{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-21cece275ac4ca93", "name": "use of md5 \u2014 core/decrypt.go:168", "shortDescription": {"text": "use of md5 \u2014 core/decrypt.go:168"}, "fullDescription": {"text": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\nRule: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5\nSeverity: WARNING\nOWASP: A03:2017 - Sensitive Data Exposure, A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-328: Use of Weak Hash\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-892bda7a5d04eb09", "name": "use of md5 \u2014 core/encrypt.go:267", "shortDescription": {"text": "use of md5 \u2014 core/encrypt.go:267"}, "fullDescription": {"text": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\nRule: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5\nSeverity: WARNING\nOWASP: A03:2017 - Sensitive Data Exposure, A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-328: Use of Weak Hash\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-e8a4cb2abf4f51e2", "name": "use of rc4 \u2014 core/encrypt.go:565", "shortDescription": {"text": "use of rc4 \u2014 core/encrypt.go:565"}, "fullDescription": {"text": "Detected RC4 cipher algorithm which is insecure. The algorithm has many known vulnerabilities. Use AES instead.\n\nRule: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-rc4\nSeverity: WARNING\nOWASP: A03:2017 - Sensitive Data Exposure, A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-327: Use of a Broken or Risky Cryptographic Algorithm\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-d04d8fb7df3f0697", "name": "use of md5 \u2014 document/writer_xref_stream.go:403", "shortDescription": {"text": "use of md5 \u2014 document/writer_xref_stream.go:403"}, "fullDescription": {"text": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\nRule: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5\nSeverity: WARNING\nOWASP: A03:2017 - Sensitive Data Exposure, A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-328: Use of Weak Hash\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-5793a70dda32d495", "name": "use of unsafe block \u2014 export/cabi.go:173", "shortDescription": {"text": "use of unsafe block \u2014 export/cabi.go:173"}, "fullDescription": {"text": "Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing.\n\nRule: go.lang.security.audit.unsafe.use-of-unsafe-block\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-242: Use of Inherently Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-3e848dd20a97fb38", "name": "use of unsafe block \u2014 export/cabi_buffer.go:33", "shortDescription": {"text": "use of unsafe block \u2014 export/cabi_buffer.go:33"}, "fullDescription": {"text": "Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing.\n\nRule: go.lang.security.audit.unsafe.use-of-unsafe-block\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-242: Use of Inherently Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-5e761d1d1156726d", "name": "use of unsafe block \u2014 export/cabi_columns.go:45", "shortDescription": {"text": "use of unsafe block \u2014 export/cabi_columns.go:45"}, "fullDescription": {"text": "Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing.\n\nRule: go.lang.security.audit.unsafe.use-of-unsafe-block\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-242: Use of Inherently Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-62649e882fc6ce9c", "name": "use of unsafe block \u2014 export/cabi_forms.go:70", "shortDescription": {"text": "use of unsafe block \u2014 export/cabi_forms.go:70"}, "fullDescription": {"text": "Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing.\n\nRule: go.lang.security.audit.unsafe.use-of-unsafe-block\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-242: Use of Inherently Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-79a5f46ba188807c", "name": "use of unsafe block \u2014 export/cabi_forms_ext.go:57", "shortDescription": {"text": "use of unsafe block \u2014 export/cabi_forms_ext.go:57"}, "fullDescription": {"text": "Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing.\n\nRule: go.lang.security.audit.unsafe.use-of-unsafe-block\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-242: Use of Inherently Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-f4a2f16d019d8582", "name": "use of unsafe block \u2014 export/cabi_grid.go:55", "shortDescription": {"text": "use of unsafe block \u2014 export/cabi_grid.go:55"}, "fullDescription": {"text": "Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing.\n\nRule: go.lang.security.audit.unsafe.use-of-unsafe-block\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-242: Use of Inherently Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-391c343869f7866b", "name": "use of unsafe block \u2014 export/cabi_merge.go:30", "shortDescription": {"text": "use of unsafe block \u2014 export/cabi_merge.go:30"}, "fullDescription": {"text": "Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing.\n\nRule: go.lang.security.audit.unsafe.use-of-unsafe-block\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-242: Use of Inherently Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-501398c2eb3e9c3b", "name": "use of unsafe block \u2014 export/cabi_page_ext.go:102", "shortDescription": {"text": "use of unsafe block \u2014 export/cabi_page_ext.go:102"}, "fullDescription": {"text": "Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing.\n\nRule: go.lang.security.audit.unsafe.use-of-unsafe-block\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-242: Use of Inherently Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-2d1f93fb827f9c30", "name": "use of unsafe block \u2014 export/cabi_redact.go:34", "shortDescription": {"text": "use of unsafe block \u2014 export/cabi_redact.go:34"}, "fullDescription": {"text": "Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing.\n\nRule: go.lang.security.audit.unsafe.use-of-unsafe-block\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-242: Use of Inherently Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-5ee6b6a66284e713", "name": "use of unsafe block \u2014 export/cabi_tab.go:31", "shortDescription": {"text": "use of unsafe block \u2014 export/cabi_tab.go:31"}, "fullDescription": {"text": "Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing.\n\nRule: go.lang.security.audit.unsafe.use-of-unsafe-block\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-242: Use of Inherently Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-9a758f441a9947ae", "name": "use of unsafe block \u2014 export/cabi_table.go:36", "shortDescription": {"text": "use of unsafe block \u2014 export/cabi_table.go:36"}, "fullDescription": {"text": "Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing.\n\nRule: go.lang.security.audit.unsafe.use-of-unsafe-block\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-242: Use of Inherently Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-ecf9f2ef2ef90cc4", "name": "use of unsafe block \u2014 export/cabi_v062.go:230", "shortDescription": {"text": "use of unsafe block \u2014 export/cabi_v062.go:230"}, "fullDescription": {"text": "Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing.\n\nRule: go.lang.security.audit.unsafe.use-of-unsafe-block\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-242: Use of Inherently Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-c860e2da6c5de68a", "name": "use of sha1 \u2014 sign/dss.go:174", "shortDescription": {"text": "use of sha1 \u2014 sign/dss.go:174"}, "fullDescription": {"text": "Detected SHA1 hash algorithm which is considered insecure. SHA1 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\nRule: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-sha1\nSeverity: WARNING\nOWASP: A03:2017 - Sensitive Data Exposure, A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-328: Use of Weak Hash\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-0b30d4403d066570", "name": "CVE-2026-56852: golang.org/x/text v0.38.0 \u2014 go.mod", "shortDescription": {"text": "CVE-2026-56852: golang.org/x/text v0.38.0 \u2014 go.mod"}, "fullDescription": {"text": "A norm.Iter can enter an infinite loop when handling input containing  ...\n\nA norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.\n\nPackage: golang.org/x/text\nInstalled: v0.38.0\nFixed in: 0.39.0\nSeverity: UNKNOWN\nFix: Upgrade golang.org/x/text to 0.39.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e637c415447867e4", "name": "Run SkillSpector's LLM-backed analysis in your own pipeline", "shortDescription": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "fullDescription": {"text": "Repobility ran SkillSpector's static rules server-side. The deeper LLM-backed analyzers \u2014 tool-poisoning (TP*), semantic security discovery (SSD*), developer-intent mismatch (SDI*) \u2014 are meant to run on YOUR machine with YOUR model; repobility never sends your code to an LLM. Recipe:\n\n# 1. Install SkillSpector in your own isolated env\npipx install \"skillspector @ git+https://github.com/NVIDIA/SkillSpector.git\"\n\n# 2. Point it at YOUR LLM pipeline (pick one) - your code stays on your machine\nexport SKILLSPECTOR_PROVIDER=anthropic && export ANTHROPIC_API_KEY=sk-ant-...\n# export SKILLSPECTOR_PROVIDER=openai   && export OPENAI_API_KEY=sk-...\n# export SKILLSPECTOR_PROVIDER=openai OPENAI_API_KEY=ollama OPENAI_BASE_URL=http://localhost:11434/v1 SKILLSPECTOR_MODEL=llama3.1:8b\n# export SKILLSPECTOR_PROVIDER=nv_build && export NVIDIA_INFERENCE_KEY=nvapi-...\n\n# 3. Run the LLM-backed scan per skill (omit --no-llm to enable the LLM analyzers)\nskillspector scan .claude/skills/using-folio --format sar"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ab37ecccd70f8b78", "name": "Possible secret in document/encryption.go", "shortDescription": {"text": "Possible secret in document/encryption.go"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching password_literal. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.58}}, {"id": "scanner-e782be9e3c6f91f6", "name": "Insecure pattern 'weak_hash' in sign/sign_test.go:796", "shortDescription": {"text": "Insecure pattern 'weak_hash' in sign/sign_test.go:796"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-go@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-go@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-55c888c4ec444140", "name": "Very large file: layout/table.go (1721 lines)", "shortDescription": {"text": "Very large file: layout/table.go (1721 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-edbb2209c44bc3fc", "name": "Very large file: html/converter_test.go (9481 lines)", "shortDescription": {"text": "Very large file: html/converter_test.go (9481 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ec4667bbc92caf58", "name": "Very large file: html/features_test.go (2840 