{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-24f9e1df3604a18e", "name": "Possibly dead Python function: discover_package", "shortDescription": {"text": "Possibly dead Python function: discover_package"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11d1510c0fab27b9", "name": "Possibly dead Python function: patched_calculate", "shortDescription": {"text": "Possibly dead Python function: patched_calculate"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-94fd73b332f84ec1", "name": "Possibly dead Python function: patched", "shortDescription": {"text": "Possibly dead Python function: patched"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cd52a7fb2006e213", "name": "Possibly dead Python function: resolve_npm_repo", "shortDescription": {"text": "Possibly dead Python function: resolve_npm_repo"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-89dff427cef993f8", "name": "Possibly dead Python function: resolve_pypi_repo", "shortDescription": {"text": "Possibly dead Python function: resolve_pypi_repo"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-912eb46e275562d9", "name": "Possibly dead Python function: resolve_rubygems_repo", "shortDescription": {"text": "Possibly dead Python function: resolve_rubygems_repo"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e600a8047fdfbbb9", "name": "Possibly dead Python function: resolve_cargo_repo", "shortDescription": {"text": "Possibly dead Python function: resolve_cargo_repo"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5a7235e5a2bc1071", "name": "Possibly dead Python function: resolve_packagist_repo", "shortDescription": {"text": "Possibly dead Python function: resolve_packagist_repo"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-628181e74b5c60b5", "name": "Possibly dead Python function: resolve_nuget_repo", "shortDescription": {"text": "Possibly dead Python function: resolve_nuget_repo"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e9d5727b9d4e01d0", "name": "Possibly dead Python function: resolve_go_repo", "shortDescription": {"text": "Possibly dead Python function: resolve_go_repo"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6df42d829259a4fa", "name": "Possibly dead Python function: version_callback", "shortDescription": {"text": "Possibly dead Python function: version_callback"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c5907408c179c91", "name": "Possibly dead Python function: fetch_npm", "shortDescription": {"text": "Possibly dead Python function: fetch_npm"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6ac6bd33df778be7", "name": "Possibly dead Python function: fetch_pypi", "shortDescription": {"text": "Possibly dead Python function: fetch_pypi"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9ddeb25f831d512e", "name": "Possibly dead Python function: fetch_cargo", "shortDescription": {"text": "Possibly dead Python function: fetch_cargo"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f79987ff29ff5333", "name": "Possibly dead Python function: fetch_rubygems", "shortDescription": {"text": "Possibly dead Python function: fetch_rubygems"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d81f6d98a0df209", "name": "Possibly dead Python function: fetch_go", "shortDescription": {"text": "Possibly dead Python function: fetch_go"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-32fc4f44c6c2afc2", "name": "Possibly dead Python function: fetch_packagist", "shortDescription": {"text": "Possibly dead Python function: fetch_packagist"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-79dc479d60da6cfa", "name": "Possibly dead Python function: fetch_nuget", "shortDescription": {"text": "Possibly dead Python function: fetch_nuget"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6ed2ef3e450934c2", "name": "Possibly dead Python function: fetch_github", "shortDescription": {"text": "Possibly dead Python function: fetch_github"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-268e08c8dce72741", "name": "Possibly dead Python function: risk_dot", "shortDescription": {"text": "Possibly dead Python function: risk_dot"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3606472974b3bccf", "name": "Possibly dead Python function: update_progress", "shortDescription": {"text": "Possibly dead Python function: update_progress"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-26cb24e858d3fc80", "name": "Possibly dead Python function: is_available", "shortDescription": {"text": "Possibly dead Python function: is_available"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3c10b2b8ed5e4c98", "name": "Possibly dead Python function: is_available", "shortDescription": {"text": "Possibly dead Python function: is_available"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-34cf9b3e05a5d3df", "name": "Possibly dead Python function: is_available", "shortDescription": {"text": "Possibly dead Python function: is_available"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cd2e344e658dd92e", "name": "Possibly dead Python function: is_available", "shortDescription": {"text": "Possibly dead Python function: is_available"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1928460043c7f6fc", "name": "Possibly dead Python function: is_available", "shortDescription": {"text": "Possibly dead Python function: is_available"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4f2aef919efea69e", "name": "Possible secret in .env.example", "shortDescription": {"text": "Possible secret in .env.example"}, "fullDescription": {"text": "Detected pattern matching github_token. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-6d1af2a2d0109b98", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-948ddd46248e973b", "name": "Very large file: tests/test_repo_cache.py (1788 lines)", "shortDescription": {"text": "Very large file: tests/test_repo_cache.py (1788 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-26b9e92ca8cafa7f", "name": "Very large file: scripts/validate.py (2682 lines)", "shortDescription": {"text": "Very large file: scripts/validate.py (2682 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8fb66ebe91b846b4", "name": "Very large file: src/ossuary/cli.py (3505 lines)", "shortDescription": {"text": "Very large file: src/ossuary/cli.py (3505 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e6d2f0f34f99d0f8", "name": "Very large file: src/ossuary/services/scorer.py (1494 lines)", "shortDescription": {"text": "Very large file: src/ossuary/services/scorer.py (1494 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 189 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 13 placeholder/mock markers across 5 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2679282aa1c484b5", "name": "Agent authority lacks a verifier contract: AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e4a8bed351f49008", "name": "Commented-code block (6 lines) in tests/test_sentiment.py:206", "shortDescription": {"text": "Commented-code block (6 lines) in tests/test_sentiment.py:206"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3f9bf9c8bd8fd79f", "name": "Commented-code block (6 lines) in tests/test_scoring.py:317", "shortDescription": {"text": "Commented-code block (6 lines) in tests/test_scoring.py:317"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-36bc40f23f3c783a", "name": "Commented-code block (5 lines) in tests/test_doc_code_drift.py:552", "shortDescription": {"text": "Commented-code block (5 lines) in tests/test_doc_code_drift.py:552"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d1e77c3549833d48", "name": "Commented-code block (10 lines) in scripts/validate.py:67", "shortDescription": {"text": "Commented-code block (10 lines) in scripts/validate.py:67"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e066ff3f0d111c0f", "name": "Commented-code block (5 lines) in scripts/migrate_scores_nullable.py:73", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/migrate_scores_nullable.py:73"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-127b9ce2dee34c4d", "name": "Blocking `time.sleep(...)` inside `async def main` \u2014 scripts/scorecard_compare.py:261", "shortDescription": {"text": "Blocking `time.sleep(...)` inside `async def main` \u2014 scripts/scorecard_compare.py:261"}, "fullDescription": {"text": "Sync I/O inside an async function blocks the event loop. While `time.sleep(...)` is running, *all* other coroutines on this loop are paused \u2014 silent throughput collapse under concurrency. Use the async equivalent (`httpx.AsyncClient`, `asyncio.sleep`, `aiofiles`) or wrap with `await asyncio.to_thread(...)`."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e5f54f7e5dc1ec89", "name": "Commented-code block (5 lines) in src/ossuary/cli.py:832", "shortDescription": {"text": "Commented-code block (5 lines) in src/ossuary/cli.py:832"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3ce739f53dad04d7", "name": "Network/subprocess call without timeout or try/except \u2014 src/ossuary/cli.py:68", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 src/ossuary/cli.py:68"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-76d03cb825ef8339", "name": "Commented-code block (8 lines) in src/ossuary/dashboard/utils.py:17", "shortDescription": {"text": "Commented-code block (8 lines) in src/ossuary/dashboard/utils.py:17"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ed063118fb61c327", "name": "Commented-code block (5 lines) in src/ossuary/dashboard/pages/4_Methodology.py:111", "shortDescription": {"text": "Commented-code block (5 lines) in src/ossuary/dashboard/pages/4_Methodology.py:111"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-debb110351276104", "name": "Commented-code block (7 lines) in