", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/blame.py:84"}, "properties": {"repobilityId": "4dcfcbf7c27958ae", "scanner": "scanner-primary", "fingerprint": "7c3b241b857b82b4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-fbd7af20b7fd2afc", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/dl_icons.py:33"}, "properties": {"repobilityId": "90c71a7552cc60eb", "scanner": "scanner-primary", "fingerprint": "fbd7af20b7fd2afc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b066bc7202119a17", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/issues.py:16"}, "properties": {"repobilityId": "1a2fef433aea6f68", "scanner": "scanner-primary", "fingerprint": "b066bc7202119a17", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2bdc8115f6a16295", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 benchmark/rungrid.py:56"}, "properties": {"repobilityId": "aa0165b534624229", "scanner": "scanner-primary", "fingerprint": "2bdc8115f6a16295", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-73a91ecd7488025e", "level": "note", "message": {"text": "Stub function `save_tags_cache` (body is just `pass`/`return`) \u2014 aider/repomap.py:224"}, "properties": {"repobilityId": "3a7a7688072cb4c4", "scanner": "scanner-primary", "fingerprint": "73a91ecd7488025e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-2311bb1f1e3fb334", "level": "note", "message": {"text": "Legacy-named symbol `cmd_copy` in aider/commands.py:1528"}, "properties": {"repobilityId": "5cfdd2e33aa89efb", "scanner": "scanner-primary", "fingerprint": "2311bb1f1e3fb334", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b5a1652bbc69b884", "level": "note", "message": {"text": "Stub function `do_settings_tab` (body is just `pass`/`return`) \u2014 aider/gui.py:166"}, "properties": {"repobilityId": "395439f46c47e4a6", "scanner": "scanner-primary", "fingerprint": "b5a1652bbc69b884", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-a04e4413e42980ea", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 aider/run_cmd.py:62"}, "properties": {"repobilityId": "2ff79f3fe9ecac93", "scanner": "scanner-primary", "fingerprint": "a04e4413e42980ea", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e8cf017681708a62", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 aider/models.py:966"}, "properties": {"repobilityId": "0df2c893a6b281e1", "scanner": "scanner-primary", "fingerprint": "e8cf017681708a62", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f44433c17e776337", "level": "none", "message": {"text": "Commented-code block (6 lines) in aider/main.py:270"}, "properties": {"repobilityId": "42c9704fe5703ac3", "scanner": "scanner-primary", "fingerprint": "f44433c17e776337", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0cb3786e91f91902", "level": "none", "message": {"text": "Commented-code block (5 lines) in aider/waiting.py:153"}, "properties": {"repobilityId": "4556fa3cc4d762fa", "scanner": "scanner-primary", "fingerprint": "0cb3786e91f91902", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e40b7050b8c0c8a2", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 aider/website/assets/asciinema/asciinema-player.min.js:1"}, "properties": {"repobilityId": "ce47228b11dbe0bf", "scanner": "scanner-primary", "fingerprint": "e40b7050b8c0c8a2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0de8c923580d5121", "level": "note", "message": {"text": "Stub function `reply_completed` (body is just `pass`/`return`) \u2014 aider/coders/base_coder.py:1625"}, "properties": {"repobilityId": "e9bda423566bcdba", "scanner": "scanner-primary", "fingerprint": "0de8c923580d5121", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-95bdfc7cc16f845f", "level": "note", "message": {"text": "Stub function `check_for_file_mentions` (body is just `pass`/`return`) \u2014 aider/coders/context_coder.py:52"}, "properties": {"repobilityId": "1a65090f8df253f6", "scanner": "scanner-primary", "fingerprint": "95bdfc7cc16f845f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-00392e3296540d83", "level": "note", "message": {"text": "Stub function `apply_edits` (body is just `pass`/`return`) \u2014 aider/coders/help_coder.py:15"}, "properties": {"repobilityId": "7177ae819ddc0066", "scanner": "scanner-primary", "fingerprint": "00392e3296540d83", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "bb7daa48c446b6b5", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "888a8e7f883870bf", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ae4dea8040e3504f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "8d99515b833458fe", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "4677333a6f96bc0b", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "84f235c694231e41", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "9036f2c197f7292e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "26578c3c21674922", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "b42afeb78ec0b856", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "665599eeebe80f7a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "8648eae31e0ed3c7", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "cbb5c9fbfe37afd3", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "d1278f95da480a0b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "3512c14de75ec3ce", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ed4deaaed56477c2", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "10dd9c675a78276d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "abcfa1499c4b7d92", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}