{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-16c4f26ff39cef71", "name": "Stray `console.log` in TS/JS \u2014 js/pos-init.js:249", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/pos-init.js:249"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-38e061540cbed256", "name": "Icon-only button without accessible name \u2014 js/pos-render.js:491", "shortDescription": {"text": "Icon-only button without accessible name \u2014 js/pos-render.js:491"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b4db5eafecb6ab57", "name": "Stray `console.log` in TS/JS \u2014 js/kitchen.js:468", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 js/kitchen.js:468"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5ff363e036ebcb0e", "name": "Stray `console.log` in TS/JS \u2014 admin/pages/recipes.js:798", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 admin/pages/recipes.js:798"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4e8d328cdac245a7", "name": "Stray `console.log` in TS/JS \u2014 server/server.js:74", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server/server.js:74"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-39b60c66fe65468d", "name": "Stray `console.log` in TS/JS \u2014 server/lib/portos-sync-job.js:70", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server/lib/portos-sync-job.js:70"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4667d93b983ccc04", "name": "Stray `console.log` in TS/JS \u2014 server/lib/weather.js:143", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server/lib/weather.js:143"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7455321a7644ae04", "name": "Stray `console.log` in TS/JS \u2014 server/lib/print/queue.js:26", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server/lib/print/queue.js:26"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-401c8461657ecb2f", "name": "Stray `console.log` in TS/JS \u2014 server/lib/print/network.js:73", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server/lib/print/network.js:73"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3da36ef251c7e74f", "name": "Stray `console.log` in TS/JS \u2014 server/lib/forecast/engine.js:322", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server/lib/forecast/engine.js:322"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4fccb9d067ce2cab", "name": "Stray `console.log` in TS/JS \u2014 server/routes/invoice-scan.js:140", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server/routes/invoice-scan.js:140"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-624a36123176395a", "name": "Stray `console.log` in TS/JS \u2014 server/routes/ttlock.js:197", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server/routes/ttlock.js:197"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1ce43abd2967ab14", "name": "Stray `console.log` in TS/JS \u2014 server/routes/inventory.js:226", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server/routes/inventory.js:226"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b286819a9b48ed95", "name": "Stray `console.log` in TS/JS \u2014 server/db/seed.js:15", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server/db/seed.js:15"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4f8cdfb31baf15c6", "name": "Stray `console.log` in TS/JS \u2014 server/jobs/paragon-sync.js:31", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server/jobs/paragon-sync.js:31"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8a84a2f1d4702499", "name": "Privileged port 4 in use", "shortDescription": {"text": "Privileged port 4 in use"}, "fullDescription": {"text": "Port 4 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8987d6d1c30c7202", "name": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c7d4db042b90bbb3", "name": "Insecure pattern 'direct_innerhtml_assignment' in login.html:443", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in login.html:443"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f9ba30ead5aa0d59", "name": "Insecure pattern 'direct_innerhtml_assignment' in pos-design-demo.html:1749", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pos-design-demo.html:1749"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3043e4e7a6d1b555", "name": "Insecure pattern 'direct_innerhtml_assignment' in api.js:551", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in api.js:551"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b741874a360ce0ad", "name": "Insecure pattern 'local_storage_auth_token' in api.js:120", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in api.js:120"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-810d01f5e2a14c40", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/pos-payments.js:403", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/pos-payments.js:403"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7d4d4abbc9ddc3e6", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/pos-init.js:577", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/pos-init.js:577"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cd28180549c9f373", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/pos-state.js:16", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/pos-state.js:16"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bf8f025c8ee1e987", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/pos-ui.js:38", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/pos-ui.js:38"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6f7d80d26ee63d68", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/pos-render.js:191", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/pos-render.js:191"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0170d7fa018f199e", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/dochadzka.js:35", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/dochadzka.js:35"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4678ab35cc50e2a1", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/pos-orders.js:1154", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/pos-orders.js:1154"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5330fc256512e949", "name": "Insecure pattern 'insert_adjacent_html' in js/pos-orders.js:374", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in js/pos-orders.js:374"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cd292902ace809ab", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/kitchen.js:174", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/kitchen.js:174"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8cab16b4bf04456f", "name": "Insecure pattern 'local_storage_auth_token' in js/kitchen.js:419", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in js/kitchen.js:419"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-df68437d16f2afc0", "name": "Insecure pattern 'direct_innerhtml_assignment' in js/pos-mobile.js:50", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/pos-mobile.js:50"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d16680ad76a4dab9", "name": "Insecure pattern 'local_storage_auth_token' in js/pos-mobile.js:472", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in js/pos-mobile.js:472"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-81dd69a5f1623b3d", "name": "Insecure pattern 'node_child_process' in scripts/export-surfspirit-menu.mjs:19", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/export-surfspirit-menu.mjs:19"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-70aea988c6daa076", "name": "Insecure pattern 'direct_innerhtml_assignment' in components/loading.js:129", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in components/loading.js:129"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6413575783d43348", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/index.html:340", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/index.html:340"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a6ae8c9815f1f6f4", "name": "Insecure pattern 'local_storage_auth_token' in admin/index.html:207", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in admin/index.html:207"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c5876d745e3440e", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/router.js:299", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/router.js:299"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9cb80a6f5d96a59b", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/components/tab-shell.js:37", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/components/tab-shell.js:37"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a74d40755abbd577", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/components/command-palette.js:185", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/components/command-palette.js:185"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-acf69bf16eca6533", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/components/toast-undo.js:112", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/components/toast-undo.js:112"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bfb3d0874c01dbc9", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/cashflow.js:96", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/cashflow.js:96"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c4bd9f4a9fa78883", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/settings.js:503", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/settings.js:503"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-192d2fb03f49a576", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/weekly.js:66", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/weekly.js:66"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-06815ea0e79149c1", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/suppliers.js:50", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/suppliers.js:50"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f06ab97426d82d2b", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/inventory-dashboard.js:107", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/inventory-dashboard.js:107"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8e86160747130294", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/zam-spotreba.js:55", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/zam-spotreba.js:55"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e99f66d368d11a5d", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/purchase-orders.js:155", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/purchase-orders.js:155"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c4ded5bb7fc2864b", "name": "Insecure pattern 'insert_adjacent_html' in admin/pages/purchase-orders.js:484", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in admin/pages/purchase-orders.js:484"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5fcf0bbff761a284", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/stock-movements.js:89", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/stock-movements.js:89"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2e00529b4b36e8b7", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/ingredients.js:99", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/ingredients.js:99"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5e4b05237b28db1a", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/staff.js:93", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/staff.js:93"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e6ad48c1a2bbc776", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/recipes.js:173", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/recipes.js:173"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4bbdc34a8b2cecde", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/write-offs.js:189", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/write-offs.js:189"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7a02dc4c1f19ee50", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/season.js:50", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/season.js:50"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-feb3d02fea4950f0", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/tables.js:63", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/tables.js:63"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d7dec23795fcc56b", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/menu.js:90", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/menu.js:90"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a2a8b944cc79be80", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/forecasts.js:45", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/forecasts.js:45"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e161bba91925340f", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/dashboard.js:23", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/dashboard.js:23"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-80c62b8f5f3c85e1", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/supplies.js:43", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/supplies.js:43"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7ea47e85d9301c45", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/fiscal-documents.js:31", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/fiscal-documents.js:31"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1c6191632495a529", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/reports.js:76", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/reports.js:76"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-59318f6e16a47ceb", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/dochadzka.js:195", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/dochadzka.js:195"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-001f94bc544d5ee0", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/inventory-audit.js:94", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/inventory-audit.js:94"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ccb612671ff22736", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/storno.js:83", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/storno.js:83"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a231f5de87a19645", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/shisha.js:68", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/shisha.js:68"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3677d0da3c3392db", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/audit.js:114", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/audit.js:114"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-72a54413238bb8e9", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/payments.js:118", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/payments.js:118"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6312fcbb1719cdad", "name": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/assets.js:174", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/assets.js:174"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0fb8c9234bf6a7ac", "name": "Insecure