{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-5aa311f615b1a764", "name": "Possibly dead Python function: do_run_migrations", "shortDescription": {"text": "Possibly dead Python function: do_run_migrations"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-165514850d995924", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d25c102a1785e83", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0e4054340144c5db", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-66a944873ea4b056", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bbd79ef6f0e9466a", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5a8db41ea3c41d6f", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e4e4edd7683d76d4", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5ee6e9d9f2d108a5", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-177ee778a68b2fd9", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c0dfb9a902b394ee", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-10b68cff66ef5ec8", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e11e3e0051274ece", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-173f07358e6a8a30", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e4240497d43a999f", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9fed0e192b3759df", "name": "Stray `console.log` in TS/JS \u2014 frontend/src/shared/hooks/useDebounce.ts:84", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 frontend/src/shared/hooks/useDebounce.ts:84"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-94b87b9f503562cd", "name": "Stray `console.log` in TS/JS \u2014 frontend/src/shared/events/useEvent.ts:192", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 frontend/src/shared/events/useEvent.ts:192"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a9b61daee39afd64", "name": "Stray `console.log` in TS/JS \u2014 frontend/e2e/tests/resource-quotas-crud.spec.ts:699", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 frontend/e2e/tests/resource-quotas-crud.spec.ts:699"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d539420270d9867", "name": "Stray `console.log` in TS/JS \u2014 frontend/e2e/tests/phase8-quality.spec.ts:193", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 frontend/e2e/tests/phase8-quality.spec.ts:193"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ad949eaeee2e0205", "name": "Stray `console.log` in TS/JS \u2014 frontend/e2e/tests/accessibility.spec.ts:44", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 frontend/e2e/tests/accessibility.spec.ts:44"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c3fe9eced4acca9", "name": "Stray `console.log` in TS/JS \u2014 frontend/e2e/tests/resource-quotas.spec.ts:336", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 frontend/e2e/tests/resource-quotas.spec.ts:336"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b57195cbeb8d2600", "name": "Privileged port 8 in use", "shortDescription": {"text": "Privileged port 8 in use"}, "fullDescription": {"text": "Port 8 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ff14fc65b423531", "name": "Privileged port 5 in use", "shortDescription": {"text": "Privileged port 5 in use"}, "fullDescription": {"text": "Port 5 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2df899e8bf753a57", "name": "Privileged port 12 in use", "shortDescription": {"text": "Privileged port 12 in use"}, "fullDescription": {"text": "Port 12 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a874d1f03b446320", "name": "Privileged port 9 in use", "shortDescription": {"text": "Privileged port 9 in use"}, "fullDescription": {"text": "Port 9 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-80df29fd87fb52cc", "name": "Privileged port 30 in use", "shortDescription": {"text": "Privileged port 30 in use"}, "fullDescription": {"text": "Port 30 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0a33b286d44924a9", "name": "Privileged port 35 in use", "shortDescription": {"text": "Privileged port 35 in use"}, "fullDescription": {"text": "Port 35 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-35062c364c5a4c1e", "name": "Privileged port 11 in use", "shortDescription": {"text": "Privileged port 11 in use"}, "fullDescription": {"text": "Port 11 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e215e6b6b42148d5", "name": "Privileged port 10 in use", "shortDescription": {"text": "Privileged port 10 in use"}, "fullDescription": {"text": "Port 10 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aae2e6ecd78b3dcd", "name": "Privileged port 2 in use", "shortDescription": {"text": "Privileged port 2 in use"}, "fullDescription": {"text": "Port 2 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1317aa799c94640b", "name": "Privileged port 13 in use", "shortDescription": {"text": "Privileged port 13 in use"}, "fullDescription": {"text": "Port 13 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f7f2d75819ab03d2", "name": "Privileged port 45 in use", "shortDescription": {"text": "Privileged