lines)", "shortDescription": {"text": "Very large file: html/features_test.go (2840 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6256732733a84546", "name": "Very large file: font/gpos_test.go (1781 lines)", "shortDescription": {"text": "Very large file: font/gpos_test.go (1781 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-10c1be65e013c3db", "name": "Very large file: font/metrics_data.go (6634 lines)", "shortDescription": {"text": "Very large file: font/metrics_data.go (6634 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 181 placeholder/mock markers across 53 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d79c4077342a7d0", "name": "Runtime service client appears to use placeholder configuration", "shortDescription": {"text": "Runtime service client appears to use placeholder configuration"}, "fullDescription": {"text": "A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing tests. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/30796"}, "properties": {"repository": "carlos7ags/folio", "repoUrl": "https://github.com/carlos7ags/folio", "branch": "main"}, "results": [{"ruleId": "scanner-21cece275ac4ca93", "level": "warning", "message": {"text": "use of md5 \u2014 core/decrypt.go:168"}, "properties": {"repobilityId": "998803c3ba747412", "scanner": "scanner-primary", "fingerprint": "21cece275ac4ca93", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/decrypt.go"}, "region": {"startLine": 168}}}]}, {"ruleId": "scanner-892bda7a5d04eb09", "level": "warning", "message": {"text": "use of md5 \u2014 core/encrypt.go:267"}, "properties": {"repobilityId": "d42c7cd397883e60", "scanner": "scanner-primary", "fingerprint": "892bda7a5d04eb09", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/encrypt.go"}, "region": {"startLine": 267}}}]}, {"ruleId": "scanner-e8a4cb2abf4f51e2", "level": "warning", "message": {"text": "use of rc4 \u2014 core/encrypt.go:565"}, "properties": {"repobilityId": "93d6386365e719ef", "scanner": "scanner-primary", "fingerprint": "e8a4cb2abf4f51e2", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "core/encrypt.go"}, "region": {"startLine": 565}}}]}, {"ruleId": "scanner-d04d8fb7df3f0697", "level": "warning", "message": {"text": "use of md5 \u2014 document/writer_xref_stream.go:403"}, "properties": {"repobilityId": "e04248bc4bebc86d", "scanner": "scanner-primary", "fingerprint": "d04d8fb7df3f0697", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "document/writer_xref_stream.go"}, "region": {"startLine": 403}}}]}, {"ruleId": "scanner-5793a70dda32d495", "level": "warning", "message": {"text": "use of unsafe block \u2014 export/cabi.go:173"}, "properties": {"repobilityId": "7dc7bc418d5298bc", "scanner": "scanner-primary", "fingerprint": "5793a70dda32d495", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "export/cabi.go"}, "region": {"startLine": 173}}}]}, {"ruleId": "scanner-3e848dd20a97fb38", "level": "warning", "message": {"text": "use of unsafe block \u2014 export/cabi_buffer.go:33"}, "properties": {"repobilityId": "f9890f319f7d790c", "scanner": "scanner-primary", "fingerprint": "3e848dd20a97fb38", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "export/cabi_buffer.go"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-5e761d1d1156726d", "level": "warning", "message": {"text": "use of unsafe block \u2014 export/cabi_columns.go:45"}, "properties": {"repobilityId": "5c1d269f40ec655c", "scanner": "scanner-primary", "fingerprint": "5e761d1d1156726d", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "export/cabi_columns.go"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-62649e882fc6ce9c", "level": "warning", "message": {"text": "use of unsafe block \u2014 export/cabi_forms.go:70"}, "properties": {"repobilityId": "6a2f0b5cf88998e6", "scanner": "scanner-primary", "fingerprint": "62649e882fc6ce9c", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "export/cabi_forms.go"}, "region": {"startLine": 70}}}]}, {"ruleId": "scanner-79a5f46ba188807c", "level": "warning", "message": {"text": "use of unsafe block \u2014 export/cabi_forms_ext.go:57"}, "properties": {"repobilityId": "3b820352ee5b81c9", "scanner": "scanner-primary", "fingerprint": "79a5f46ba188807c", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "export/cabi_forms_ext.go"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-f4a2f16d019d8582", "level": "warning", "message": {"text": "use of unsafe block \u2014 export/cabi_grid.go:55"}, "properties": {"repobilityId": "6ad1baaebc2745f5", "scanner": "scanner-primary", "fingerprint": "f4a2f16d019d8582", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "export/cabi_grid.go"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-391c343869f7866b", "level": "warning", "message": {"text": "use of unsafe block \u2014 export/cabi_merge.go:30"}, "properties": {"repobilityId": "4fcc53a90dbce270", "scanner": "scanner-primary", "fingerprint": "391c343869f7866b", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "export/cabi_merge.go"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-501398c2eb3e9c3b", "level": "warning", "message": {"text": "use of unsafe block \u2014 export/cabi_page_ext.go:102"}, "properties": {"repobilityId": "3f11d6feabd85e31", "scanner": "scanner-primary", "fingerprint": "501398c2eb3e9c3b", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "export/cabi_page_ext.go"}, "region": {"startLine": 102}}}]}, {"ruleId": "scanner-2d1f93fb827f9c30", "level": "warning", "message": {"text": "use