pattern 'direct_innerhtml_assignment' in web/index.html:1449", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web/index.html:1449"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-067317841b672ed4", "name": "Insecure pattern 'node_child_process' in server/lib/backup.js:15", "shortDescription": {"text": "Insecure pattern 'node_child_process' in server/lib/backup.js:15"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-debb6b5262c9e887", "name": "Insecure pattern 'cors_wildcard' in server/routes/public-menu.js:82", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in server/routes/public-menu.js:82"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dc0dc63fa345b3c6", "name": "Very large file: js/pos-payments.js (1260 lines)", "shortDescription": {"text": "Very large file: js/pos-payments.js (1260 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-075c22239979b46b", "name": "Very large file: js/pos-render.js (1324 lines)", "shortDescription": {"text": "Very large file: js/pos-render.js (1324 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-45419387a82f2981", "name": "Very large file: js/pos-orders.js (1907 lines)", "shortDescription": {"text": "Very large file: js/pos-orders.js (1907 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1cf0f5278c8fcee0", "name": "Very large file: admin/pages/settings.js (1280 lines)", "shortDescription": {"text": "Very large file: admin/pages/settings.js (1280 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e47df544f1b064da", "name": "Very large file: admin/pages/purchase-orders.js (1369 lines)", "shortDescription": {"text": "Very large file: admin/pages/purchase-orders.js (1369 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fb6ecd14a594c64a", "name": "Very large file: admin/pages/reports.js (1570 lines)", "shortDescription": {"text": "Very large file: admin/pages/reports.js (1570 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b5457d8e285d78f7", "name": "Very large file: admin/pages/dochadzka.js (1239 lines)", "shortDescription": {"text": "Very large file: admin/pages/dochadzka.js (1239 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b3ed68815bca2f8c", "name": "Node manifest has dependencies but no lockfile: package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 93 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 112 placeholder/mock markers across 26 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci, lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bea357a6497a2d5d", "name": "Agent authority lacks a verifier contract: CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f0c2bf9bdfe8e576", "name": "Agent authority lacks a verifier contract: .claude/admin-impl-contract.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/admin-impl-contract.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-978afd3144190c4a", "name": "Agent authority lacks a verifier contract: .cursor/rules/autonomous-deploy.mdc", "shortDescription": {"text": "Agent authority lacks a verifier contract: .cursor/rules/autonomous-deploy.mdc"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-081c5d10fbddb23e", "name": "Commented-code block (5 lines) in sw.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in sw.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-78d4e354b4ee7ca1", "name": "Commented-code block (5 lines) in api.js:17", "shortDescription": {"text": "Commented-code block (5 lines) in api.js:17"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6e11541b5a39edc2", "name": "Commented-code block (8 lines) in tests/e2e/local-draft-survives-poll.spec.mjs:1", "shortDescription": {"text": "Commented-code block (8 lines) in tests/e2e/local-draft-survives-poll.spec.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d600e29643253eae", "name": "Commented-code block (6 lines) in tests/e2e/_setup/global-setup.mjs:141", "shortDescription": {"text": "Commented-code block (6 lines) in tests/e2e/_setup/global-setup.mjs:141"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-623726fcea5b31b6", "name": "Commented-code block (5 lines) in js/pos-payments.js:412", "shortDescription": {"text": "Commented-code block (5 lines) in js/pos-payments.js:412"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4df4d17f769fd081", "name": "`fetch()` without try/.catch or AbortSignal \u2014 js/pos-payments.js:304", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 js/pos-payments.js:304"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-db9e19c821d41ae9", "name": "Commented-code block (5 lines) in js/pos-init.js:33", "shortDescription": {"text": "Commented-code block (5 lines) in js/pos-init.js:33"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9a5872384833037e", "name": "Legacy-named symbol `pos_topItems_v1` in js/pos-state.js:32", "shortDescription": {"text": "Legacy-named symbol `pos_topItems_v1` in js/pos-state.js:32"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-851348a1bbea0993", "name": "Commented-code block (6 lines) in js/pos-state.js:64", "shortDescription": {"text": "Commented-code block (6 lines) in js/pos-state.js:64"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-eecdcba61c383acb", "name": "Commented-code block (8 lines) in js/pos-ui.js:102", "shortDescription": {"text": "Commented-code block (8 lines) in js/pos-ui.js:102"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f268ecc57fab9242", "name": "Commented-code block (7 lines) in js/pos-render.js:9", "shortDescription": {"text": "Commented-code block (7 lines) in js/pos-render.js:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6677da3a6bbf8e12", "name": "`fetch()` without try/.catch or AbortSignal \u2014 js/dochadzka.js:71", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 js/dochadzka.js:71"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6b61ecf937bdba4b", "name": "Commented-code block (5 lines) in js/pos-escape.js:6", "shortDescription": {"text": "Commented-code block (5 lines) in js/pos-escape.js:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3256e9a87a1faa7a", "name": "Commented-code block (5 lines) in js/pos-orders.js:16", "shortDescription": {"text": "Commented-code block (5 lines) in js/pos-orders.js:16"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8a6487452919bb44", "name": "`fetch()` without try/.catch or AbortSignal \u2014 js/kitchen.js:436", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 js/kitchen.js:436"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-351d37d81793e377", "name": "Commented-code block (7 lines) in js/pos-mobile.js:374", "shortDescription": {"text": "Commented-code block (7 lines) in js/pos-mobile.js:374"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-40f72f2c2c264c2c", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/check-portos-profile-on-kasa.mjs:5", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/check-portos-profile-on-kasa.mjs:5"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d3d72301097af5dc", "name": "Commented-code block (7 lines) in components/fmt.js:7", "shortDescription": {"text": "Commented-code block (7 lines) in components/fmt.js:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0f5598d94a59cdfb", "name": "Commented-code block (6 lines) in admin/router.js:112", "shortDescription": {"text": "Commented-code block (6 lines) in admin/router.js:112"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-600d6ac88b5ed06d", "name": "Commented-code block (9 lines) in admin/components/empty-state.js:9", "shortDescription": {"text": "Commented-code block (9 lines) in admin/components/empty-state.js:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a3fab953c6ba8952", "name": "Commented-code block (6 lines) in admin/components/tab-shell.js:7", "shortDescription": {"text": "Commented-code block (6 lines) in admin/components/tab-shell.js:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3d6848651227182a", "name": "Commented-code block (5 lines) in admin/components/command-palette.js:13", "shortDescription": {"text": "Commented-code block (5 lines) in admin/components/command-palette.js:13"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-30b10d679898048b", "name": "Commented-code block (14 lines) in admin/components/toast-undo.js:8", "shortDescription": {"text": "Commented-code block (14 lines) in admin/components/toast-undo.js:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6900e81b54d4abc2", "name": "Commented-code block (6 lines) in admin/pages/zam-spotreba.js:1", "shortDescription": {"text": "Commented-code block (6 lines) in admin/pages/zam-spotreba.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d6475ad6241b7a96", "name": "Commented-code block (6 lines) in admin/pages/recipes.js:437", "shortDescription": {"text": "Commented-code block (6 lines) in admin/pages/recipes.js:437"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5efebdad1e458142", "name": "Commented-code block (6 lines) in admin/pages/season.js:1", "shortDescription": {"text": "Commented-code block (6 lines) in admin/pages/season.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9bcfd89a061a7b8b", "name": "Commented-code block (5 lines) in admin/pages/forecasts.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in admin/pages/forecasts.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-64470489f0aa35b1", "name": "Commented-code block (5 lines) in admin/pages/dashboard.js:424", "shortDescription": {"text": "Commented-code block (5 lines) in admin/pages/dashboard.js:424"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5ee1ab9610948950", "name": "Commented-code block (5 lines) in admin/pages/reports.js:326", "shortDescription": {"text": "Commented-code block (5 lines) in admin/pages/reports.js:326"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-aa5ecc18a7357800", "name": "`fetch()` without try/.catch or AbortSignal \u2014 admin/pages/reports.js:937", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 admin/pages/reports.js:937"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-549d54658fc24de7", "name": "Commented-code block (7 lines) in admin/pages/dochadzka.js:5", "shortDescription": {"text": "Commented-code block (7 lines) in admin/pages/dochadzka.js:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f7a99e3f59a72196", "name": "Commented-code block (8 lines) in server/app.js:54", "shortDescription": {"text": "Commented-code block (8 lines) in server/app.js:54"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3784cf261579b697", "name": "Commented-code block (6 lines) in server/server.js:34", "shortDescription": {"text": "Commented-code block (6 lines) in server/server.js:34"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2e4ca6304f999d9b", "name": "Commented-code block (7 lines) in server/middleware/idempotency.js:187", "shortDescription": {"text": "Commented-code block (7 lines) in server/middleware/idempotency.js:187"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-864014693c2e4438", "name": "Commented-code block (6 lines) in server/test/lib/order-queries.test.js:1", "shortDescription": {"text": "Commented-code block (6 lines) in server/test/lib/order-queries.test.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c5875dfe5e310867", "name": "Commented-code block (5 lines) in server/test/lib/offline-queue.test.js:10", "shortDescription": {"text": "Commented-code block (5 lines) in server/test/lib/offline-queue.test.js:10"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4ca6395594662dae", "name": "Commented-code block (5 lines) in server/test/lib/fiscal-payment.test.js:57", "shortDescription": {"text": "Commented-code block (5 lines) in server/test/lib/fiscal-payment.test.js:57"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-30b0b3ca6e60a825", "name": "Commented-code block (5 lines) in server/test/routes/roles.test.js:11", "shortDescription": {"text": "Commented-code block (5 lines) in server/test/routes/roles.test.js:11"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a84152923f8b1518", "name": "Commented-code block (5 lines) in server/test/routes/auth-verify-manager-lockout.test.js:7", "shortDescription": {"text": "Commented-code block (5 lines) in server/test/routes/auth-verify-manager-lockout.test.js:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7cac0e3274aff941", "name": "Legacy-named symbol `print_copy` in server/test/routes/payments.portos.test.js:420", "shortDescription": {"text": "Legacy-named symbol `print_copy` in server/test/routes/payments.portos.test.js:420"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d06da25201f0ce37", "name": "Commented-code block (5 lines) in server/test/routes/auth-lockout.test.js:7", "shortDescription": {"text": "Commented-code block (5 lines) in server/test/routes/auth-lockout.test.js:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f4d39fcaa6fbe04c", "name": "Commented-code block (11 lines) in server/test/routes/auth.test.js:8", "shortDescription": {"text": "Commented-code block (11 lines) in server/test/routes/auth.test.js:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e0f5da5645724665", "name": "Commented-code block (5 lines) in server/test/routes/cashflow.test.js:11", "shortDescription": {"text": "Commented-code block (5 lines) in server/test/routes/cashflow.test.js:11"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-834fd8c25b552f25", "name": "`fetch()` without try/.catch or AbortSignal \u2014 server/scripts/portos-baud-scan.mjs:34", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 server/scripts/portos-baud-scan.mjs:34"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e8b3380aad081851", "name": "`fetch()` without try/.catch or AbortSignal \u2014 server/scripts/portos-printer-test.mjs:15", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 server/scripts/portos-printer-test.mjs:15"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0cb3251cadf89140", "name": "Commented-code block (7 lines) in server/lib/storno-stock.js:5", "shortDescription": {"text": "Commented-code block (7 lines) in server/lib/storno-stock.js:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a97c918a8c219be1", "name": "Legacy-named symbol `print_copy` in server/lib/portos.js:459", "shortDescription": {"text": "Legacy-named symbol `print_copy` in server/lib/portos.js:459"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-58fb80134cec2a1e", "name": "Commented-code block (12 lines) in server/lib/stock.js:25", "shortDescription": {"text": "Commented-code block (12 lines) in server/lib/stock.js:25"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-910c36c5448ef6cd", "name": "Commented-code block (5 lines) in server/lib/menu-helpers.js:3", "shortDescription": {"text": "Commented-code block (5 lines) in server/lib/menu-helpers.