port 45 in use"}, "fullDescription": {"text": "Port 45 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cec6749c7db67250", "name": "Privileged port 988 in use", "shortDescription": {"text": "Privileged port 988 in use"}, "fullDescription": {"text": "Port 988 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ad9dc008bd80c6ee", "name": "Privileged port 1021 in use", "shortDescription": {"text": "Privileged port 1021 in use"}, "fullDescription": {"text": "Port 1021 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0639a8266ee56ff6", "name": "Privileged port 1022 in use", "shortDescription": {"text": "Privileged port 1022 in use"}, "fullDescription": {"text": "Port 1022 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9e60ce1447265af1", "name": "Privileged port 1023 in use", "shortDescription": {"text": "Privileged port 1023 in use"}, "fullDescription": {"text": "Port 1023 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8cd20d539467d2c5", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-60427b03771411b6", "name": "Dockerfile runs as root: frontend/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: frontend/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bfb1caa8d76b37a1", "name": "Docker base image is tag-pinned but not digest-pinned: node:18-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:18-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b048d166901fd868", "name": "Docker base image is tag-pinned but not digest-pinned: nginx:alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: nginx:alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ddd1f9f0f5da5a07", "name": "Insecure pattern 'weak_hash' in backend/src/modules/datasets/api/schemas/upload_schemas.py:62", "shortDescription": {"text": "Insecure pattern 'weak_hash' in backend/src/modules/datasets/api/schemas/upload_schemas.py:62"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7a926d72cf92e2a3", "name": "Possible secret in infrastructure/gitops/monitoring/alerting-rules.yaml", "shortDescription": {"text": "Possible secret in infrastructure/gitops/monitoring/alerting-rules.yaml"}, "fullDescription": {"text": "Detected pattern matching slack_token. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-c3621ebf1b2ff0f5", "name": "Insecure pattern 'direct_innerhtml_assignment' in frontend/docs/brand-palette-preview.html:561", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in frontend/docs/brand-palette-preview.html:561"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-754112febdc95087", "name": "Insecure pattern 'local_storage_auth_token' in frontend/e2e/utils/auth.ts:77", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/e2e/utils/auth.ts:77"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1c33b79e1c3b45d0", "name": "Insecure pattern 'local_storage_auth_token' in frontend/e2e/audit/auditSetup.ts:46", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/e2e/audit/auditSetup.ts:46"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6c2ac4dc00e41b8a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c1d2a7344402394d", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f3dc88ac56f32ee8", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-066b8deee4bf8178", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 9 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 68 placeholder/mock markers across 29 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bea357a6497a2d5d", "name": "Agent authority lacks a verifier contract: CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2da6fa5249dec9fb", "name": "Agent authority lacks a verifier contract: infrastructure/cdk/.claude/rules/hyperpod.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: infrastructure/cdk/.claude/rules/hyperpod.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ddaba5a405d909d7", "name": "Agent instruction/config may expose a secret: infrastructure/cdk/.claude/rules/construct-design.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: infrastructure/cdk/.claude/rules/construct-design.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-301ffb23c779df46", "name": "Agent instruction contains unpinned remote install: infrastructure/cdk/.claude/rules/tech-stack.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: infrastructure/cdk/.claude/rules/tech-stack.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-16c8ab110dec671d", "name": "Agent authority lacks a verifier contract: infrastructure/cdk/.claude/rules/configuration.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: infrastructure/cdk/.claude/rules/configuration.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-58235a38748d73df", "name": "Agent instruction/config may expose a secret: infrastructure/cdk/.claude/rules/testing.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: infrastructure/cdk/.claude/rules/testing.