src/ossuary/scoring/reputation.py:75", "shortDescription": {"text": "Commented-code block (7 lines) in src/ossuary/scoring/reputation.py:75"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-399977cc91dfdb74", "name": "Commented-code block (14 lines) in src/ossuary/scoring/factors.py:195", "shortDescription": {"text": "Commented-code block (14 lines) in src/ossuary/scoring/factors.py:195"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ee3871f9b3c5429e", "name": "Commented-code block (8 lines) in src/ossuary/scoring/engine.py:129", "shortDescription": {"text": "Commented-code block (8 lines) in src/ossuary/scoring/engine.py:129"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3f35c0f1c413d775", "name": "Commented-code block (5 lines) in src/ossuary/collectors/git.py:184", "shortDescription": {"text": "Commented-code block (5 lines) in src/ossuary/collectors/git.py:184"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7415d2dfcf3fd3c0", "name": "Commented-code block (5 lines) in src/ossuary/collectors/github.py:105", "shortDescription": {"text": "Commented-code block (5 lines) in src/ossuary/collectors/github.py:105"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3e86f27d9c54fb5d", "name": "Commented-code block (7 lines) in src/ossuary/collectors/pypi.py:42", "shortDescription": {"text": "Commented-code block (7 lines) in src/ossuary/collectors/pypi.py:42"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4ced67fe67b7ffca", "name": "Commented-code block (5 lines) in src/ossuary/collectors/registries.py:225", "shortDescription": {"text": "Commented-code block (5 lines) in src/ossuary/collectors/registries.py:225"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-26ad569db4676295", "name": "Commented-code block (5 lines) in src/ossuary/db/session.py:62", "shortDescription": {"text": "Commented-code block (5 lines) in src/ossuary/db/session.py:62"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-88e39a9435b7b816", "name": "Commented-code block (7 lines) in src/ossuary/db/models.py:55", "shortDescription": {"text": "Commented-code block (7 lines) in src/ossuary/db/models.py:55"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-085e28a6d32c81ee", "name": "Commented-code block (5 lines) in src/ossuary/sentiment/analyzer.py:57", "shortDescription": {"text": "Commented-code block (5 lines) in src/ossuary/sentiment/analyzer.py:57"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-51b3992a289201d5", "name": "Commented-code block (8 lines) in src/ossuary/services/batch.py:33", "shortDescription": {"text": "Commented-code block (8 lines) in src/ossuary/services/batch.py:33"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e6cbb6adb0b2efef", "name": "Commented-code block (5 lines) in src/ossuary/services/repo_cache.py:62", "shortDescription": {"text": "Commented-code block (5 lines) in src/ossuary/services/repo_cache.py:62"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-81e8adfc8aa5aa0f", "name": "Commented-code block (8 lines) in src/ossuary/services/scorer.py:127", "shortDescription": {"text": "Commented-code block (8 lines) in src/ossuary/services/scorer.py:127"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-319e66a630e14977", "name": "2 env vars used in code but missing from .env.example", "shortDescription": {"text": "2 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `OSSUARY_CACHE_DAYS`, `PYPI_TOKEN`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscripts/migrate_provisional_column.py:migrate, scripts/migrate_scores_nullable.py:migrate\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/ossuary/collectors/npm.py:close, src/ossuary/collectors/github.py:close, src/ossuary/collectors/pypi.py:close\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02525d39071dd2c7", "name": "Near-duplicate function bodies in 5 places", "shortDescription": {"text": "Near-duplicate function bodies in 5 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsrc/ossuary/collectors/registries.py:is_available, src/ossuary/collectors/registries.py:is_available, src/ossuary/collectors/registries.py:is_available, src/ossuary/collectors/registries.py:is_available\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24213"}, "properties": {"repository": "anicka-net/ossuary-risk", "repoUrl": "https://github.com/anicka-net/ossuary-risk", "branch": "main"}, "results": [{"ruleId": "scanner-24f9e1df3604a18e", "level": "note", "message": {"text": "Possibly dead Python function: discover_package"}, "properties": {"repobilityId": "34d9307bf798e014", "scanner": "scanner-primary", "fingerprint": "24f9e1df3604a18e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/discover_suse.py:243"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-11d1510c0fab27b9", "level": "note", "message": {"text": "Possibly dead Python function: patched_calculate"}, "properties": {"repobilityId": "c94b9fcd2d84d25f", "scanner": "scanner-primary", "fingerprint": "11d1510c0fab27b9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/sweep_maturity.py:113"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-94fd73b332f84ec1", "level": "note", "message": {"text": "Possibly dead Python function: patched"}, "properties": {"repobilityId": "c36f09674ca3f6ed", "scanner": "scanner-primary", "fingerprint": "94fd73b332f84ec1", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/ablation.py:95"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cd52a7fb2006e213", "level": "note", "message": {"text": "Possibly dead Python function: resolve_npm_repo"}, "properties": {"repobilityId": "99ec3d5e3ff3686a", "scanner": "scanner-primary", "fingerprint": "cd52a7fb2006e213", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/scorecard_compare.py:34"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-89dff427cef993f8", "level": "note", "message": {"text": "Possibly dead Python function: resolve_pypi_repo"}, "properties": {"repobilityId": "64eef33f95ef6d85", "scanner": "scanner-primary", "fingerprint": "89dff427cef993f8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/scorecard_compare.py:51"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-912eb46e275562d9", "level": "note", "message": {"text": "Possibly dead Python function: resolve_rubygems_repo"}, "properties": {"repobilityId": "ed74807f6c91043f", "scanner": "scanner-primary", "fingerprint": "912eb46e275562d9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/scorecard_compare.py:75"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e600a8047fdfbbb9", "level": "note", "message": {"text": "Possibly dead Python function: resolve_cargo_repo"}, "properties": {"repobilityId": "ec3da181721ae223", "scanner": "scanner-primary", "fingerprint": "e600a8047fdfbbb9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/scorecard_compare.py:93"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5a7235e5a2bc1071", "level": "note", "message": {"text": "Possibly dead Python function: resolve_packagist_repo"}, "properties": {"repobilityId": "97dc7b39e3dc7933", "scanner": "scanner-primary", "fingerprint": "5a7235e5a2bc1071", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/scorecard_compare.py:109"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-628181e74b5c60b5", "level": "note", "message": {"text": "Possibly dead Python function: resolve_nuget_repo"}, "properties": {"repobilityId": "d3005c8552f11e10", "scanner": "scanner-primary", "fingerprint": "628181e74b5c60b5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/scorecard_compare.py:127"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e9d5727b9d4e01d0", "level": "note", "message": {"text": "Possibly dead Python function: resolve_go_repo"}, "properties": {"repobilityId": "529cec0705de8b4a", "scanner": "scanner-primary", "fingerprint": "e9d5727b9d4e01d0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/scorecard_compare.py:153"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6df42d829259a4fa", "level": "note", "message": {"text": "Possibly dead Python function: version_callback"}, "properties": {"repobilityId": "29bbc1b0b3de41cf", "scanner": "scanner-primary", "fingerprint": "6df42d829259a4fa", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ossuary/cli.py:31"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7c5907408c179c91", "level": "note", "message": {"text": "Possibly dead Python function: fetch_npm"}, "properties": {"repobilityId": "6c25d2cfc6ad72f5", "scanner": "scanner-primary", "fingerprint": "7c5907408c179c91", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ossuary/cli.py:2112"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6ac6bd33df778be7", "level": "note", "message": {"text": "Possibly dead Python function: fetch_pypi"}, "properties": {"repobilityId": "9ccf221957edcb57", "scanner": "scanner-primary", "fingerprint": "6ac6bd33df778be7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ossuary/cli.py:2122"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9ddeb25f831d512e", "level": "note", "message": {"text": "Possibly dead Python function: fetch_cargo"}, "properties": {"repobilityId": "bae96d77b3070f48", "scanner": "scanner-primary", "fingerprint": "9ddeb25f831d512e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ossuary/cli.py:2141"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f79987ff29ff5333", "level": "note", "message": {"text": "Possibly dead Python function: fetch_rubygems"}, "properties": {"repobilityId": "5b333c9ee3668ba2", "scanner": "scanner-primary", "fingerprint": "f79987ff29ff5333", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ossuary/cli.py:2158"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4d81f6d98a0df209", "level": "note", "message": {"text": "Possibly dead Python function: fetch_go"}, "properties": {"repobilityId": "f575378fb54e399a", "scanner": "scanner-primary", "fingerprint": "4d81f6d98a0df209", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ossuary/cli.py:2174"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-32fc4f44c6c2afc2", "level": "note", "message": {"text": "Possibly dead Python function: fetch_packagist"}, "properties": {"repobilityId": "4f8c0094bda95a23", "scanner": "scanner-primary", "fingerprint": "32fc4f44c6c2afc2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ossuary/cli.py:2209"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-79dc479d60da6cfa", "level": "note", "message": {"text": "Possibly dead Python function: fetch_nuget"}, "properties": {"repobilityId": "2fd2a328ca29e3ed", "scanner": "scanner-primary", "fingerprint": "79dc479d60da6cfa", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ossuary/cli.py:2223"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6ed2ef3e450934c2", "level": "note", "message": {"text": "Possibly dead Python function: fetch_github"}, "properties": {"repobilityId": "22a954475aa97a4d", "scanner": "scanner-primary", "fingerprint": "6ed2ef3e450934c2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ossuary/cli.py:2245"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-268e08c8dce72741", "level": "note", "message": {"text": "Possibly dead Python function: risk_dot"}, "properties": {"repobilityId": "2159beef7c9a4163", "scanner": "scanner-primary", "fingerprint": "268e08c8dce72741", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ossuary/dashboard/utils.py:91"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3606472974b3bccf", "level": "note", "message": {"text": "Possibly dead Python function: update_progress"}, "properties": {"repobilityId": "00877585aa2a12d8", "scanner": "scanner-primary", "fingerprint": "3606472974b3bccf", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ossuary/dashboard/pages/2_Package.py:439"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-26cb24e858d3fc80", "level": "note", "message": {"text": "Possibly dead Python function: is_available"}, "properties": {"repobilityId": "19896608512daf00", "scanner": "scanner-primary", "fingerprint": "26cb24e858d3fc80", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ossuary/collectors/git.py:154"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3c10b2b8ed5e4c98", "level": "note", "message": {"text": "Possibly dead Python function: is_available"}, "properties": {"repobilityId": "19896608512daf00", "scanner": "scanner-primary", "fingerprint": "3c10b2b8ed5e4c98", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ossuary/collectors/npm.py:65"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-34cf9b3e05a5d3df", "level": "note", "message": {"text": "Possibly dead Python function: is_available"}, "properties": {"repobilityId": "19896608512daf00", "scanner": "scanner-primary", "fingerprint": "34cf9b3e05a5d3df", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ossuary/collectors/github.py:241"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cd2e344e658dd92e", "level": "note", "message": {"text": "Possibly dead Python function: is_available"}, "properties": {"repobilityId": "19896608512daf00", "scanner": "scanner-primary", "fingerprint": "cd2e344e658dd92e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ossuary/collectors/pypi.py:66"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1928460043c7f6fc", "level": "note", "message": {"text": "Possibly dead Python function: is_available"}, "properties": {"repobilityId": "19896608512daf00", "scanner": "scanner-primary", "fingerprint": "1928460043c7f6fc", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ossuary/collectors/registries.py:441"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4f2aef919efea69e", "level": "error", "message": {"text": "Possible secret in .env.example"}, "properties": {"repobilityId": "438da6b46bbaef14", "scanner": "scanner-primary", "fingerprint": "4f2aef919efea69e", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".env.example"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-6d1af2a2d0109b98", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5f9271709a05da10", "scanner": "scanner-primary", "fingerprint": "6d1af2a2d0109b98", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ossuary-scan.yml"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-948ddd46248e973b", "level": "note", "message": {"text": "Very large file: tests/test_repo_cache.py (1788 lines)"}, "properties": {"repobilityId": "394da46faad9d653", "scanner": "scanner-primary", "fingerprint": "948ddd46248e973b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-26b9e92ca8cafa7f", "level": "note", "message": {"text": "Very large file: scripts/validate.py (2682 lines)"}, "properties": {"repobilityId": "53ad73e11d42d11a", "scanner": "scanner-primary", "fingerprint": "26b9e92ca8cafa7f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8fb66ebe91b846b4", "level": "note", "message": {"text": "Very