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5a28d02e1a3d7e45", "name": "Commented-code block (8 lines) in server/lib/backup.js:6", "shortDescription": {"text": "Commented-code block (8 lines) in server/lib/backup.js:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2cd91fa16ef50651", "name": "Commented-code block (5 lines) in server/lib/print/queue.js:118", "shortDescription": {"text": "Commented-code block (5 lines) in server/lib/print/queue.js:118"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e46e141d50938295", "name": "Commented-code block (10 lines) in server/lib/print/network.js:9", "shortDescription": {"text": "Commented-code block (10 lines) in server/lib/print/network.js:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bd4024b1a2f0f14b", "name": "Commented-code block (5 lines) in server/lib/print/format.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in server/lib/print/format.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ce0aa02e97b7e86e", "name": "Commented-code block (5 lines) in server/lib/print/tickets.js:28", "shortDescription": {"text": "Commented-code block (5 lines) in server/lib/print/tickets.js:28"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e6fd66891440847f", "name": "Commented-code block (8 lines) in server/lib/print/z-report.js:14", "shortDescription": {"text": "Commented-code block (8 lines) in server/lib/print/z-report.js:14"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-03652bfca9f7d0c1", "name": "Commented-code block (5 lines) in server/lib/forecast/ridge.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in server/lib/forecast/ridge.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-82ce09afb3cf08ae", "name": "Commented-code block (6 lines) in server/lib/forecast/engine-hourly.js:1", "shortDescription": {"text": "Commented-code block (6 lines) in server/lib/forecast/engine-hourly.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ea898e83284b848c", "name": "Commented-code block (6 lines) in server/lib/forecast/engine.js:1", "shortDescription": {"text": "Commented-code block (6 lines) in server/lib/forecast/engine.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c14a57705ab037f7", "name": "Commented-code block (6 lines) in server/lib/forecast/gbt.js:1", "shortDescription": {"text": "Commented-code block (6 lines) in server/lib/forecast/gbt.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-337549899a90cb6d", "name": "Commented-code block (5 lines) in server/lib/payments/fiscal-storno.js:112", "shortDescription": {"text": "Commented-code block (5 lines) in server/lib/payments/fiscal-storno.js:112"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e802b8dbe16ac897", "name": "Commented-code block (5 lines) in server/lib/payments/history.js:10", "shortDescription": {"text": "Commented-code block (5 lines) in server/lib/payments/history.js:10"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ee9607fbe3ba6ea2", "name": "Commented-code block (7 lines) in server/lib/payments/create.js:109", "shortDescription": {"text": "Commented-code block (7 lines) in server/lib/payments/create.js:109"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-06e52261f786b4fe", "name": "Commented-code block (7 lines) in server/lib/payments/change-method.js:30", "shortDescription": {"text": "Commented-code block (7 lines) in server/lib/payments/change-method.js:30"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e6ba39aefccab574", "name": "Commented-code block (11 lines) in server/lib/reports/weekly.js:189", "shortDescription": {"text": "Commented-code block (11 lines) in server/lib/reports/weekly.js:189"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0d67264ac5efe955", "name": "Commented-code block (6 lines) in server/lib/reports/forecasts.js:5", "shortDescription": {"text": "Commented-code block (6 lines) in server/lib/reports/forecasts.js:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2026ebd202506039", "name": "Commented-code block (8 lines) in server/lib/reports/z-report.js:131", "shortDescription": {"text": "Commented-code block (8 lines) in server/lib/reports/z-report.js:131"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-19c3abe11b56bea3", "name": "Commented-code block (6 lines) in server/lib/reports/summary.js:7", "shortDescription": {"text": "Commented-code block (6 lines) in server/lib/reports/summary.js:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8f792c4eeb5fe350", "name": "Commented-code block (5 lines) in server/routes/storno-basket.js:162", "shortDescription": {"text": "Commented-code block (5 lines) in server/routes/storno-basket.js:162"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9b144c1faa7470ca", "name": "Commented-code block (5 lines) in server/routes/staff.js:12", "shortDescription": {"text": "Commented-code block (5 lines) in server/routes/staff.js:12"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b6fc8251ed8c0093", "name": "Commented-code block (6 lines) in server/routes/orders.js:62", "shortDescription": {"text": "Commented-code block (6 lines) in server/routes/orders.js:62"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f35137f28eb330f0", "name": "Commented-code block (7 lines) in server/routes/attendance.js:106", "shortDescription": {"text": "Commented-code block (7 lines) in server/routes/attendance.js:106"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5b69ef7c79aed971", "name": "`fetch()` without try/.catch or AbortSignal \u2014 server/routes/ttlock.js:47", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 server/routes/ttlock.js:47"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2677ec4e2d56fd46", "name": "Commented-code block (5 lines) in server/routes/paragons.js:5", "shortDescription": {"text": "Commented-code block (5 lines) in server/routes/paragons.js:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-55dd8fb466c26d00", "name": "Commented-code block (5 lines) in server/routes/menu.js:91", "shortDescription": {"text": "Commented-code block (5 lines) in server/routes/menu.js:91"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a0506d341c60a1d7", "name": "Commented-code block (6 lines) in server/routes/auth.js:13", "shortDescription": {"text": "Commented-code block (6 lines) in server/routes/auth.js:13"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-46c09c34e6c7055f", "name": "Commented-code block (5 lines) in server/routes/inventory.js:187", "shortDescription": {"text": "Commented-code block (5 lines) in server/routes/inventory.js:187"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c98539d93cd0c29d", "name": "Commented-code block (7 lines) in server/routes/public-menu.js:1", "shortDescription": {"text": "Commented-code block (7 lines) in server/routes/public-menu.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-17750030d4609cf6", "name": "Commented-code block (5 lines) in server/db/schema.js:58", "shortDescription": {"text": "Commented-code block (5 lines) in server/db/schema.js:58"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ed05ec59eedcee24", "name": "Commented-code block (6 lines) in server/db/index.js:6", "shortDescription": {"text": "Commented-code block (6 lines) in server/db/index.js:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-03351f90bf5e0398", "name": "Commented-code block (6 lines) in server/schemas/cashflow.js:22", "shortDescription": {"text": "Commented-code block (6 lines) in server/schemas/cashflow.js:22"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a9f20de79300a322", "name": "Commented-code block (5 lines) in server/schemas/orders.js:45", "shortDescription": {"text": "Commented-code block (5 lines) in server/schemas/orders.js:45"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9a82cf7d16234d20", "name": "21 env vars used in code but missing from .env.example", "shortDescription": {"text": "21 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `ALLOWED_ORIGINS`, `BACKUP_DIR`, `BACKUP_RETENTION_DAYS`, `BUILD_VERSION`, `DEPLOY_HOST`, `DISABLE_PIN_RATE_LIMIT`, `HTTPS_PORT`, `KASA_BASE` + 13 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e0a6331f644c3c5d", "name": "Dangling fetch: POST /auth/verify-manager (js/pos-payments.js:1000)", "shortDescription": {"text": "Dangling fetch: POST /auth/verify-manager (js/pos-payments.js:1000)"}, "fullDescription": {"text": "`js/pos-payments.js:1000` calls `POST /auth/verify-manager` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: helper:request\nNormalized path used for matching: `/auth/verify-manager`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-394137dd7964eb60", "name": "Dangling fetch: GET http://localhost:${process.env.PORT || 3080}/api/reports/z-report?date=${date} (server/lib/print/z-r", "shortDescription": {"text": "Dangling fetch: GET http://localhost:${process.env.PORT || 3080}/api/reports/z-report?date=${date} (server/lib/print/z-report.js:29)"}, "fullDescription": {"text": "`server/lib/print/z-report.js:29` calls `GET http://localhost:${process.env.PORT || 3080}/api/reports/z-report?date=${date}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/localhost:/<p>/api/reports/z-report`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-29e0ed54344aaa81", "name": "Unused endpoint: GET /menu", "shortDescription": {"text": "Unused endpoint: GET /menu"}, "fullDescription": {"text": "`api.js` declares `GET /menu` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a41f2c569e37ab27", "name": "Unused endpoint: GET /integrations/portos/status", "shortDescription": {"text": "Unused endpoint: GET /integrations/portos/status"}, "fullDescription": {"text": "`api.js` declares `GET /integrations/portos/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c028f07b4f30d25", "name": "Unused endpoint: GET /company-profile", "shortDescription": {"text": "Unused endpoint: GET /company-profile"}, "fullDescription": {"text": "`api.js` declares `GET /company-profile` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e10e11b828e863ca", "name": "Unused endpoint: PUT /company-profile", "shortDescription": {"text": "Unused endpoint: PUT /company-profile"}, "fullDescription": {"text": "`api.js` declares `PUT /company-profile` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6632fc77007169f4", "name": "Unused endpoint: GET /company-profile/portos-compare", "shortDescription": {"text": "Unused endpoint: GET /company-profile/portos-compare"}, "fullDescription": {"text": "`api.js` declares `GET /company-profile/portos-compare` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-40a386b4b2d770dd", "name": "Unused endpoint: POST /company-profile/sync-from-portos", "shortDescription": {"text": "Unused endpoint: POST /company-profile/sync-from-portos"}, "fullDescription": {"text": "`api.js` declares `POST /company-profile/sync-from-portos` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f1057abb810cb8eb", "name": "Unused endpoint: GET /fiscal-documents/search?", "shortDescription": {"text": "Unused endpoint: GET /fiscal-documents/search?"}, "fullDescription": {"text": "`api.js` declares `GET /fiscal-documents/search?` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb8357a946e81357", "name": "Unused endpoint: GET /fiscal-documents/", "shortDescription": {"text": "Unused endpoint: GET /fiscal-documents/"}, "fullDescription": {"text": "`api.js` declares `GET /fiscal-documents/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-afa5516c58014335", "name": "Unused endpoint: POST /fiscal-documents/", "shortDescription": {"text": "Unused endpoint: POST /fiscal-documents/"}, "fullDescription": {"text": "`api.js` declares `POST /fiscal-documents/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72a9fcbdf7c4dc6b", "name": "Unused endpoint: GET /payments/history", "shortDescription": {"text": "Unused endpoint: GET /payments/history"}, "fullDescription": {"text": "`api.js` declares `GET /payments/history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e34e63a60724fcb4", "name": "Unused endpoint: POST /payments/", "shortDescription": {"text": "Unused endpoint: POST /payments/"}, "fullDescription": {"text": "`api.js` declares `POST /payments/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5aaed4fa45b14d40", "name": "Unused endpoint: GET /payments/", "shortDescription": {"text": "Unused endpoint: GET /payments/"}, "fullDescription": {"text": "`api.js` declares `GET /payments/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e1a48f00748448a3", "name": "Unused endpoint: POST /print/kitchen", "shortDescription": {"text": "Unused endpoint: POST /print/kitchen"}, "fullDescription": {"text": "`js/pos-payments.js` declares `POST /print/kitchen` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a906f2342eee71df", "name": "Unused endpoint: POST /orders/", "shortDescription": {"text": "Unused endpoint: POST /orders/"}, "fullDescription": {"text": "`js/pos-payments.js` declares `POST /orders/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d962920df8b2c26a", "name": "Unused endpoint: POST /paragons", "shortDescription": {"text": "Unused endpoint: POST /paragons"}, "fullDescription": {"text": "`js/pos-payments.js` declares `POST /paragons` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6ae361e8dba69f15", "name": "Unused endpoint: POST /print/paragon", "shortDescription": {"text": "Unused endpoint: POST /print/paragon"}, "fullDescription": {"text": "`js/pos-payments.js` declares `POST /print/paragon` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e5006457a4f69d46", "name": "Unused endpoint: POST /payments", "shortDescription": {"text": "Unused endpoint: POST /payments"}, "fullDescription": {"text": "`js/pos-payments.js` declares `POST /payments` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bfd52c9c80ecb887", "name": "Unused