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2cda4c4462b10d5d", "name": "Agent instruction/config may expose a secret: infrastructure/cdk/.claude/rules/architecture.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: infrastructure/cdk/.claude/rules/architecture.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0761b055c0067f28", "name": "Agent instruction/config may expose a secret: frontend/.claude/rules/security.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: frontend/.claude/rules/security.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c1b51e188bb56f79", "name": "Agent authority lacks a verifier contract: frontend/.claude/rules/security.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: frontend/.claude/rules/security.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-257edcc2c06a032b", "name": "Agent instruction/config may expose a secret: frontend/.claude/rules/interaction-states.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: frontend/.claude/rules/interaction-states.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cdbafdeb26d6720b", "name": "Agent instruction/config may expose a secret: frontend/.claude/rules/state-management.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: frontend/.claude/rules/state-management.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-80818b0ad579841d", "name": "Agent instruction/config may expose a secret: .claude/plans/aws-deploy-e2e.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: .claude/plans/aws-deploy-e2e.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8f6d508c9d48fa9e", "name": "Agent authority lacks a verifier contract: .claude/skills/speckit-git-validate/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-git-validate/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c3b5bcae91be5465", "name": "Agent authority lacks a verifier contract: .claude/skills/speckit-plan/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-plan/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-68dfac0dc0956dd3", "name": "Agent authority lacks a verifier contract: .claude/skills/speckit-git-remote/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-git-remote/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ac8564ae12d191fd", "name": "Agent authority lacks a verifier contract: .claude/skills/speckit-git-commit/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-git-commit/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-373517c18f0b0dbb", "name": "Agent authority lacks a verifier contract: .claude/skills/speckit-checklist/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-checklist/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d6f94294a691b1fc", "name": "Agent authority lacks a verifier contract: .claude/skills/ui-audit/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/ui-audit/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0446c25aa6e2896c", "name": "Agent authority lacks a verifier contract: .claude/skills/speckit-agent-context-update/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-agent-context-update/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8492bc3758ab49c6", "name": "Agent authority lacks a verifier contract: .claude/skills/speckit-clarify/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-clarify/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-78ac78bc4ff3cf46", "name": "Agent authority lacks a verifier contract: .claude/skills/speckit-taskstoissues/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-taskstoissues/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8d996699d6c06141", "name": "Agent authority lacks a verifier contract: .claude/skills/speckit-git-initialize/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-git-initialize/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-92732a4847259da4", "name": "Agent authority lacks a verifier contract: .claude/skills/hyperpod-scheduling/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/hyperpod-scheduling/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f2805f2c7f976aed", "name": "Legacy-named symbol `list_objects_v2` in backend/tests/unit/training/test_svc_hyperpod_client.py:48", "shortDescription": {"text": "Legacy-named symbol `list_objects_v2` in backend/tests/unit/training/test_svc_hyperpod_client.py:48"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-238c05149b71ed43", "name": "Legacy-named symbol `mock_run_old` in backend/tests/unit/modules/training/application/services/test_mlflow_service.py:31", "shortDescription": {"text": "Legacy-named symbol `mock_run_old` in backend/tests/unit/modules/training/application/services/test_mlflow_service.py:314"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8f1ae6f7ed20ce4d", "name": "Legacy-named symbol `test_version_default_is_v1` in backend/tests/unit/modules/datasets/infrastructure/test_dataset_mode", "shortDescription": {"text": "Legacy-named symbol `test_version_default_is_v1` in