large file: src/ossuary/cli.py (3505 lines)"}, "properties": {"repobilityId": "26a667b15350623d", "scanner": "scanner-primary", "fingerprint": "8fb66ebe91b846b4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e6d2f0f34f99d0f8", "level": "note", "message": {"text": "Very large file: src/ossuary/services/scorer.py (1494 lines)"}, "properties": {"repobilityId": "7928e2d696411005", "scanner": "scanner-primary", "fingerprint": "e6d2f0f34f99d0f8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "cbd715c26ce43e0e", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "995e862f69f6d558", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "7356c7d1718f379d", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "61d113fca02204c7", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "ce96adbfa7396ed0", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2679282aa1c484b5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "properties": {"repobilityId": "27d579812e6be614", "scanner": "scanner-primary", "fingerprint": "2679282aa1c484b5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e4a8bed351f49008", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/test_sentiment.py:206"}, "properties": {"repobilityId": "678ba26a513a7f3c", "scanner": "scanner-primary", "fingerprint": "e4a8bed351f49008", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3f9bf9c8bd8fd79f", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/test_scoring.py:317"}, "properties": {"repobilityId": "1089b171413e10b6", "scanner": "scanner-primary", "fingerprint": "3f9bf9c8bd8fd79f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-36bc40f23f3c783a", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/test_doc_code_drift.py:552"}, "properties": {"repobilityId": "8c14ba12ff67025d", "scanner": "scanner-primary", "fingerprint": "36bc40f23f3c783a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d1e77c3549833d48", "level": "none", "message": {"text": "Commented-code block (10 lines) in scripts/validate.py:67"}, "properties": {"repobilityId": "e25d3df2a4246090", "scanner": "scanner-primary", "fingerprint": "d1e77c3549833d48", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e066ff3f0d111c0f", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/migrate_scores_nullable.py:73"}, "properties": {"repobilityId": "c7b8138b1fd37c49", "scanner": "scanner-primary", "fingerprint": "e066ff3f0d111c0f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-127b9ce2dee34c4d", "level": "error", "message": {"text": "Blocking `time.sleep(...)` inside `async def main` \u2014 scripts/scorecard_compare.py:261"}, "properties": {"repobilityId": "6de51e5615dd192a", "scanner": "scanner-primary", "fingerprint": "127b9ce2dee34c4d", "layer": "quality", "severity": "high", "confidence": 1.0, "tags": ["integrity", "sync-io-in-async", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/scorecard_compare.py"}, "region": {"startLine": 261}}}]}, {"ruleId": "scanner-e5f54f7e5dc1ec89", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/ossuary/cli.py:832"}, "properties": {"repobilityId": "5e3e0b8a61c37159", "scanner": "scanner-primary", "fingerprint": "e5f54f7e5dc1ec89", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3ce739f53dad04d7", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 src/ossuary/cli.py:68"}, "properties": {"repobilityId": "bab64988189b41af", "scanner": "scanner-primary", "fingerprint": "3ce739f53dad04d7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-76d03cb825ef8339", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/ossuary/dashboard/utils.py:17"}, "properties": {"repobilityId": "f341052c1aa95f98", "scanner": "scanner-primary", "fingerprint": "76d03cb825ef8339", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ed063118fb61c327", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/ossuary/dashboard/pages/4_Methodology.py:111"}, "properties": {"repobilityId": "133b11b7ec1848fa", "scanner": "scanner-primary", "fingerprint": "ed063118fb61c327", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-debb110351276104", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/ossuary/scoring/reputation.py:75"}, "properties": {"repobilityId": "7e8401c0a9d4b346", "scanner": "scanner-primary", "fingerprint": "debb110351276104", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-399977cc91dfdb74", "level": "none", "message": {"text": "Commented-code block (14 lines) in