endpoint: POST /print/pre-bill", "shortDescription": {"text": "Unused endpoint: POST /print/pre-bill"}, "fullDescription": {"text": "`js/pos-payments.js` declares `POST /print/pre-bill` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fb1b0d2870d2a808", "name": "Unused endpoint: POST /ttlock/passcode", "shortDescription": {"text": "Unused endpoint: POST /ttlock/passcode"}, "fullDescription": {"text": "`js/pos-init.js` declares `POST /ttlock/passcode` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5fca3d9619754e6b", "name": "Unused endpoint: POST /print/lockcode", "shortDescription": {"text": "Unused endpoint: POST /print/lockcode"}, "fullDescription": {"text": "`js/pos-init.js` declares `POST /print/lockcode` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-57d57804b276920c", "name": "Unused endpoint: GET /tables", "shortDescription": {"text": "Unused endpoint: GET /tables"}, "fullDescription": {"text": "`js/pos-init.js` declares `GET /tables` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d92a33bc30aa57c", "name": "Unused endpoint: GET /shifts/current", "shortDescription": {"text": "Unused endpoint: GET /shifts/current"}, "fullDescription": {"text": "`js/pos-init.js` declares `GET /shifts/current` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-17feda489b5e2a42", "name": "Unused endpoint: POST /shifts/open", "shortDescription": {"text": "Unused endpoint: POST /shifts/open"}, "fullDescription": {"text": "`js/pos-init.js` declares `POST /shifts/open` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd7f4a53a317aa35", "name": "Unused endpoint: GET /shifts/current/summary", "shortDescription": {"text": "Unused endpoint: GET /shifts/current/summary"}, "fullDescription": {"text": "`js/pos-init.js` declares `GET /shifts/current/summary` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6d2603f94b3036f9", "name": "Unused endpoint: POST /shifts/close", "shortDescription": {"text": "Unused endpoint: POST /shifts/close"}, "fullDescription": {"text": "`js/pos-init.js` declares `POST /shifts/close` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-210649ca48864e6a", "name": "Unused endpoint: GET /reports/z-report?date=", "shortDescription": {"text": "Unused endpoint: GET /reports/z-report?date="}, "fullDescription": {"text": "`js/pos-init.js` declares `GET /reports/z-report?date=` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-10a603206383c132", "name": "Unused endpoint: GET /storno-basket", "shortDescription": {"text": "Unused endpoint: GET /storno-basket"}, "fullDescription": {"text": "`js/pos-state.js` declares `GET /storno-basket` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0df69fa38bf271f0", "name": "Unused endpoint: GET /zones", "shortDescription": {"text": "Unused endpoint: GET /zones"}, "fullDescription": {"text": "`js/pos-state.js` declares `GET /zones` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0328e9bdbb61fa68", "name": "Unused endpoint: GET /orders", "shortDescription": {"text": "Unused endpoint: GET /orders"}, "fullDescription": {"text": "`js/pos-state.js` declares `GET /orders` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4f78697ee86646f7", "name": "Unused endpoint: GET /orders/table/", "shortDescription": {"text": "Unused endpoint: GET /orders/table/"}, "fullDescription": {"text": "`js/pos-state.js` declares `GET /orders/table/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e8bb2bc0a5072575", "name": "Unused endpoint: PUT /tables/", "shortDescription": {"text": "Unused endpoint: PUT /tables/"}, "fullDescription": {"text": "`js/pos-state.js` declares `PUT /tables/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-988262c12d31b479", "name": "Unused endpoint: POST /orders", "shortDescription": {"text": "Unused endpoint: POST /orders"}, "fullDescription": {"text": "`js/pos-ui.js` declares `POST /orders` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4b83850743dac652", "name": "Unused endpoint: PUT /orders/", "shortDescription": {"text": "Unused endpoint: PUT /orders/"}, "fullDescription": {"text": "`js/pos-ui.js` declares `PUT /orders/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e0b82c0ee4a9f4ce", "name": "Unused endpoint: POST /storno-basket/", "shortDescription": {"text": "Unused endpoint: POST /storno-basket/"}, "fullDescription": {"text": "`js/pos-render.js` declares `POST /storno-basket/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e9c025148fc40c6", "name": "Unused endpoint: GET /discounts", "shortDescription": {"text": "Unused endpoint: GET /discounts"}, "fullDescription": {"text": "`js/pos-render.js` declares `GET /discounts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1cbe2b0464f31c3d", "name": "Unused endpoint: POST /storno-basket", "shortDescription": {"text": "Unused endpoint: POST /storno-basket"}, "fullDescription": {"text": "`js/pos-orders.js` declares `POST /storno-basket` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-44360851685c3679", "name": "Unused endpoint: GET /cashflow/summary?", "shortDescription": {"text": "Unused endpoint: GET /cashflow/summary?"}, "fullDescription": {"text": "`admin/pages/cashflow.js` declares `GET /cashflow/summary?` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f2789b56851c1d6e", "name": "Unused endpoint: GET /cashflow?", "shortDescription": {"text": "Unused endpoint: GET /cashflow?"}, "fullDescription": {"text": "`admin/pages/cashflow.js` declares `GET /cashflow?` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-89fc9ea6e7a0aa7c", "name": "Unused endpoint: PATCH /cashflow/", "shortDescription": {"text": "Unused endpoint: PATCH /cashflow/"}, "fullDescription": {"text": "`admin/pages/cashflow.js` declares `PATCH /cashflow/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e3afbb03fcaf6a78", "name": "Unused endpoint: POST /cashflow", "shortDescription": {"text": "Unused endpoint: POST /cashflow"}, "fullDescription": {"text": "`admin/pages/cashflow.js` declares `POST /cashflow` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02dfdc80cd527b2b", "name": "Unused endpoint: GET /inventory/suppliers", "shortDescription": {"text": "Unused endpoint: GET /inventory/suppliers"}, "fullDescription": {"text": "`admin/pages/cashflow.js` declares `GET /inventory/suppliers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b0618e1d5bfecabb", "name": "Unused endpoint: GET /printers", "shortDescription": {"text": "Unused endpoint: GET /printers"}, "fullDescription": {"text": "`admin/pages/settings.js` declares `GET /printers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-30fedd8cd7a57475", "name": "Unused endpoint: PUT /printers/", "shortDescription": {"text": "Unused endpoint: PUT /printers/"}, "fullDescription": {"text": "`admin/pages/settings.js` declares `PUT /printers/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ed0b25a9205e793e", "name": "Unused endpoint: POST /printers", "shortDescription": {"text": "Unused endpoint: POST /printers"}, "fullDescription": {"text": "`admin/pages/settings.js` declares `POST /printers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-65b7615b17f22b5a", "name": "Unused endpoint: POST /printers/", "shortDescription": {"text": "Unused endpoint: POST /printers/"}, "fullDescription": {"text": "`admin/pages/settings.js` declares `POST /printers/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ec4643c62a5bb024", "name": "Unused endpoint: GET /discounts/all", "shortDescription": {"text": "Unused endpoint: GET /discounts/all"}, "fullDescription": {"text": "`admin/pages/settings.js` declares `GET /discounts/all` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ae9f622bf34e0d8", "name": "Unused endpoint: POST /discounts", "shortDescription": {"text": "Unused endpoint: POST /discounts"}, "fullDescription": {"text": "`admin/pages/settings.js` declares `POST /discounts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-12263013181171e6", "name": "Unused endpoint: PUT /discounts/", "shortDescription": {"text": "Unused endpoint: PUT /discounts/"}, "fullDescription": {"text": "`admin/pages/settings.js` declares `PUT /discounts/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-82cdc135da43090a", "name": "Unused endpoint: GET /reports/weekly?from=", "shortDescription": {"text": "Unused endpoint: GET /reports/weekly?from="}, "fullDescription": {"text": "`admin/pages/weekly.js` declares `GET /reports/weekly?from=` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a64f07011aae2a89", "name": "Unused endpoint: GET /reports/weather?from=", "shortDescription": {"text": "Unused endpoint: GET /reports/weather?from="}, "fullDescription": {"text": "`admin/pages/weekly.js` declares `GET /reports/weather?from=` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23228"}, "properties": {"repository": "Yevheni55/POS", "repoUrl": "https://github.com/Yevheni55/POS", "branch": "main"}, "results": [{"ruleId": "scanner-16c4f26ff39cef71", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/pos-init.js:249"}, "properties": {"repobilityId": "c65c1c3c1250cb89", "scanner": "scanner-primary", "fingerprint": "16c4f26ff39cef71", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-38e061540cbed256", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 js/pos-render.js:491"}, "properties": {"repobilityId": "55a8f836869e083d", "scanner": "scanner-primary", "fingerprint": "38e061540cbed256", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-b4db5eafecb6ab57", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 js/kitchen.js:468"}, "properties": {"repobilityId": "de560a05a85e39b6", "scanner": "scanner-primary", "fingerprint": "b4db5eafecb6ab57", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5ff363e036ebcb0e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 admin/pages/recipes.js:798"}, "properties": {"repobilityId": "3e6d938d6a0d6b9e", "scanner": "scanner-primary", "fingerprint": "5ff363e036ebcb0e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-4e8d328cdac245a7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server/server.js:74"}, "properties": {"repobilityId": "72b828fc11274423", "scanner": "scanner-primary", "fingerprint": "4e8d328cdac245a7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-39b60c66fe65468d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server/lib/portos-sync-job.js:70"}, "properties": {"repobilityId": "f6ae8c2dbf1982e5", "scanner": "scanner-primary", "fingerprint": "39b60c66fe65468d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-4667d93b983ccc04", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server/lib/weather.js:143"}, "properties": {"repobilityId": "2741e30c2ffc6f50", "scanner": "scanner-primary", "fingerprint": "4667d93b983ccc04", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7455321a7644ae04", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server/lib/print/queue.js:26"}, "properties": {"repobilityId": "2b47a934022b9b78", "scanner": "scanner-primary", "fingerprint": "7455321a7644ae04", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-401c8461657ecb2f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server/lib/print/network.js:73"}, "properties": {"repobilityId": "39e7c1b252d37e65", "scanner": "scanner-primary", "fingerprint": "401c8461657ecb2f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3da36ef251c7e74f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server/lib/forecast/engine.js:322"}, "properties": {"repobilityId": "7ab54ec29ea99f5f", "scanner": "scanner-primary", "fingerprint": "3da36ef251c7e74f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-4fccb9d067ce2cab", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server/routes/invoice-scan.js:140"}, "properties": {"repobilityId": "d6d0f5c298268f88", "scanner": "scanner-primary", "fingerprint": "4fccb9d067ce2cab", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-624a36123176395a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server/routes/ttlock.js:197"}, "properties": {"repobilityId": "bd8555fc7b4ac08d", "scanner": "scanner-primary", "fingerprint": "624a36123176395a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1ce43abd2967ab14", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server/routes/inventory.js:226"}, "properties": {"repobilityId": "252fba3c1eb733ae", "scanner": "scanner-primary", "fingerprint": "1ce43abd2967ab14", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b286819a9b48ed95", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server/db/seed.js:15"}, "properties": {"repobilityId": "86e53f9788cfdc84", "scanner": "scanner-primary", "fingerprint": "b286819a9b48ed95", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-4f8cdfb31baf15c6", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server/jobs/paragon-sync.js:31"}, "properties": {"repobilityId": "f8ff57c7861388c2", "scanner": "scanner-primary", "fingerprint": "4f8cdfb31baf15c6", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8a84a2f1d4702499", "level": "warning", "message": {"text": "Privileged port 4 in use"}, "properties": {"repobilityId": "1594bfeff919296e", "scanner": "scanner-primary", "fingerprint": "8a84a2f1d4702499", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-8987d6d1c30c7202", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "properties": {"repobilityId": "068fbf45727eac17", "scanner": "scanner-primary", "fingerprint": "8987d6d1c30c7202", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-c7d4db042b90bbb3", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in login.html:443"}, "properties": {"repobilityId": "617b51c994b02988", "scanner": "scanner-primary", "fingerprint": "c7d4db042b90bbb3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "login.html"}, "region": {"startLine": 443}}}]}, {"ruleId": "scanner-f9ba30ead5aa0d59", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in pos-design-demo.html:1749"}, "properties": {"repobilityId": "7cd345910767c492", "scanner": "scanner-primary", "fingerprint": "f9ba30ead5aa0d59", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pos-design-demo.html"}, "region": {"startLine": 1749}}}]}, {"ruleId": "scanner-3043e4e7a6d1b555", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in api.js:551"}, "properties": {"repobilityId": "08f5b3605493eb45", "scanner": "scanner-primary", "fingerprint": "3043e4e7a6d1b555", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api.js"}, "region": {"startLine": 551}}}]}, {"ruleId": "scanner-b741874a360ce0ad", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in