backend/tests/unit/modules/datasets/infrastructure/test_dataset_model.py:140"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4c3e7aeaca4922b4", "name": "Legacy-named symbol `test_parse_version_v1` in backend/tests/unit/models/test_entity_model.py:184", "shortDescription": {"text": "Legacy-named symbol `test_parse_version_v1` in backend/tests/unit/models/test_entity_model.py:184"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c00c0ec8d02f95cd", "name": "Legacy-named symbol `model_v2` in backend/tests/unit/models/test_svc_model.py:106", "shortDescription": {"text": "Legacy-named symbol `model_v2` in backend/tests/unit/models/test_svc_model.py:106"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a732de31a926d83", "name": "Legacy-named symbol `list_objects_v2` in backend/tests/unit/shared/test_svc_s3_client.py:124", "shortDescription": {"text": "Legacy-named symbol `list_objects_v2` in backend/tests/unit/shared/test_svc_s3_client.py:124"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d236143bdeb5894e", "name": "Commented-code block (5 lines) in backend/tests/integration/contracts/test_api_contract_users.py:151", "shortDescription": {"text": "Commented-code block (5 lines) in backend/tests/integration/contracts/test_api_contract_users.py:151"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9d08150fcbdcc552", "name": "Legacy-named symbol `list_objects_v2` in backend/src/modules/training/infrastructure/hyperpod/checkpoint_client.py:63", "shortDescription": {"text": "Legacy-named symbol `list_objects_v2` in backend/src/modules/training/infrastructure/hyperpod/checkpoint_client.py:63"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-40cf12dfdd33cc60", "name": "Commented-code block (7 lines) in backend/src/modules/datasets/__init__.py:20", "shortDescription": {"text": "Commented-code block (7 lines) in backend/src/modules/datasets/__init__.py:20"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bb9a2c6f6e74e08f", "name": "Legacy-named symbol `list_objects_v2` in backend/src/shared/infrastructure/storage/s3_client.py:80", "shortDescription": {"text": "Legacy-named symbol `list_objects_v2` in backend/src/shared/infrastructure/storage/s3_client.py:80"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2bd82c8edc62e253", "name": "Commented-code block (7 lines) in infrastructure/cdk/stacks/compute/eks_stack.py:262", "shortDescription": {"text": "Commented-code block (7 lines) in infrastructure/cdk/stacks/compute/eks_stack.py:262"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-49a086156641316d", "name": "Legacy-named symbol `compare_v1` in frontend/src/features/models/api/modelApi.ts:49", "shortDescription": {"text": "Legacy-named symbol `compare_v1` in frontend/src/features/models/api/modelApi.ts:49"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-57f015e217d327a5", "name": "Legacy-named symbol `compare_v1` in frontend/src/features/models/api/queries.ts:49", "shortDescription": {"text": "Legacy-named symbol `compare_v1` in frontend/src/features/models/api/queries.ts:49"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2f0b21cc1644190c", "name": "Legacy-named symbol `compare_v1` in frontend/src/features/models/pages/ModelVersionsPage.tsx:63", "shortDescription": {"text": "Legacy-named symbol `compare_v1` in frontend/src/features/models/pages/ModelVersionsPage.tsx:63"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b4af897e825b12c2", "name": "Commented-code block (5 lines) in frontend/e2e/audit/routes-manifest.ts:350", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/e2e/audit/routes-manifest.ts:350"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d0b17c8c07a7421d", "name": "8 env vars used in code but missing from .env.example", "shortDescription": {"text": "8 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `AUDIT_DATE`, `CI`, `DEV`, `E2E_BASE_URL`, `E2E_PASSWORD`, `E2E_USERNAME`, `KUBERNETES_SERVICE_HOST`, `VITE_GRAFANA_URL`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/src/modules/billing/application/interfaces/resource_usage_query.py:get_training_job_stats_by_period, backend/src/modules/billing/infrastructure/repositories/resource_usage_query_impl.py:get_training_job_stats_by_period\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/src/modules/billing/application/services/cost_models.py:calculate, backend/src/modules/billing/application/services/cost_models.py:calculate, backend/src/modules/billing/application/services/cost_models.py:calculate\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1ba13502cd24b226", "name": "Frontend route `/home` has no Link/navigate to it \u2014 frontend/tests/unit/app/router/RoleGuard.test.tsx", "shortDescription": {"text": "Frontend route `/home` has no Link/navigate to it \u2014 frontend/tests/unit/app/router/RoleGuard.test.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-33df11f3d86c46e8", "name": "Frontend route `/protected` has no Link/navigate to it \u2014 frontend/tests/unit/app/router/AuthGuard.test.tsx", "shortDescription": {"text": "Frontend route `/protected` has no Link/navigate to it \u2014 frontend/tests/unit/app/router/AuthGuard.test.