src/ossuary/scoring/factors.py:195"}, "properties": {"repobilityId": "399e60963f75bbbf", "scanner": "scanner-primary", "fingerprint": "399977cc91dfdb74", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ee3871f9b3c5429e", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/ossuary/scoring/engine.py:129"}, "properties": {"repobilityId": "b96fb3b82e6d672a", "scanner": "scanner-primary", "fingerprint": "ee3871f9b3c5429e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3f35c0f1c413d775", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/ossuary/collectors/git.py:184"}, "properties": {"repobilityId": "704c0e448d962530", "scanner": "scanner-primary", "fingerprint": "3f35c0f1c413d775", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7415d2dfcf3fd3c0", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/ossuary/collectors/github.py:105"}, "properties": {"repobilityId": "ee70a8093f060fc9", "scanner": "scanner-primary", "fingerprint": "7415d2dfcf3fd3c0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3e86f27d9c54fb5d", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/ossuary/collectors/pypi.py:42"}, "properties": {"repobilityId": "d77c319a1fea6846", "scanner": "scanner-primary", "fingerprint": "3e86f27d9c54fb5d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4ced67fe67b7ffca", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/ossuary/collectors/registries.py:225"}, "properties": {"repobilityId": "65aeaff3d20fc8a2", "scanner": "scanner-primary", "fingerprint": "4ced67fe67b7ffca", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-26ad569db4676295", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/ossuary/db/session.py:62"}, "properties": {"repobilityId": "72ebe38f3d813c04", "scanner": "scanner-primary", "fingerprint": "26ad569db4676295", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-88e39a9435b7b816", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/ossuary/db/models.py:55"}, "properties": {"repobilityId": "3cf3337264d17126", "scanner": "scanner-primary", "fingerprint": "88e39a9435b7b816", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-085e28a6d32c81ee", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/ossuary/sentiment/analyzer.py:57"}, "properties": {"repobilityId": "1f053a5dd2c6284b", "scanner": "scanner-primary", "fingerprint": "085e28a6d32c81ee", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-51b3992a289201d5", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/ossuary/services/batch.py:33"}, "properties": {"repobilityId": "a85da43ea98c0141", "scanner": "scanner-primary", "fingerprint": "51b3992a289201d5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e6cbb6adb0b2efef", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/ossuary/services/repo_cache.py:62"}, "properties": {"repobilityId": "5b8ed1e3bb58068f", "scanner": "scanner-primary", "fingerprint": "e6cbb6adb0b2efef", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-81e8adfc8aa5aa0f", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/ossuary/services/scorer.py:127"}, "properties": {"repobilityId": "5a669b6347ebbc15", "scanner": "scanner-primary", "fingerprint": "81e8adfc8aa5aa0f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-319e66a630e14977", "level": "none", "message": {"text": "2 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "d838d1fc5d8231c9", "scanner": "scanner-primary", "fingerprint": "319e66a630e14977", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "0655486d319f931a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "1606287bc3f12c3c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "5d773b74ef80f6ef", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e88fda4fbd45f0e5", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "03fd268c79b4c655", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "d0bd5e28afb20f95", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "088565fa33e6adf3", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e1b9e56f84d43a38", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "bbfe7b0de935d3b9", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "07594671011373b7", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "44a88bd35aa87b3f", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "70f12f2dcf2c27de", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-02525d39071dd2c7", "level": "note", "message": {"text": "Near-duplicate function bodies in 5 places"}, "properties": {"repobilityId": "db35a0b6499cd853", "scanner": "scanner-primary", "fingerprint": "02525d39071dd2c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-02525d39071dd2c7", "level": "note", "message": {"text": "Near-duplicate function bodies in 5 places"}, "properties": {"repobilityId": "c51a9846e27d5ee3", "scanner": "scanner-primary", "fingerprint": "02525d39071dd2c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-02525d39071dd2c7", "level": "note", "message": {"text": "Near-duplicate function bodies in 5 places"}, "properties": {"repobilityId": "8468579451935f00", "scanner": "scanner-primary", "fingerprint": "02525d39071dd2c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "584eb57ccb4dfe08", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "276def53263c22fb", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}