api.js:120"}, "properties": {"repobilityId": "74417e727d477e6c", "scanner": "scanner-primary", "fingerprint": "b741874a360ce0ad", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api.js"}, "region": {"startLine": 120}}}]}, {"ruleId": "scanner-810d01f5e2a14c40", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/pos-payments.js:403"}, "properties": {"repobilityId": "03d9d4913c8e9fbb", "scanner": "scanner-primary", "fingerprint": "810d01f5e2a14c40", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/pos-payments.js"}, "region": {"startLine": 403}}}]}, {"ruleId": "scanner-7d4d4abbc9ddc3e6", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/pos-init.js:577"}, "properties": {"repobilityId": "3ac580458e88adec", "scanner": "scanner-primary", "fingerprint": "7d4d4abbc9ddc3e6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/pos-init.js"}, "region": {"startLine": 577}}}]}, {"ruleId": "scanner-cd28180549c9f373", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/pos-state.js:16"}, "properties": {"repobilityId": "07ee36fb15970dfb", "scanner": "scanner-primary", "fingerprint": "cd28180549c9f373", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/pos-state.js"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-bf8f025c8ee1e987", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/pos-ui.js:38"}, "properties": {"repobilityId": "211707f93b7dad3c", "scanner": "scanner-primary", "fingerprint": "bf8f025c8ee1e987", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/pos-ui.js"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-6f7d80d26ee63d68", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/pos-render.js:191"}, "properties": {"repobilityId": "657d5806232b063a", "scanner": "scanner-primary", "fingerprint": "6f7d80d26ee63d68", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/pos-render.js"}, "region": {"startLine": 191}}}]}, {"ruleId": "scanner-0170d7fa018f199e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/dochadzka.js:35"}, "properties": {"repobilityId": "8c813348fb36055a", "scanner": "scanner-primary", "fingerprint": "0170d7fa018f199e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/dochadzka.js"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-4678ab35cc50e2a1", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/pos-orders.js:1154"}, "properties": {"repobilityId": "e18c067f86a93a45", "scanner": "scanner-primary", "fingerprint": "4678ab35cc50e2a1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/pos-orders.js"}, "region": {"startLine": 1154}}}]}, {"ruleId": "scanner-5330fc256512e949", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in js/pos-orders.js:374"}, "properties": {"repobilityId": "9aa394310f410acc", "scanner": "scanner-primary", "fingerprint": "5330fc256512e949", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/pos-orders.js"}, "region": {"startLine": 374}}}]}, {"ruleId": "scanner-cd292902ace809ab", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/kitchen.js:174"}, "properties": {"repobilityId": "462c32b26cb9b000", "scanner": "scanner-primary", "fingerprint": "cd292902ace809ab", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/kitchen.js"}, "region": {"startLine": 174}}}]}, {"ruleId": "scanner-8cab16b4bf04456f", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in js/kitchen.js:419"}, "properties": {"repobilityId": "cee3d9f73df1c7e3", "scanner": "scanner-primary", "fingerprint": "8cab16b4bf04456f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/kitchen.js"}, "region": {"startLine": 419}}}]}, {"ruleId": "scanner-df68437d16f2afc0", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in js/pos-mobile.js:50"}, "properties": {"repobilityId": "df80ed8ffc9cd58e", "scanner": "scanner-primary", "fingerprint": "df68437d16f2afc0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/pos-mobile.js"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-d16680ad76a4dab9", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in js/pos-mobile.js:472"}, "properties": {"repobilityId": "1b2ba2ca28303d80", "scanner": "scanner-primary", "fingerprint": "d16680ad76a4dab9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "js/pos-mobile.js"}, "region": {"startLine": 472}}}]}, {"ruleId": "scanner-81dd69a5f1623b3d", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/export-surfspirit-menu.mjs:19"}, "properties": {"repobilityId": "75940b3efc2261ee", "scanner": "scanner-primary", "fingerprint": "81dd69a5f1623b3d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/export-surfspirit-menu.mjs"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-70aea988c6daa076", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in components/loading.js:129"}, "properties": {"repobilityId": "bff9a1f6fc3409f9", "scanner": "scanner-primary", "fingerprint": "70aea988c6daa076", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "components/loading.js"}, "region": {"startLine": 129}}}]}, {"ruleId": "scanner-6413575783d43348", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/index.html:340"}, "properties": {"repobilityId": "d75ddf931ed139f4", "scanner": "scanner-primary", "fingerprint": "6413575783d43348", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/index.html"}, "region": {"startLine": 340}}}]}, {"ruleId": "scanner-a6ae8c9815f1f6f4", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in admin/index.html:207"}, "properties": {"repobilityId": "eab292f5cfbe8289", "scanner": "scanner-primary", "fingerprint": "a6ae8c9815f1f6f4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/index.html"}, "region": {"startLine": 207}}}]}, {"ruleId": "scanner-2c5876d745e3440e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/router.js:299"}, "properties": {"repobilityId": "d231942d067ec535", "scanner": "scanner-primary", "fingerprint": "2c5876d745e3440e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/router.js"}, "region": {"startLine": 299}}}]}, {"ruleId": "scanner-9cb80a6f5d96a59b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/components/tab-shell.js:37"}, "properties": {"repobilityId": "c257909c78f9a31a", "scanner": "scanner-primary", "fingerprint": "9cb80a6f5d96a59b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/components/tab-shell.js"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-a74d40755abbd577", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/components/command-palette.js:185"}, "properties": {"repobilityId": "447a0fdeb05fbb1e", "scanner": "scanner-primary", "fingerprint": "a74d40755abbd577", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/components/command-palette.js"}, "region": {"startLine": 185}}}]}, {"ruleId": "scanner-acf69bf16eca6533", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/components/toast-undo.js:112"}, "properties": {"repobilityId": "d0c6e3beb7179090", "scanner": "scanner-primary", "fingerprint": "acf69bf16eca6533", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/components/toast-undo.js"}, "region": {"startLine": 112}}}]}, {"ruleId": "scanner-bfb3d0874c01dbc9", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/cashflow.js:96"}, "properties": {"repobilityId": "c08f508822cbff19", "scanner": "scanner-primary", "fingerprint": "bfb3d0874c01dbc9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/pages/cashflow.js"}, "region": {"startLine": 96}}}]}, {"ruleId": "scanner-c4bd9f4a9fa78883", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/settings.js:503"}, "properties": {"repobilityId": "782a302ba5bedabd", "scanner": "scanner-primary", "fingerprint": "c4bd9f4a9fa78883", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/pages/settings.js"}, "region": {"startLine": 503}}}]}, {"ruleId": "scanner-192d2fb03f49a576", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/weekly.js:66"}, "properties": {"repobilityId": "acdd71e59af9e04f", "scanner": "scanner-primary", "fingerprint": "192d2fb03f49a576", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/pages/weekly.js"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-06815ea0e79149c1", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/suppliers.js:50"}, "properties": {"repobilityId": "9a0385ef29e8d119", "scanner": "scanner-primary", "fingerprint": "06815ea0e79149c1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/pages/suppliers.js"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-f06ab97426d82d2b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/inventory-dashboard.js:107"}, "properties": {"repobilityId": "0cdd07b42826330a", "scanner": "scanner-primary", "fingerprint": "f06ab97426d82d2b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/pages/inventory-dashboard.js"}, "region": {"startLine": 107}}}]}, {"ruleId": "scanner-8e86160747130294", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/zam-spotreba.js:55"}, "properties": {"repobilityId": "c823f2c27fa629b7", "scanner": "scanner-primary", "fingerprint": "8e86160747130294", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/pages/zam-spotreba.js"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-e99f66d368d11a5d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/purchase-orders.js:155"}, "properties": {"repobilityId": "3a704295741ac291", "scanner": "scanner-primary", "fingerprint": "e99f66d368d11a5d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/pages/purchase-orders.js"}, "region": {"startLine": 155}}}]}, {"ruleId": "scanner-c4ded5bb7fc2864b", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in admin/pages/purchase-orders.js:484"}, "properties": {"repobilityId": "b2871ff98dd898e3", "scanner": "scanner-primary", "fingerprint": "c4ded5bb7fc2864b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/pages/purchase-orders.js"}, "region": {"startLine": 484}}}]}, {"ruleId": "scanner-5fcf0bbff761a284", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/stock-movements.js:89"}, "properties": {"repobilityId": "4294950ba169c05c", "scanner": "scanner-primary", "fingerprint": "5fcf0bbff761a284", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/pages/stock-movements.js"}, "region": {"startLine": 89}}}]}, {"ruleId": "scanner-2e00529b4b36e8b7", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/ingredients.js:99"}, "properties": {"repobilityId": "105f8ec32db454b4", "scanner": "scanner-primary", "fingerprint": "2e00529b4b36e8b7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/pages/ingredients.js"}, "region": {"startLine": 99}}}]}, {"ruleId": "scanner-5e4b05237b28db1a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/staff.js:93"}, "properties": {"repobilityId": "dd5ede08d69e071e", "scanner": "scanner-primary", "fingerprint": "5e4b05237b28db1a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/pages/staff.js"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-e6ad48c1a2bbc776", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/recipes.js:173"}, "properties": {"repobilityId": "c85a9983c691cc12", "scanner": "scanner-primary", "fingerprint": "e6ad48c1a2bbc776", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/pages/recipes.js"}, "region": {"startLine": 173}}}]}, {"ruleId": "scanner-4bbdc34a8b2cecde", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/write-offs.js:189"}, "properties": {"repobilityId": "b6058c2ca9353929", "scanner": "scanner-primary", "fingerprint": "4bbdc34a8b2cecde", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/pages/write-offs.js"}, "region": {"startLine": 189}}}]}, {"ruleId": "scanner-7a02dc4c1f19ee50", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/season.js:50"}, "properties": {"repobilityId": "57fdb0d80e53ccd1", "scanner": "scanner-primary", "fingerprint": "7a02dc4c1f19ee50", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/pages/season.js"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-feb3d02fea4950f0", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/tables.js:63"}, "properties": {"repobilityId": "857370e2c903565b", "scanner": "scanner-primary", "fingerprint": "feb3d02fea4950f0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/pages/tables.js"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-d7dec23795fcc56b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/menu.js:90"}, "properties": {"repobilityId": "031f536cabe47aea", "scanner": "scanner-primary", "fingerprint": "d7dec23795fcc56b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/pages/menu.js"}, "region": {"startLine": 90}}}]}, {"ruleId": "scanner-a2a8b944cc79be80", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/forecasts.js:45"}, "properties": {"repobilityId": "44cff0bfc68a3042", "scanner": "scanner-primary", "fingerprint": "a2a8b944cc79be80", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/pages/forecasts.js"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-e161bba91925340f", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/dashboard.js:23"}, "properties": {"repobilityId": "2258c4cc002ed841", "scanner": "scanner-primary", "fingerprint": "e161bba91925340f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/pages/dashboard.js"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-80c62b8f5f3c85e1", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/supplies.js:43"}, "properties": {"repobilityId": "75e80236caab13da", "scanner": "scanner-primary", "fingerprint": "80c62b8f5f3c85e1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/pages/supplies.js"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-7ea47e85d9301c45", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/fiscal-documents.js:31"}, "properties": {"repobilityId": "da9c185bcd2f393e", "scanner": "scanner-primary", "fingerprint": "7ea47e85d9301c45", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/pages/fiscal-documents.js"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-1c6191632495a529", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/reports.js:76"}, "properties": {"repobilityId": "c891252fb5ed087c", "scanner": "scanner-primary", "fingerprint": "1c6191632495a529", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/pages/reports.js"}, "region": {"startLine": 76}}}]}, {"ruleId": "scanner-59318f6e16a47ceb", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/dochadzka.js:195"}, "properties": {"repobilityId": "5b766badc75f6180", "scanner": "scanner-primary", "fingerprint": "59318f6e16a47ceb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/pages/dochadzka.js"}, "region": {"startLine": 195}}}]}, {"ruleId": "scanner-001f94bc544d5ee0", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/inventory-audit.js:94"}, "properties": {"repobilityId": "b9fc663b1634fe87", "scanner": "scanner-primary", "fingerprint": "001f94bc544d5ee0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/pages/inventory-audit.js"}, "region": {"startLine": 