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eabb1c0f3181556c", "name": "FastAPI PATCH `update_dataset` without auth dependency \u2014 backend/src/modules/datasets/api/endpoints/datasets.py:138", "shortDescription": {"text": "FastAPI PATCH `update_dataset` without auth dependency \u2014 backend/src/modules/datasets/api/endpoints/datasets.py:138"}, "fullDescription": {"text": "`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cd243e1fb3b33edb", "name": "FastAPI DELETE `delete_dataset` without auth dependency \u2014 backend/src/modules/datasets/api/endpoints/datasets.py:153", "shortDescription": {"text": "FastAPI DELETE `delete_dataset` without auth dependency \u2014 backend/src/modules/datasets/api/endpoints/datasets.py:153"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-768e9ebf7ae2203c", "name": "FastAPI POST `create_dataset_version` without auth dependency \u2014 backend/src/modules/datasets/api/endpoints/datasets.py:1", "shortDescription": {"text": "FastAPI POST `create_dataset_version` without auth dependency \u2014 backend/src/modules/datasets/api/endpoints/datasets.py:164"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e07bcd25b4105b26", "name": "FastAPI POST `initiate_fsx_sync` without auth dependency \u2014 backend/src/modules/datasets/api/endpoints/fsx.py:26", "shortDescription": {"text": "FastAPI POST `initiate_fsx_sync` without auth dependency \u2014 backend/src/modules/datasets/api/endpoints/fsx.py:26"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f62357ab6a01e955", "name": "FastAPI POST `prefetch_dataset_to_fsx` without auth dependency \u2014 backend/src/modules/datasets/api/endpoints/fsx.py:66", "shortDescription": {"text": "FastAPI POST `prefetch_dataset_to_fsx` without auth dependency \u2014 backend/src/modules/datasets/api/endpoints/fsx.py:66"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7e6abd03eb8ddcb1", "name": "FastAPI DELETE `release_dataset_cache` without auth dependency \u2014 backend/src/modules/datasets/api/endpoints/fsx.py:88", "shortDescription": {"text": "FastAPI DELETE `release_dataset_cache` without auth dependency \u2014 backend/src/modules/datasets/api/endpoints/fsx.py:88"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4fe4b69b9f955a99", "name": "FastAPI POST `request_password_reset` without auth dependency \u2014 backend/src/modules/auth/api/endpoints/password.py:50", "shortDescription": {"text": "FastAPI POST `request_password_reset` without auth dependency \u2014 backend/src/modules/auth/api/endpoints/password.py:50"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-12c5daf7ea39e88a", "name": "FastAPI POST `confirm_password_reset` without auth dependency \u2014 backend/src/modules/auth/api/endpoints/password.py:67", "shortDescription": {"text": "FastAPI POST `confirm_password_reset` without auth dependency \u2014 backend/src/modules/auth/api/endpoints/password.py:67"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8bf3648c4427634c", "name": "FastAPI POST `create_user` without auth dependency \u2014 backend/src/modules/auth/api/endpoints/users.py:69", "shortDescription": {"text": "FastAPI POST `create_user` without auth dependency \u2014 backend/src/modules/auth/api/endpoints/users.py:69"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c268219cf650fec7", "name": "FastAPI PUT `update_user` without auth dependency \u2014 backend/src/modules/auth/api/endpoints/users.py:119", "shortDescription": {"text": "FastAPI PUT `update_user` without auth dependency \u2014 backend/src/modules/auth/api/endpoints/users.py:119"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24287"}, "properties": {"repository": "arch-team/ai-studio-project", "repoUrl": "https://github.com/arch-team/ai-studio-project", "branch": "main"}, "results": [{"ruleId": "scanner-5aa311f615b1a764", "level": "note", "message": {"text": "Possibly dead Python function: do_run_migrations"}, "properties": {"repobilityId": "087acb17722cfd2f", "scanner": "scanner-primary", "fingerprint": "5aa311f615b1a764", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/env.py:68"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-165514850d995924", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "165514850d995924", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/20260125_100100_9a1b2c3d4e5f_create_datasets.py:204"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2d25c102a1785e83", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "2d25c102a1785e83", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/20260612_100000_add_checkpoint_trigger_type.py:35"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0e4054340144c5db", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "0e4054340144c5db", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/20260115_100000_create_training_jobs.py:462"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