of unsafe block \u2014 export/cabi_redact.go:34"}, "properties": {"repobilityId": "d5e62ecc1c32f845", "scanner": "scanner-primary", "fingerprint": "2d1f93fb827f9c30", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "export/cabi_redact.go"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-5ee6b6a66284e713", "level": "warning", "message": {"text": "use of unsafe block \u2014 export/cabi_tab.go:31"}, "properties": {"repobilityId": "91980ab6442c011e", "scanner": "scanner-primary", "fingerprint": "5ee6b6a66284e713", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "export/cabi_tab.go"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-9a758f441a9947ae", "level": "warning", "message": {"text": "use of unsafe block \u2014 export/cabi_table.go:36"}, "properties": {"repobilityId": "56058b24d50a288c", "scanner": "scanner-primary", "fingerprint": "9a758f441a9947ae", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "export/cabi_table.go"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-ecf9f2ef2ef90cc4", "level": "warning", "message": {"text": "use of unsafe block \u2014 export/cabi_v062.go:230"}, "properties": {"repobilityId": "45db069c110a3427", "scanner": "scanner-primary", "fingerprint": "ecf9f2ef2ef90cc4", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "export/cabi_v062.go"}, "region": {"startLine": 230}}}]}, {"ruleId": "scanner-c860e2da6c5de68a", "level": "warning", "message": {"text": "use of sha1 \u2014 sign/dss.go:174"}, "properties": {"repobilityId": "cfc4025d9c81b500", "scanner": "scanner-primary", "fingerprint": "c860e2da6c5de68a", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sign/dss.go"}, "region": {"startLine": 174}}}]}, {"ruleId": "scanner-0b30d4403d066570", "level": "none", "message": {"text": "CVE-2026-56852: golang.org/x/text v0.38.0 \u2014 go.mod"}, "properties": {"repobilityId": "b7935bed016c2ddc", "scanner": "scanner-primary", "fingerprint": "0b30d4403d066570", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-56852"]}}, {"ruleId": "scanner-e637c415447867e4", "level": "none", "message": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "properties": {"repobilityId": "1936f198ff5212bf", "scanner": "scanner-primary", "fingerprint": "e637c415447867e4", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["skillspector", "mcp-skill", "llm-advisory", "ai-coder"]}}, {"ruleId": "scanner-ab37ecccd70f8b78", "level": "warning", "message": {"text": "Possible secret in document/encryption.go"}, "properties": {"repobilityId": "cef0683e5315bc99", "scanner": "scanner-primary", "fingerprint": "ab37ecccd70f8b78", "layer": "security", "severity": "medium", "confidence": 0.58, "tags": ["secrets", "password_literal"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "document/encryption.go"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-e782be9e3c6f91f6", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in sign/sign_test.go:796"}, "properties": {"repobilityId": "e87a59f2ff5d8856", "scanner": "scanner-primary", "fingerprint": "e782be9e3c6f91f6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "sign/sign_test.go"}, "region": {"startLine": 796}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "be8027642c95a9ce", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "45fe1bb72fced1b5", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-55c888c4ec444140", "level": "note", "message": {"text": "Very large file: layout/table.go (1721 lines)"}, "properties": {"repobilityId": "f7dee8e9005f2365", "scanner": "scanner-primary", "fingerprint": "55c888c4ec444140", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-edbb2209c44bc3fc", "level": "note", "message": {"text": "Very large file: html/converter_test.go (9481 lines)"}, "properties": {"repobilityId": "cd519711a1b908c6", "scanner": "scanner-primary", "fingerprint": "edbb2209c44bc3fc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ec4667bbc92caf58", "level": "note", "message": {"text": "Very large file: html/features_test.go (2840 lines)"}, "properties": {"repobilityId": "96b7245e64151b5c", "scanner": "scanner-primary", "fingerprint": "ec4667bbc92caf58", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6256732733a84546", "level": "note", "message": {"text": "Very large file: font/gpos_test.go (1781 lines)"}, "properties": {"repobilityId": "a055b313cadca86a", "scanner": "scanner-primary", "fingerprint": "6256732733a84546", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-10c1be65e013c3db", "level": "note", "message": {"text": "Very large file: font/metrics_data.go (6634 lines)"}, "properties": {"repobilityId": "b390b39886595de0", "scanner": "scanner-primary", "fingerprint": "10c1be65e013c3db", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "e2ed2044e18ef43b", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-9d79c4077342a7d0", "level": "warning", "message": {"text": "Runtime service client appears to use placeholder configuration"}, "properties": {"repobilityId": "251f92dee0ac37e3", "scanner": "scanner-primary", "fingerprint": "9d79c4077342a7d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "runtime-config", "service-client", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "f9af3c8d82ad701f", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "f869c3b912a8d09c", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "8644cff5b8156059", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}]}]}