94}}}]}, {"ruleId": "scanner-ccb612671ff22736", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/storno.js:83"}, "properties": {"repobilityId": "1d5fb8a30c3bc252", "scanner": "scanner-primary", "fingerprint": "ccb612671ff22736", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/pages/storno.js"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-a231f5de87a19645", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/shisha.js:68"}, "properties": {"repobilityId": "57dd64366fcaf281", "scanner": "scanner-primary", "fingerprint": "a231f5de87a19645", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/pages/shisha.js"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-3677d0da3c3392db", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/audit.js:114"}, "properties": {"repobilityId": "4f052b461e9cdf40", "scanner": "scanner-primary", "fingerprint": "3677d0da3c3392db", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/pages/audit.js"}, "region": {"startLine": 114}}}]}, {"ruleId": "scanner-72a54413238bb8e9", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/payments.js:118"}, "properties": {"repobilityId": "d131830a369dab10", "scanner": "scanner-primary", "fingerprint": "72a54413238bb8e9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/pages/payments.js"}, "region": {"startLine": 118}}}]}, {"ruleId": "scanner-6312fcbb1719cdad", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in admin/pages/assets.js:174"}, "properties": {"repobilityId": "30cca75da74f4fa2", "scanner": "scanner-primary", "fingerprint": "6312fcbb1719cdad", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "admin/pages/assets.js"}, "region": {"startLine": 174}}}]}, {"ruleId": "scanner-0fb8c9234bf6a7ac", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web/index.html:1449"}, "properties": {"repobilityId": "403cbb974bf02660", "scanner": "scanner-primary", "fingerprint": "0fb8c9234bf6a7ac", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/index.html"}, "region": {"startLine": 1449}}}]}, {"ruleId": "scanner-067317841b672ed4", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in server/lib/backup.js:15"}, "properties": {"repobilityId": "c75b04bec85c6f14", "scanner": "scanner-primary", "fingerprint": "067317841b672ed4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/lib/backup.js"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-debb6b5262c9e887", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in server/routes/public-menu.js:82"}, "properties": {"repobilityId": "6bc22332f6b91c54", "scanner": "scanner-primary", "fingerprint": "debb6b5262c9e887", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/routes/public-menu.js"}, "region": {"startLine": 82}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-dc0dc63fa345b3c6", "level": "note", "message": {"text": "Very large file: js/pos-payments.js (1260 lines)"}, "properties": {"repobilityId": "04409cdf7626965e", "scanner": "scanner-primary", "fingerprint": "dc0dc63fa345b3c6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-075c22239979b46b", "level": "note", "message": {"text": "Very large file: js/pos-render.js (1324 lines)"}, "properties": {"repobilityId": "5fd27f28938e5a8e", "scanner": "scanner-primary", "fingerprint": "075c22239979b46b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-45419387a82f2981", "level": "note", "message": {"text": "Very large file: js/pos-orders.js (1907 lines)"}, "properties": {"repobilityId": "f8d23be48be5f7c8", "scanner": "scanner-primary", "fingerprint": "45419387a82f2981", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1cf0f5278c8fcee0", "level": "note", "message": {"text": "Very large file: admin/pages/settings.js (1280 lines)"}, "properties": {"repobilityId": "65bb100f3835fb6a", "scanner": "scanner-primary", "fingerprint": "1cf0f5278c8fcee0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e47df544f1b064da", "level": "note", "message": {"text": "Very large file: admin/pages/purchase-orders.js (1369 lines)"}, "properties": {"repobilityId": "a196519d5780e1f2", "scanner": "scanner-primary", "fingerprint": "e47df544f1b064da", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-fb6ecd14a594c64a", "level": "note", "message": {"text": "Very large file: admin/pages/reports.js (1570 lines)"}, "properties": {"repobilityId": "a2c8cbf3de556183", "scanner": "scanner-primary", "fingerprint": "fb6ecd14a594c64a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b5457d8e285d78f7", "level": "note", "message": {"text": "Very large file: admin/pages/dochadzka.js (1239 lines)"}, "properties": {"repobilityId": "463f332d0770b083", "scanner": "scanner-primary", "fingerprint": "b5457d8e285d78f7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "1517cc62933f539b", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b3ed68815bca2f8c", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: package.json"}, "properties": {"repobilityId": "7edae0550c126386", "scanner": "scanner-primary", "fingerprint": "b3ed68815bca2f8c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "38d74c5b46b95dde", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "3fe2b4c7cf3f1f05", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "f16200e57d9a10b4", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "9e57e4690698f7a5", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "2d00f7ae7357ec86", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "d8cf7c8e5e7e7682", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "5cbfc9cc23fff0af", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-bea357a6497a2d5d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "properties": {"repobilityId": "aae72df3934829ac", "scanner": "scanner-primary", "fingerprint": "bea357a6497a2d5d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f0c2bf9bdfe8e576", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/admin-impl-contract.md"}, "properties": {"repobilityId": "28cfbee2fb8ddfdf", "scanner": "scanner-primary", "fingerprint": "f0c2bf9bdfe8e576", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/admin-impl-contract.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-978afd3144190c4a", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .cursor/rules/autonomous-deploy.mdc"}, "properties": {"repobilityId": "1ca83717e56063d5", "scanner": "scanner-primary", "fingerprint": "978afd3144190c4a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "cursor_rule"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".cursor/rules/autonomous-deploy.mdc"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-081c5d10fbddb23e", "level": "none", "message": {"text": "Commented-code block (5 lines) in sw.js:1"}, "properties": {"repobilityId": "9a4766a64492e144", "scanner": "scanner-primary", "fingerprint": "081c5d10fbddb23e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-78d4e354b4ee7ca1", "level": "none", "message": {"text": "Commented-code block (5 lines) in api.js:17"}, "properties": {"repobilityId": "888da557e6a723d2", "scanner": "scanner-primary", "fingerprint": "78d4e354b4ee7ca1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6e11541b5a39edc2", "level": "none", "message": {"text": "Commented-code block (8 lines) in tests/e2e/local-draft-survives-poll.spec.mjs:1"}, "properties": {"repobilityId": "9fd4f233edd6ca0d", "scanner": "scanner-primary", "fingerprint": "6e11541b5a39edc2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d600e29643253eae", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/e2e/_setup/global-setup.mjs:141"}, "properties": {"repobilityId": "61691597016fdebe", "scanner": "scanner-primary", "fingerprint": "d600e29643253eae", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-623726fcea5b31b6", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/pos-payments.js:412"}, "properties": {"repobilityId": "620a96a7d862bfe8", "scanner": "scanner-primary", "fingerprint": "623726fcea5b31b6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4df4d17f769fd081", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 js/pos-payments.js:304"}, "properties": {"repobilityId": "eeb370dd41483330", "scanner": "scanner-primary", "fingerprint": "4df4d17f769fd081", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-db9e19c821d41ae9", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/pos-init.js:33"}, "properties": {"repobilityId": "6513b0b92d47d005", "scanner": "scanner-primary", "fingerprint": "db9e19c821d41ae9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9a5872384833037e", "level": "note", "message": {"text": "Legacy-named symbol `pos_topItems_v1` in js/pos-state.js:32"}, "properties": {"repobilityId": "bae87563f36d992a", "scanner": "scanner-primary", "fingerprint": "9a5872384833037e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-851348a1bbea0993", "level": "none", "message": {"text": "Commented-code block (6 lines) in js/pos-state.js:64"}, "properties": {"repobilityId": "ec8a00550150a628", "scanner": "scanner-primary", "fingerprint": "851348a1bbea0993", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-eecdcba61c383acb", "level": "none", "message": {"text": "Commented-code block (8 lines) in js/pos-ui.js:102"}, "properties": {"repobilityId": "67b8a722a1e6a213", "scanner": "scanner-primary", "fingerprint": "eecdcba61c383acb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f268ecc57fab9242", "level": "none", "message": {"text": "Commented-code block (7 lines) in js/pos-render.js:9"}, "properties": {"repobilityId": "2c3db1948fc2c6b9", "scanner": "scanner-primary", "fingerprint": "f268ecc57fab9242", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6677da3a6bbf8e12", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 js/dochadzka.js:71"}, "properties": {"repobilityId": "cfebdceb6c6161ad", "scanner": "scanner-primary", "fingerprint": "6677da3a6bbf8e12", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6b61ecf937bdba4b", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/pos-escape.js:6"}, "properties": {"repobilityId": "8303b92ed9b5ad9e", "scanner": "scanner-primary", "fingerprint": "6b61ecf937bdba4b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3256e9a87a1faa7a", "level": "none", "message": {"text": "Commented-code block (5 lines) in js/pos-orders.js:16"}, "properties": {"repobilityId": "69c1d7f695a82604", "scanner": "scanner-primary", "fingerprint": "3256e9a87a1faa7a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8a6487452919bb44", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 js/kitchen.js:436"}, "properties": {"repobilityId": "e44a666627041119", "scanner": "scanner-primary", "fingerprint": "8a6487452919bb44", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-351d37d81793e377", "level": "none", "message": {"text": "Commented-code block (7 lines) in js/pos-mobile.js:374"}, "properties": {"repobilityId": "9d61d0e3723f2180", "scanner": "scanner-primary", "fingerprint": "351d37d81793e377", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-40f72f2c2c264c2c", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/check-portos-profile-on-kasa.mjs:5"}, "properties": {"repobilityId": "c274721fb7bde153", "scanner": "scanner-primary", "fingerprint": "40f72f2c2c264c2c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d3d72301097af5dc", "level": "none", "message": {"text": "Commented-code block (7 lines) in components/fmt.js:7"}, "properties": {"repobilityId": "1b7d8fcc745e66c7", "scanner": "scanner-primary", "fingerprint": "d3d72301097af5dc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0f5598d94a59cdfb", "level": "none", "message": {"text": "Commented-code block (6 lines) in admin/router.js:112"}, "properties": {"repobilityId": "c5ef3bdbc01fdf91", "scanner": "scanner-primary", "fingerprint": "0f5598d94a59cdfb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-600d6ac88b5ed06d", "level": "none", "message": {"text": "Commented-code block (9 lines) in admin/components/empty-state.js:9"}, "properties": {"repobilityId": "b9a4635f16f23a15", "scanner": "scanner-primary", "fingerprint": "600d6ac88b5ed06d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a3fab953c6ba8952", "level": "none", "message": {"text": "Commented-code block (6 lines) in admin/components/tab-shell.js:7"}, "properties": {"repobilityId": "93d24ca70e1bd0b2", "scanner": "scanner-primary", "fingerprint": "a3fab953c6ba8952", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3d6848651227182a", "level": "none", "message": {"text": "Commented-code block (5 lines) in admin/components/command-palette.js:13"}, "properties": {"repobilityId": "be9e94cb01b02cc1", "scanner": "scanner-primary", "fingerprint": "3d6848651227182a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-30b10d679898048b", "level": "none", "message": {"text": "Commented-code block (14 lines) in admin/components/toast-undo.js:8"}, "properties": {"repobilityId": "06d545abdd564fd5", "scanner": "scanner-primary", "fingerprint": "30b10d679898048b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6900e81b54d4abc2", "level": "none", "message": {"text": "Commented-code block (6 lines) in admin/pages/zam-spotreba.js:1"}, "properties": {"repobilityId": "c12b5eb59d1153b6", "scanner": "scanner-primary", "fingerprint": "6900e81b54d4abc2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d6475ad6241b7a96", "level": "none", "message": {"text": "Commented-code block (6 lines) in admin/pages/recipes.js:437"}, "properties": {"repobilityId": "d2e7c83eeb904eb2", "scanner": "scanner-primary", "fingerprint": "d6475ad6241b7a96", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5efebdad1e458142", "level": "none", "message": {"text": "Commented-code block (6 lines) in admin/pages/season.js:1"}, "properties": {"repobilityId": "e8f41f52afa0508a", "scanner": "scanner-primary", "fingerprint": "5efebdad1e458142", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9bcfd89a061a7b8b", "level": "none", "message": {"text": "Commented-code block (5 lines) in admin/pages/forecasts.js:1"}, "properties": {"repobilityId": "66d15d781b0509db", "scanner": "scanner-primary", "fingerprint": "9bcfd89a061a7b8b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-64470489f0aa35b1", "level": "none", "message": {"text": "Commented-code block (5 lines) in admin/pages/dashboard.js:424"}, "properties": {"repobilityId": "b1609417710a2dc5", "scanner": "scanner-primary", "fingerprint": "64470489f0aa35b1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5ee1ab9610948950", "level": "none", "message": {"text": "Commented-code