-66a944873ea4b056", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "66a944873ea4b056", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/20260114_225426_a743f443fb73_add_auth_fields_and_tables.py:218"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bbd79ef6f0e9466a", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "bbd79ef6f0e9466a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/20260126_100000_create_hyperpod_clusters.py:201"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5a8db41ea3c41d6f", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "5a8db41ea3c41d6f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/20260114_221209_7778e77de8a6_create_training_job_state_transition_.py:165"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e4e4edd7683d76d4", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "e4e4edd7683d76d4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/20260222_100200_add_soft_delete_and_unique_constraint.py:47"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5ee6e9d9f2d108a5", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "5ee6e9d9f2d108a5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/20260613_140000_add_space_backend_fields.py:77"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-177ee778a68b2fd9", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "177ee778a68b2fd9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/20260126_100100_create_upload_sessions.py:199"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c0dfb9a902b394ee", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "c0dfb9a902b394ee", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/20260114_221056_206d5baf77c1_create_core_tables_users_resource_.py:299"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-10b68cff66ef5ec8", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "10b68cff66ef5ec8", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/20260222_100000_add_hyperpod_job_arn.py:35"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e11e3e0051274ece", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "e11e3e0051274ece", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/20260115_100300_add_auto_resume_checkpoint_id.py:53"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-173f07358e6a8a30", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "173f07358e6a8a30", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/20260115_100100_create_checkpoints.py:223"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e4240497d43a999f", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "e4240497d43a999f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/20260222_100300_revert_enum_to_uppercase.py:60"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9fed0e192b3759df", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 frontend/src/shared/hooks/useDebounce.ts:84"}, "properties": {"repobilityId": "8ac531f25f57e3a8", "scanner": "scanner-primary", "fingerprint": "9fed0e192b3759df", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-94b87b9f503562cd", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 frontend/src/shared/events/useEvent.ts:192"}, "properties": {"repobilityId": "86db8aee37d882bc", "scanner": "scanner-primary", "fingerprint": "94b87b9f503562cd", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a9b61daee39afd64", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 frontend/e2e/tests/resource-quotas-crud.spec.ts:699"}, "properties": {"repobilityId": "cd909bbcf2faa161", "scanner": "scanner-primary", "fingerprint": "a9b61daee39afd64", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-4d539420270d9867", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 frontend/e2e/tests/phase8-quality.spec.ts:193"}, "properties": {"repobilityId": "745d2f468c40b23e", "scanner": "scanner-primary", "fingerprint": "4d539420270d9867", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ad949eaeee2e0205", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 frontend/e2e/tests/accessibility.spec.ts:44"}, "properties": {"repobilityId": "2d0e94e9355ce478", "scanner": "scanner-primary", "fingerprint": "ad949eaeee2e0205", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2c3fe9eced4acca9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 frontend/e2e/tests/resource-quotas.spec.ts:336"}, "properties": {"repobilityId": "e39b375743e053ea", "scanner": "scanner-primary", "fingerprint": "2c3fe9eced4acca9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b57195cbeb8d2600", "level": "warning", "message": {"text": "Privileged port 8 in use"}, "properties": {"repobilityId": "8e03f5632e703751", "scanner": "scanner-primary", "fingerprint": "b57195cbeb8d2600", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "specs/001-ai-training-platform/contracts/training-jobs-api.