{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-6bd577263ccd9f0c", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.12-alpine3.19", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-alpine3.19"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-50b92d6db2fa28fc", "name": "Insecure pattern 'direct_innerhtml_assignment' in demoSite/js/ai-assistant-ui.js:22", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in demoSite/js/ai-assistant-ui.js:22"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7484008f50eef20e", "name": "Insecure pattern 'direct_innerhtml_assignment' in demoSite/js/code-history.js:70", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in demoSite/js/code-history.js:70"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a753c54fbfd9ac22", "name": "Insecure pattern 'insert_adjacent_html' in demoSite/js/config-ui.js:39", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in demoSite/js/config-ui.js:39"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-106c28f0afc93333", "name": "Insecure pattern 'direct_innerhtml_assignment' in demoSite/js/config-ui-models.js:50", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in demoSite/js/config-ui-models.js:50"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7fc3a17754013e42", "name": "Insecure pattern 'direct_innerhtml_assignment' in demoSite/js/ai-assistant.js:317", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in demoSite/js/ai-assistant.js:317"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0fc9980ce6e0424a", "name": "Insecure pattern 'direct_innerhtml_assignment' in demoSite/js/modules/drawioIntegration.js:274", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in demoSite/js/modules/drawioIntegration.js:274"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-306522ee7f14137f", "name": "Insecure pattern 'direct_innerhtml_assignment' in demoSite/js/modules/fullscreen.js:70", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in demoSite/js/modules/fullscreen.js:70"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-35ca83fb5fd081b9", "name": "Insecure pattern 'direct_innerhtml_assignment' in demoSite/js/modules/diagramOperations.js:63", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in demoSite/js/modules/diagramOperations.js:63"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4f588e8601a72d7f", "name": "Insecure pattern 'direct_innerhtml_assignment' in demoSite/js/modules/errors.js:100", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in demoSite/js/modules/errors.js:100"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "oven-sh/setup-bun@v2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-64192a3c67110d01", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d1fd3ae3733b0e54", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ecb73c61b416960", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v3 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e4f658c0c00de0d4", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-448d8837178ae57a", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 20 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f00477bbd1904862", "name": "Commented-code block (6 lines) in demoSite/server.py:217", "shortDescription": {"text": "Commented-code block (6 lines) in demoSite/server.py:217"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bd30391bd42864f3", "name": "Commented-code block (6 lines) in demoSite/gunicorn.conf.py:37", "shortDescription": {"text": "Commented-code block (6 lines) in demoSite/gunicorn.conf.py:37"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-74b04079e8beee5d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 demoSite/js/ai-assistant-api.js:37", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 demoSite/js/ai-assistant-api.js:37"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-64ad0774e05406ab", "name": "`fetch()` without try/.catch or AbortSignal \u2014 demoSite/js/main.js:287", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 demoSite/js/main.js:287"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b19db4f4cfbcd2ef", "name": "`fetch()` without try/.catch or AbortSignal \u2014 demoSite/js/config-ui-models.js:34", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 demoSite/js/config-ui-models.js:34"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d5ee225872de7d4e", "name": "Commented-code block (5 lines) in scripts/build-lite.mjs:122", "shortDescription": {"text": "Commented-code block (5 lines) in scripts/build-lite.mjs:122"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f808a4ef3e1071fb", "name": "14 env vars used in code but missing from .env.example", "shortDescription": {"text": "14 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `AI_ACCESS_TOKEN`, `AI_DAILY_LIMIT_PER_IP`, `AI_MODEL_ALLOWLIST`, `AI_MODEL_FALLBACKS`, `AI_RETRY_PROMPT`, `AI_SYSTEM_PROMPT`, `AI_USER_PROMPT`, `DISABLED_DIAGRAM_TYPES` + 6 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f01172cde7e0a15e", "name": "Flask mutation route `validate_model` without `@login_required` \u2014 demoSite/server.py:480", "shortDescription": {"text": "Flask mutation route `validate_model` without `@login_required` \u2014 demoSite/server.py:480"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-91cd163d6752c65a", "name": "Flask mutation route `ai_assist` without `@login_required` \u2014 demoSite/server.py:591", "shortDescription": {"text": "Flask mutation route `ai_assist` without `@login_required` \u2014 demoSite/server.py:591"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e6121051eaeffe16", "name": "Dangling fetch: GET /examples/${type}.txt (demoSite/js/modules/diagramOperations.js:96)", "shortDescription": {"text": "Dangling fetch: GET /examples/${type}.txt (demoSite/js/modules/diagramOperations.js:96)"}, "fullDescription": {"text": "`demoSite/js/modules/diagramOperations.js:96` calls `GET /examples/${type}.txt` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/examples/<p>.txt`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8ece8c987ff9c424", "name": "Unused endpoint: ANY /api/health", "shortDescription": {"text": "Unused endpoint: ANY /api/health"}, "fullDescription": {"text": "`demoSite/server.py` declares `ANY /api/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a6d91f2236825bf", "name": "Unused endpoint: ANY /", "shortDescription": {"text": "Unused endpoint: ANY /"}, "fullDescription": {"text": "`demoSite/server.py` declares `ANY /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e568bdfce08b33f5", "name": "Unused endpoint: ANY /<path:filename>", "shortDescription": {"text": "Unused endpoint: ANY /<path:filename>"}, "fullDescription": {"text": "`demoSite/server.py` declares `ANY /<path:filename>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22426"}, "properties": {"repository": "vppillai/kroki-server", "repoUrl": "https://github.com/vppillai/kroki-server", "branch": "main"}, "results": [{"ruleId": "scanner-6bd577263ccd9f0c", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.12-alpine3.19"}, "properties": {"repobilityId": "7685a7da71c7de4c", "scanner": "scanner-primary", "fingerprint": "6bd577263ccd9f0c", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demoSite/Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-50b92d6db2fa28fc", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in demoSite/js/ai-assistant-ui.js:22"}, "properties": {"repobilityId": "67795c54650dfb3f", "scanner": "scanner-primary", "fingerprint": "50b92d6db2fa28fc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demoSite/js/ai-assistant-ui.js"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-7484008f50eef20e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in demoSite/js/code-history.js:70"}, "properties": {"repobilityId": "e5db94387507a762", "scanner": "scanner-primary", "fingerprint": "7484008f50eef20e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demoSite/js/code-history.js"}, "region": {"startLine": 70}}}]}, {"ruleId": "scanner-a753c54fbfd9ac22", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in demoSite/js/config-ui.js:39"}, "properties": {"repobilityId": "64f1f89a46b0170e", "scanner": "scanner-primary", "fingerprint": "a753c54fbfd9ac22", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demoSite/js/config-ui.js"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-106c28f0afc93333", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in demoSite/js/config-ui-models.js:50"}, "properties": {"repobilityId": "e83dca0febb824a1", "scanner": "scanner-primary", "fingerprint": "106c28f0afc93333", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demoSite/js/config-ui-models.js"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-7fc3a17754013e42", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in demoSite/js/ai-assistant.js:317"}, "properties": {"repobilityId": "7ecbc31956d629ea", "scanner": "scanner-primary", "fingerprint": "7fc3a17754013e42", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demoSite/js/ai-assistant.js"}, "region": {"startLine": 317}}}]}, {"ruleId": "scanner-0fc9980ce6e0424a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in demoSite/js/modules/drawioIntegration.js:274"}, "properties": {"repobilityId": "601c7e065f0cd0d8", "scanner": "scanner-primary", "fingerprint": "0fc9980ce6e0424a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demoSite/js/modules/drawioIntegration.js"}, "region": {"startLine": 274}}}]}, {"ruleId": "scanner-306522ee7f14137f", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in demoSite/js/modules/fullscreen.js:70"}, "properties": {"repobilityId": "c1b894cb7b97d4ac", "scanner": "scanner-primary", "fingerprint": "306522ee7f14137f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demoSite/js/modules/fullscreen.js"}, "region": {"startLine": 70}}}]}, {"ruleId": "scanner-35ca83fb5fd081b9", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in demoSite/js/modules/diagramOperations.js:63"}, "properties": {"repobilityId": "7901bff8b2de774a", "scanner": "scanner-primary", "fingerprint": "35ca83fb5fd081b9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demoSite/js/modules/diagramOperations.js"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-4f588e8601a72d7f", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in demoSite/js/modules/errors.js:100"}, "properties": {"repobilityId": "c2f89a6c2652eec3", "scanner": "scanner-primary", "fingerprint": "4f588e8601a72d7f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demoSite/js/modules/errors.js"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dcb6504096fc20e7", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "04f57d208548fcef", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 91}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d1b973fc5722bf04", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 108}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d1b973fc5722bf04", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 131}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c3fda9e893c533ec", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 135}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c4b845a5807c42de", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 143}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae63b315ae3ef32f", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 154}}}]}, {"ruleId": "scanner-64192a3c67110d01", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "87338a8bfcb6f435", "scanner": "scanner-primary", "fingerprint": "64192a3c67110d01", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d1fd3ae3733b0e54", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d46d563153002d49", "scanner": "scanner-primary", "fingerprint": "d1fd3ae3733b0e54", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-kroki-core.yml"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-d1fd3ae3733b0e54", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "10b493899b165d57", "scanner": "scanner-primary", "fingerprint": "d1fd3ae3733b0e54", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-kroki-core.yml"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-d1fd3ae3733b0e54", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8ee9cc68e7faafd3", "scanner": "scanner-primary", "fingerprint": "d1fd3ae3733b0e54", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-kroki-core.yml"}, "region": {"startLine": 