block (5 lines) in admin/pages/reports.js:326"}, "properties": {"repobilityId": "83baf664c19d1303", "scanner": "scanner-primary", "fingerprint": "5ee1ab9610948950", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-aa5ecc18a7357800", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 admin/pages/reports.js:937"}, "properties": {"repobilityId": "30671b3735ea2721", "scanner": "scanner-primary", "fingerprint": "aa5ecc18a7357800", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-549d54658fc24de7", "level": "none", "message": {"text": "Commented-code block (7 lines) in admin/pages/dochadzka.js:5"}, "properties": {"repobilityId": "6e95b451a58624ad", "scanner": "scanner-primary", "fingerprint": "549d54658fc24de7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f7a99e3f59a72196", "level": "none", "message": {"text": "Commented-code block (8 lines) in server/app.js:54"}, "properties": {"repobilityId": "c2a9df280a3a015b", "scanner": "scanner-primary", "fingerprint": "f7a99e3f59a72196", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3784cf261579b697", "level": "none", "message": {"text": "Commented-code block (6 lines) in server/server.js:34"}, "properties": {"repobilityId": "9b7de0c6cea4b439", "scanner": "scanner-primary", "fingerprint": "3784cf261579b697", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2e4ca6304f999d9b", "level": "none", "message": {"text": "Commented-code block (7 lines) in server/middleware/idempotency.js:187"}, "properties": {"repobilityId": "fb17b39f5d27524d", "scanner": "scanner-primary", "fingerprint": "2e4ca6304f999d9b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-864014693c2e4438", "level": "none", "message": {"text": "Commented-code block (6 lines) in server/test/lib/order-queries.test.js:1"}, "properties": {"repobilityId": "45a510d09790c346", "scanner": "scanner-primary", "fingerprint": "864014693c2e4438", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c5875dfe5e310867", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/test/lib/offline-queue.test.js:10"}, "properties": {"repobilityId": "2ed5369babfc1b72", "scanner": "scanner-primary", "fingerprint": "c5875dfe5e310867", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4ca6395594662dae", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/test/lib/fiscal-payment.test.js:57"}, "properties": {"repobilityId": "6a78632732580b6c", "scanner": "scanner-primary", "fingerprint": "4ca6395594662dae", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-30b0b3ca6e60a825", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/test/routes/roles.test.js:11"}, "properties": {"repobilityId": "8745703460428ae5", "scanner": "scanner-primary", "fingerprint": "30b0b3ca6e60a825", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a84152923f8b1518", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/test/routes/auth-verify-manager-lockout.test.js:7"}, "properties": {"repobilityId": "42808dc0f8c43ecd", "scanner": "scanner-primary", "fingerprint": "a84152923f8b1518", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7cac0e3274aff941", "level": "note", "message": {"text": "Legacy-named symbol `print_copy` in server/test/routes/payments.portos.test.js:420"}, "properties": {"repobilityId": "55a8ed851d3ba804", "scanner": "scanner-primary", "fingerprint": "7cac0e3274aff941", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d06da25201f0ce37", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/test/routes/auth-lockout.test.js:7"}, "properties": {"repobilityId": "5f67a2b6b978da97", "scanner": "scanner-primary", "fingerprint": "d06da25201f0ce37", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f4d39fcaa6fbe04c", "level": "none", "message": {"text": "Commented-code block (11 lines) in server/test/routes/auth.test.js:8"}, "properties": {"repobilityId": "f0079508f502cf43", "scanner": "scanner-primary", "fingerprint": "f4d39fcaa6fbe04c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e0f5da5645724665", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/test/routes/cashflow.test.js:11"}, "properties": {"repobilityId": "1db783798487fe12", "scanner": "scanner-primary", "fingerprint": "e0f5da5645724665", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-834fd8c25b552f25", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 server/scripts/portos-baud-scan.mjs:34"}, "properties": {"repobilityId": "b279ba93892954f8", "scanner": "scanner-primary", "fingerprint": "834fd8c25b552f25", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e8b3380aad081851", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 server/scripts/portos-printer-test.mjs:15"}, "properties": {"repobilityId": "d27905ddc6ffcd8f", "scanner": "scanner-primary", "fingerprint": "e8b3380aad081851", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0cb3251cadf89140", "level": "none", "message": {"text": "Commented-code block (7 lines) in server/lib/storno-stock.js:5"}, "properties": {"repobilityId": "5ae6fb45adac076c", "scanner": "scanner-primary", "fingerprint": "0cb3251cadf89140", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a97c918a8c219be1", "level": "note", "message": {"text": "Legacy-named symbol `print_copy` in server/lib/portos.js:459"}, "properties": {"repobilityId": "2521dffb1523eb58", "scanner": "scanner-primary", "fingerprint": "a97c918a8c219be1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-58fb80134cec2a1e", "level": "none", "message": {"text": "Commented-code block (12 lines) in server/lib/stock.js:25"}, "properties": {"repobilityId": "654c7ce33c7c2ec8", "scanner": "scanner-primary", "fingerprint": "58fb80134cec2a1e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-910c36c5448ef6cd", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/lib/menu-helpers.js:3"}, "properties": {"repobilityId": "18d287dd60b4cd3b", "scanner": "scanner-primary", "fingerprint": "910c36c5448ef6cd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5a28d02e1a3d7e45", "level": "none", "message": {"text": "Commented-code block (8 lines) in server/lib/backup.js:6"}, "properties": {"repobilityId": "643df2a6d43c798e", "scanner": "scanner-primary", "fingerprint": "5a28d02e1a3d7e45", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2cd91fa16ef50651", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/lib/print/queue.js:118"}, "properties": {"repobilityId": "72a183bdc233235c", "scanner": "scanner-primary", "fingerprint": "2cd91fa16ef50651", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e46e141d50938295", "level": "none", "message": {"text": "Commented-code block (10 lines) in server/lib/print/network.js:9"}, "properties": {"repobilityId": "2bfc5cde95eed9a8", "scanner": "scanner-primary", "fingerprint": "e46e141d50938295", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bd4024b1a2f0f14b", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/lib/print/format.js:1"}, "properties": {"repobilityId": "0938dc4035fac62d", "scanner": "scanner-primary", "fingerprint": "bd4024b1a2f0f14b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ce0aa02e97b7e86e", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/lib/print/tickets.js:28"}, "properties": {"repobilityId": "34459ef9fd476e33", "scanner": "scanner-primary", "fingerprint": "ce0aa02e97b7e86e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e6fd66891440847f", "level": "none", "message": {"text": "Commented-code block (8 lines) in server/lib/print/z-report.js:14"}, "properties": {"repobilityId": "ee210f843abaacb8", "scanner": "scanner-primary", "fingerprint": "e6fd66891440847f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-03652bfca9f7d0c1", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/lib/forecast/ridge.js:1"}, "properties": {"repobilityId": "868f0cd9c88334fb", "scanner": "scanner-primary", "fingerprint": "03652bfca9f7d0c1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-82ce09afb3cf08ae", "level": "none", "message": {"text": "Commented-code block (6 lines) in server/lib/forecast/engine-hourly.js:1"}, "properties": {"repobilityId": "abc26ca9ffe3571c", "scanner": "scanner-primary", "fingerprint": "82ce09afb3cf08ae", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ea898e83284b848c", "level": "none", "message": {"text": "Commented-code block (6 lines) in server/lib/forecast/engine.js:1"}, "properties": {"repobilityId": "09afe3af21d66e61", "scanner": "scanner-primary", "fingerprint": "ea898e83284b848c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c14a57705ab037f7", "level": "none", "message": {"text": "Commented-code block (6 lines) in server/lib/forecast/gbt.js:1"}, "properties": {"repobilityId": "7ca4edd0ddc85a4a", "scanner": "scanner-primary", "fingerprint": "c14a57705ab037f7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-337549899a90cb6d", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/lib/payments/fiscal-storno.js:112"}, "properties": {"repobilityId": "5f0c05a33c5afbc4", "scanner": "scanner-primary", "fingerprint": "337549899a90cb6d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e802b8dbe16ac897", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/lib/payments/history.js:10"}, "properties": {"repobilityId": "5accebc8f735b3d1", "scanner": "scanner-primary", "fingerprint": "e802b8dbe16ac897", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ee9607fbe3ba6ea2", "level": "none", "message": {"text": "Commented-code block (7 lines) in server/lib/payments/create.js:109"}, "properties": {"repobilityId": "beba992a44e2da0a", "scanner": "scanner-primary", "fingerprint": "ee9607fbe3ba6ea2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-06e52261f786b4fe", "level": "none", "message": {"text": "Commented-code block (7 lines) in server/lib/payments/change-method.js:30"}, "properties": {"repobilityId": "4fd943fcddce9687", "scanner": "scanner-primary", "fingerprint": "06e52261f786b4fe", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e6ba39aefccab574", "level": "none", "message": {"text": "Commented-code block (11 lines) in server/lib/reports/weekly.js:189"}, "properties": {"repobilityId": "8d9cfc4fcd155de0", "scanner": "scanner-primary", "fingerprint": "e6ba39aefccab574", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0d67264ac5efe955", "level": "none", "message": {"text": "Commented-code block (6 lines) in server/lib/reports/forecasts.js:5"}, "properties": {"repobilityId": "bcca1c4d0ead8467", "scanner": "scanner-primary", "fingerprint": "0d67264ac5efe955", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2026ebd202506039", "level": "none", "message": {"text": "Commented-code block (8 lines) in server/lib/reports/z-report.js:131"}, "properties": {"repobilityId": "db58702ac2d8777e", "scanner": "scanner-primary", "fingerprint": "2026ebd202506039", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-19c3abe11b56bea3", "level": "none", "message": {"text": "Commented-code block (6 lines) in server/lib/reports/summary.js:7"}, "properties": {"repobilityId": "1bd8457ba4ed91fa", "scanner": "scanner-primary", "fingerprint": "19c3abe11b56bea3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8f792c4eeb5fe350", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/routes/storno-basket.js:162"}, "properties": {"repobilityId": "c272532f17628b67", "scanner": "scanner-primary", "fingerprint": "8f792c4eeb5fe350", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9b144c1faa7470ca", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/routes/staff.js:12"}, "properties": {"repobilityId": "db6a55d917bfa30a", "scanner": "scanner-primary", "fingerprint": "9b144c1faa7470ca", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b6fc8251ed8c0093", "level": "none", "message": {"text": "Commented-code block (6 lines) in server/routes/orders.js:62"}, "properties": {"repobilityId": "0d08d9c92e0f3f66", "scanner": "scanner-primary", "fingerprint": "b6fc8251ed8c0093", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f35137f28eb330f0", "level": "none", "message": {"text": "Commented-code block (7 lines) in server/routes/attendance.js:106"}, "properties": {"repobilityId": "b2bd3d05cc99c00d", "scanner": "scanner-primary", "fingerprint": "f35137f28eb330f0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5b69ef7c79aed971", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 server/routes/ttlock.js:47"}, "properties": {"repobilityId": "287faa8c413a39b4", "scanner": "scanner-primary", "fingerprint": "5b69ef7c79aed971", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2677ec4e2d56fd46", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/routes/paragons.js:5"}, "properties": {"repobilityId": "a2ed6aad90301af3", "scanner": "scanner-primary", "fingerprint": "2677ec4e2d56fd46", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-55dd8fb466c26d00", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/routes/menu.js:91"}, "properties": {"repobilityId": "631e368b20177f35", "scanner": "scanner-primary", "fingerprint": "55dd8fb466c26d00", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a0506d341c60a1d7", "level": "none", "message": {"text": "Commented-code block (6 lines) in server/routes/auth.js:13"}, "properties": {"repobilityId": "1198352aa4e43bad", "scanner": "scanner-primary", "fingerprint": "a0506d341c60a1d7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-46c09c34e6c7055f", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/routes/inventory.js:187"}, "properties": {"repobilityId": "b32d4d2513173159", "scanner": "scanner-primary", "fingerprint": "46c09c34e6c7055f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c98539d93cd0c29d", "level": "none", "message": {"text": "Commented-code block (7 lines) in server/routes/public-menu.js:1"}, "properties": {"repobilityId": "2e89f8fd40e2c4d2", "scanner": "scanner-primary", "fingerprint": "c98539d93cd0c29d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-17750030d4609cf6", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/db/schema.js:58"}, "properties": {"repobilityId": "e44e22a67fbc531e", "scanner": "scanner-primary", "fingerprint": "17750030d4609cf6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ed05ec59eedcee24", "level": "none", "message": {"text": "Commented-code block (6 lines) in server/db/index.js:6"}, "properties": {"repobilityId": "fa3e63fc1c9c9b69", "scanner": "scanner-primary", "fingerprint": "ed05ec59eedcee24", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-03351f90bf5e0398", "level": "none", "message": {"text": "Commented-code block (6 lines) in server/schemas/cashflow.js:22"}, "properties": {"repobilityId": "f0eee2cc8b9a91cc", "scanner": "scanner-primary", "fingerprint": "03351f90bf5e0398", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a9f20de79300a322", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/schemas/orders.js:45"}, "properties": {"repobilityId": "d1889b0d50d01803", "scanner": "scanner-primary", "fingerprint": "a9f20de79300a322", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9a82cf7d16234d20", "level": "note", "message": {"text": "21 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "2fad2cbef136ee78", "scanner": "scanner-primary", "fingerprint": "9a82cf7d16234d20", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-e0a6331f644c3c5d", "level": "error", "message": {"text": "Dangling fetch: POST /auth/verify-manager (js/pos-payments.js:1000)"}, "properties": {"repobilityId": "57d15467286ac47e", "scanner": "scanner-primary", "fingerprint": "e0a6331f644c3c5d", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "helper:request"]}}, {"ruleId": "scanner-394137dd7964eb60", "level": "error", "message": {"text": "Dangling fetch: GET http://localhost:${process.env.PORT || 3080}/api/reports/z-report?date=${date} (server/lib/print/z-report.js:29)"}, "properties": {"repobilityId": "56919f9b0c3c2bfd", "scanner": "scanner-primary", "fingerprint": "394137dd7964eb60", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-29e0ed54344aaa81", "level": "note", "message": {"text": "Unused endpoint: GET /menu"}, "properties": {"repobilityId": "568847bf7dd2031e", "scanner": "scanner-primary", "fingerprint": "29e0ed54344aaa81", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a41f2c569e37ab27", "level": "note", "message": {"text": "Unused endpoint: GET /integrations/portos/status"}, "properties": {"repobilityId": "b1b7d1c20a14e376", "scanner": "scanner-primary", "fingerprint": "a41f2c569e37ab27", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8c028f07b4f30d25", "level": "note", "message": {"text": "Unused endpoint: GET /company-profile"}, "properties": {"repobilityId": "ac84cf87895ee2d7", "scanner": "scanner-primary", "fingerprint": "8c028f07b4f30d25", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e10e11b828e863ca", "level": "note", "message": {"text": "Unused endpoint: PUT /company-profile"}, "properties": {"repobilityId": "0725d801f57c794e", "scanner": "scanner-primary", "fingerprint": "e10e11b828e863ca", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6632fc77007169f4", "level": "note", "message": {"text": "Unused endpoint: GET /company-profile/portos-compare"}, "properties": {"repobilityId": "e68ca518a3b1c0e8", "scanner": "scanner-primary", "fingerprint": "6632fc77007169f4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-40a386b4b2d770dd", "level": "note", "message": {"text": "Unused endpoint: POST /company-profile/sync-from-portos"}, "properties": {"repobilityId": "ef25aa70ad703317", "scanner": "scanner-primary", "fingerprint": "40a386b4b2d770dd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f1057abb810cb8eb", "level": "note", "message": {"text": "Unused endpoint: GET /fiscal-documents/search?"}, "properties": {"repobilityId": "d160008d5ddf8e24", "scanner": "scanner-primary", "fingerprint": "f1057abb810cb8eb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cb8357a946e81357", "level": "note", "message": {"text": "Unused endpoint: GET /fiscal-documents/"}, "properties": {"repobilityId": "a56af351164b1c29", "scanner": "scanner-primary", "fingerprint": "cb8357a946e81357", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-afa5516c58014335", "level": "note", "message": {"text": "Unused endpoint: POST /fiscal-documents/"}, "properties": {"repobilityId": "0a6a553767f6f411", "scanner": "scanner-primary", "fingerprint": "afa5516c58014335", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-72a9fcbdf7c4dc6b", "level": "note", "message": {"text": "Unused endpoint: GET /payments/history"}, "properties": {"repobilityId": "2f3e1ea358c4220f", "scanner": "scanner-primary", "fingerprint": "72a9fcbdf7c4dc6b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e34e63a60724fcb4", "level": "note", "message": {"text": "Unused endpoint: POST /payments/"}, "properties": {"repobilityId": "690401949ad0964c", "scanner": "scanner-primary", "fingerprint": "e34e63a60724fcb4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5aaed4fa45b14d40", "level": "note", "message": {"text": "Unused endpoint: GET /payments/"}, "properties": {"repobilityId": "01e7aeff9dd5deaf", "scanner": "scanner-primary", "fingerprint": "5aaed4fa45b14d40", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e1a48f00748448a3", "level": "note", "message": {"text": "Unused endpoint: POST /print/kitchen"}, "properties": {"repobilityId": "26181e12f4736eab", "scanner": "scanner-primary", "fingerprint": "e1a48f00748448a3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a906f2342eee71df", "level": "note", "message": {"text": "Unused endpoint: POST /orders/"}, "properties": {"repobilityId": "54f7a744aa84d1bb", "scanner": "scanner-primary", "fingerprint": "a906f2342eee71df", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d962920df8b2c26a", "level": "note", "message": {"text": "Unused endpoint: POST /paragons"}, "properties": {"repobilityId": "cbdfd4e070d4f27a", "scanner": "scanner-primary", "fingerprint": "d962920df8b2c26a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6ae361e8dba69f15", "level": "note", "message": {"text": "Unused endpoint: POST /print/paragon"}, "properties": {"repobilityId": "a2dfdc3ece76cb31", "scanner": "scanner-primary", "fingerprint": "6ae361e8dba69f15", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e5006457a4f69d46", "level": "note", "message": {"text": "Unused endpoint: POST /payments"}, "properties": {"repobilityId": "a7ec6956a603266c", "scanner": "scanner-primary", "fingerprint": "e5006457a4f69d46", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bfd52c9c80ecb887", "level": "note", "message": {"text": "Unused endpoint: POST /print/pre-bill"}, "properties": {"repobilityId": "cb46f7f9ec4716bf", "scanner": "scanner-primary", "fingerprint": "bfd52c9c80ecb887", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fb1b0d2870d2a808", "level": "note", "message": {"text": "Unused endpoint: POST /ttlock/passcode"}, "properties": {"repobilityId": "d7ef561afbbf7d43", "scanner": "scanner-primary", "fingerprint": "fb1b0d2870d2a808", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5fca3d9619754e6b", "level": "note", "message": {"text": "Unused endpoint: POST /print/lockcode"}, "properties": {"repobilityId": "469a8c85822437d3", "scanner": "scanner-primary", "fingerprint": "5fca3d9619754e6b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-57d57804b276920c", "level": "note", "message": {"text": "Unused endpoint: GET /tables"}, "properties": {"repobilityId": "a324ceb68aad4adc", "scanner": "scanner-primary", "fingerprint": "57d57804b276920c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0d92a33bc30aa57c", "level": "note", "message": {"text": "Unused endpoint: GET /shifts/current"}, "properties": {"repobilityId": "350645c218e260a8", "scanner": "scanner-primary", "fingerprint": "0d92a33bc30aa57c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-17feda489b5e2a42", "level": "note", "message": {"text": "Unused endpoint: POST /shifts/open"}, "properties": {"repobilityId": "5750bed17450d32e", "scanner": "scanner-primary", "fingerprint": "17feda489b5e2a42", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd7f4a53a317aa35", "level": "note", "message": {"text": "Unused endpoint: GET /shifts/current/summary"}, "properties": {"repobilityId": "747667d6540aac9a", "scanner": "scanner-primary", "fingerprint": "fd7f4a53a317aa35", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6d2603f94b3036f9", "level": "note", "message": {"text": "Unused endpoint: POST /shifts/close"}, "properties": {"repobilityId": "8064e42507df6fc4", "scanner": "scanner-primary", "fingerprint": "6d2603f94b3036f9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-210649ca48864e6a", "level": "note", "message": {"text": "Unused endpoint: GET /reports/z-report?date="}, "properties": {"repobilityId": "1285e83e819b6556", "scanner": "scanner-primary", "fingerprint": "210649ca48864e6a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-10a603206383c132", "level": "note", "message": {"text": "Unused endpoint: GET /storno-basket"}, "properties": {"repobilityId": "d03ed75257cd432a", "scanner": "scanner-primary", "fingerprint": "10a603206383c132", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0df69fa38bf271f0", "level": "note", "message": {"text": "Unused endpoint: GET /zones"}, "properties": {"repobilityId": "b4afbdd37c071979", "scanner": "scanner-primary", "fingerprint": "0df69fa38bf271f0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0328e9bdbb61fa68", "level": "note", "message": {"text": "Unused endpoint: GET /orders"}, "properties": {"repobilityId": "de886eca2be277fb", "scanner": "scanner-primary", "fingerprint": "0328e9bdbb61fa68", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4f78697ee86646f7", "level": "note", "message": {"text": "Unused endpoint: GET /orders/table/"}, "properties": {"repobilityId": "49f6490750389f8e", "scanner": "scanner-primary", "fingerprint": "4f78697ee86646f7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e8bb2bc0a5072575", "level": "note", "message": {"text": "Unused endpoint: PUT /tables/"}, "properties": {"repobilityId": "0900e26678fb27d4", "scanner": "scanner-primary", "fingerprint": "e8bb2bc0a5072575", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-988262c12d31b479", "level": "note", "message": {"text": "Unused endpoint: POST /orders"}, "properties": {"repobilityId": "44c30a7900b0b9d3", "scanner": "scanner-primary", "fingerprint": "988262c12d31b479", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4b83850743dac652", "level": "note", "message": {"text": "Unused endpoint: PUT /orders/"}, "properties": {"repobilityId": "c0b6fa1b5b9ad17d", "scanner": "scanner-primary", "fingerprint": "4b83850743dac652", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e0b82c0ee4a9f4ce", "level": "note", "message": {"text": "Unused endpoint: POST /storno-basket/"}, "properties": {"repobilityId": "c04f771df89ee0cd", "scanner": "scanner-primary", "fingerprint": "e0b82c0ee4a9f4ce", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8e9c025148fc40c6", "level": "note", "message": {"text": "Unused endpoint: GET /discounts"}, "properties": {"repobilityId": "8740425d04e1515c", "scanner": "scanner-primary", "fingerprint": "8e9c025148fc40c6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1cbe2b0464f31c3d", "level": "note", "message": {"text": "Unused endpoint: POST /storno-basket"}, "properties": {"repobilityId": "a11d40b4cda58c78", "scanner": "scanner-primary", "fingerprint": "1cbe2b0464f31c3d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-44360851685c3679", "level": "note", "message": {"text": "Unused endpoint: GET /cashflow/summary?"}, "properties": {"repobilityId": "bfd0ce93b6f31d14", "scanner": "scanner-primary", "fingerprint": "44360851685c3679", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f2789b56851c1d6e", "level": "note", "message": {"text": "Unused endpoint: GET /cashflow?"}, "properties": {"repobilityId": "e0d7cb77ef8dcc4e", "scanner": "scanner-primary", "fingerprint": "f2789b56851c1d6e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-89fc9ea6e7a0aa7c", "level": "note", "message": {"text": "Unused endpoint: PATCH /cashflow/"}, "properties": {"repobilityId": "6515d7eec8b26c67", "scanner": "scanner-primary", "fingerprint": "89fc9ea6e7a0aa7c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e3afbb03fcaf6a78", "level": "note", "message": {"text": "Unused endpoint: POST /cashflow"}, "properties": {"repobilityId": "7a15a606247fa366", "scanner": "scanner-primary", "fingerprint": "e3afbb03fcaf6a78", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-02dfdc80cd527b2b", "level": "note", "message": {"text": "Unused endpoint: GET /inventory/suppliers"}, "properties": {"repobilityId": "0c6c5a53e7834b51", "scanner": "scanner-primary", "fingerprint": "02dfdc80cd527b2b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b0618e1d5bfecabb", "level": "note", "message": {"text": "Unused endpoint: GET /printers"}, "properties": {"repobilityId": "8e75b26369223e98", "scanner": "scanner-primary", "fingerprint": "b0618e1d5bfecabb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-30fedd8cd7a57475", "level": "note", "message": {"text": "Unused endpoint: PUT /printers/"}, "properties": {"repobilityId": "c633bc7c6a9dbe3a", "scanner": "scanner-primary", "fingerprint": "30fedd8cd7a57475", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ed0b25a9205e793e", "level": "note", "message": {"text": "Unused endpoint: POST /printers"}, "properties": {"repobilityId": "c771c5b3d5aef190", "scanner": "scanner-primary", "fingerprint": "ed0b25a9205e793e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-65b7615b17f22b5a", "level": "note", "message": {"text": "Unused endpoint: POST /printers/"}, "properties": {"repobilityId": "9442a94099905115", "scanner": "scanner-primary", "fingerprint": "65b7615b17f22b5a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ec4643c62a5bb024", "level": "note", "message": {"text": "Unused endpoint: GET /discounts/all"}, "properties": {"repobilityId": "078bbbf19f65729c", "scanner": "scanner-primary", "fingerprint": "ec4643c62a5bb024", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3ae9f622bf34e0d8", "level": "note", "message": {"text": "Unused endpoint: POST /discounts"}, "properties": {"repobilityId": "9c29dc99b6aa1d4a", "scanner": "scanner-primary", "fingerprint": "3ae9f622bf34e0d8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-12263013181171e6", "level": "note", "message": {"text": "Unused endpoint: PUT /discounts/"}, "properties": {"repobilityId": "edd8349d244a4e55", "scanner": "scanner-primary", "fingerprint": "12263013181171e6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-82cdc135da43090a", "level": "note", "message": {"text": "Unused endpoint: GET /reports/weekly?from="}, "properties": {"repobilityId": "f63e6abd84a28e8f", "scanner": "scanner-primary", "fingerprint": "82cdc135da43090a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a64f07011aae2a89", "level": "note", "message": {"text": "Unused endpoint: GET /reports/weather?from="}, "properties": {"repobilityId": "15b76e88b31ae12a", "scanner": "scanner-primary", "fingerprint": "a64f07011aae2a89", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}