70}}}]}, {"ruleId": "scanner-d1fd3ae3733b0e54", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3b46627d4e64d075", "scanner": "scanner-primary", "fingerprint": "d1fd3ae3733b0e54", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-kroki-core.yml"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-d1fd3ae3733b0e54", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8ee9cc68e7faafd3", "scanner": "scanner-primary", "fingerprint": "d1fd3ae3733b0e54", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-kroki-core.yml"}, "region": {"startLine": 98}}}]}, {"ruleId": "scanner-d1fd3ae3733b0e54", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3b46627d4e64d075", "scanner": "scanner-primary", "fingerprint": "d1fd3ae3733b0e54", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-kroki-core.yml"}, "region": {"startLine": 101}}}]}, {"ruleId": "scanner-2ecb73c61b416960", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "ad809a448e0313f8", "scanner": "scanner-primary", "fingerprint": "2ecb73c61b416960", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-kroki-core.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "51597ecccc1bdb97", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d36d1b20b6d64d68", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "23668c781d0b7b39", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b2edfca1f61db63c", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9546e40eb6281c82", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "51597ecccc1bdb97", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f60d9951f1477eef", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "39d5b9c59fffea83", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9ed0853ab3bb5419", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e1a9cc0aa0ef1a08", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "3d5c6f08903dde90", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 61}}}]}, {"ruleId": "scanner-448d8837178ae57a", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "13af6451e15656fc", "scanner": "scanner-primary", "fingerprint": "448d8837178ae57a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "b7029591590b3a83", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "f4f3e5ed16f9b908", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "5d50a7009f499cbb", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-f00477bbd1904862", "level": "none", "message": {"text": "Commented-code block (6 lines) in demoSite/server.py:217"}, "properties": {"repobilityId": "ab577a7240d04e1a", "scanner": "scanner-primary", "fingerprint": "f00477bbd1904862", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bd30391bd42864f3", "level": "none", "message": {"text": "Commented-code block (6 lines) in demoSite/gunicorn.conf.py:37"}, "properties": {"repobilityId": "439a9f34dea8e266", "scanner": "scanner-primary", "fingerprint": "bd30391bd42864f3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-74b04079e8beee5d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 demoSite/js/ai-assistant-api.js:37"}, "properties": {"repobilityId": "ca56583285109cd3", "scanner": "scanner-primary", "fingerprint": "74b04079e8beee5d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-64ad0774e05406ab", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 demoSite/js/main.js:287"}, "properties": {"repobilityId": "6539433a4cf78897", "scanner": "scanner-primary", "fingerprint": "64ad0774e05406ab", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b19db4f4cfbcd2ef", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 demoSite/js/config-ui-models.js:34"}, "properties": {"repobilityId": "2f3f989adbaf38cb", "scanner": "scanner-primary", "fingerprint": "b19db4f4cfbcd2ef", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d5ee225872de7d4e", "level": "none", "message": {"text": "Commented-code block (5 lines) in scripts/build-lite.mjs:122"}, "properties": {"repobilityId": "a832db34c6902752", "scanner": "scanner-primary", "fingerprint": "d5ee225872de7d4e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f808a4ef3e1071fb", "level": "note", "message": {"text": "14 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "ce6b2ec4be4ec75a", "scanner": "scanner-primary", "fingerprint": "f808a4ef3e1071fb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-f01172cde7e0a15e", "level": "error", "message": {"text": "Flask mutation route `validate_model` without `@login_required` \u2014 demoSite/server.py:480"}, "properties": {"repobilityId": "cc40c9249e3c88ce", "scanner": "scanner-primary", "fingerprint": "f01172cde7e0a15e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demoSite/server.py"}, "region": {"startLine": 480}}}]}, {"ruleId": "scanner-91cd163d6752c65a", "level": "error", "message": {"text": "Flask mutation route `ai_assist` without `@login_required` \u2014 demoSite/server.py:591"}, "properties": {"repobilityId": "be572ec33a6fd286", "scanner": "scanner-primary", "fingerprint": "91cd163d6752c65a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "demoSite/server.py"}, "region": {"startLine": 591}}}]}, {"ruleId": "scanner-e6121051eaeffe16", "level": "error", "message": {"text": "Dangling fetch: GET /examples/${type}.txt (demoSite/js/modules/diagramOperations.js:96)"}, "properties": {"repobilityId": "100da119afee82e3", "scanner": "scanner-primary", "fingerprint": "e6121051eaeffe16", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-8ece8c987ff9c424", "level": "note", "message": {"text": "Unused endpoint: ANY /api/health"}, "properties": {"repobilityId": "134ac479633e40b4", "scanner": "scanner-primary", "fingerprint": "8ece8c987ff9c424", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1a6d91f2236825bf", "level": "note", "message": {"text": "Unused endpoint: ANY /"}, "properties": {"repobilityId": "c450aa39770f0843", "scanner": "scanner-primary", "fingerprint": "1a6d91f2236825bf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e568bdfce08b33f5", "level": "note", "message": {"text": "Unused endpoint: ANY /<path:filename>"}, "properties": {"repobilityId": "f29804ffd8000988", "scanner": "scanner-primary", "fingerprint": "e568bdfce08b33f5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}