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ff14fc65b423531", "level": "warning", "message": {"text": "Privileged port 5 in use"}, "properties": {"repobilityId": "a8f80b4866464301", "scanner": "scanner-primary", "fingerprint": "3ff14fc65b423531", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "specs/001-ai-training-platform/contracts/training-jobs-api.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2df899e8bf753a57", "level": "warning", "message": {"text": "Privileged port 12 in use"}, "properties": {"repobilityId": "65e7eefa33f2def4", "scanner": "scanner-primary", "fingerprint": "2df899e8bf753a57", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "specs/001-ai-training-platform/contracts/training-jobs-api.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a874d1f03b446320", "level": "warning", "message": {"text": "Privileged port 9 in use"}, "properties": {"repobilityId": "31590a6ba3409390", "scanner": "scanner-primary", "fingerprint": "a874d1f03b446320", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "specs/001-ai-training-platform/contracts/training-jobs-api.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-80df29fd87fb52cc", "level": "warning", "message": {"text": "Privileged port 30 in use"}, "properties": {"repobilityId": "54f172e7d16fc662", "scanner": "scanner-primary", "fingerprint": "80df29fd87fb52cc", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "specs/001-ai-training-platform/contracts/training-jobs-api.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0a33b286d44924a9", "level": "warning", "message": {"text": "Privileged port 35 in use"}, "properties": {"repobilityId": "e997ec9811d79c6d", "scanner": "scanner-primary", "fingerprint": "0a33b286d44924a9", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "specs/001-ai-training-platform/contracts/training-jobs-api.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-35062c364c5a4c1e", "level": "warning", "message": {"text": "Privileged port 11 in use"}, "properties": {"repobilityId": "5b3038c67fabb4c8", "scanner": "scanner-primary", "fingerprint": "35062c364c5a4c1e", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "specs/001-ai-training-platform/contracts/training-jobs-api.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e215e6b6b42148d5", "level": "warning", "message": {"text": "Privileged port 10 in use"}, "properties": {"repobilityId": "735372d6b5594915", "scanner": "scanner-primary", "fingerprint": "e215e6b6b42148d5", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "specs/001-ai-training-platform/contracts/training-jobs-api.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aae2e6ecd78b3dcd", "level": "warning", "message": {"text": "Privileged port 2 in use"}, "properties": {"repobilityId": "755b04866010e843", "scanner": "scanner-primary", "fingerprint": "aae2e6ecd78b3dcd", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "specs/001-ai-training-platform/contracts/training-jobs-api.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1317aa799c94640b", "level": "warning", "message": {"text": "Privileged port 13 in use"}, "properties": {"repobilityId": "79d721e4d6f64798", "scanner": "scanner-primary", "fingerprint": "1317aa799c94640b", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "specs/001-ai-training-platform/contracts/training-jobs-api.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f7f2d75819ab03d2", "level": "warning", "message": {"text": "Privileged port 45 in use"}, "properties": {"repobilityId": "73cf64d92574d41c", "scanner": "scanner-primary", "fingerprint": "f7f2d75819ab03d2", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "specs/001-ai-training-platform/contracts/training-jobs-api.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cec6749c7db67250", "level": "warning", "message": {"text": "Privileged port 988 in use"}, "properties": {"repobilityId": "a324dac403e53b49", "scanner": "scanner-primary", "fingerprint": "cec6749c7db67250", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/k8s/network-policies/training-network-policy.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ad9dc008bd80c6ee", "level": "warning", "message": {"text": "Privileged port 1021 in use"}, "properties": {"repobilityId": "c6c859f292430221", "scanner": "scanner-primary", "fingerprint": "ad9dc008bd80c6ee", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/k8s/network-policies/training-network-policy.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0639a8266ee56ff6", "level": "warning", "message": {"text": "Privileged port 1022 in use"}, "properties": {"repobilityId": "64afffb6c43dc725", "scanner": "scanner-primary", "fingerprint": "0639a8266ee56ff6", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/k8s/network-policies/training-network-policy.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9e60ce1447265af1", "level": "warning", "message": {"text": "Privileged port 1023 in use"}, "properties": {"repobilityId": "dc7b373fd581220d", "scanner": "scanner-primary", "fingerprint": "9e60ce1447265af1", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/k8s/network-policies/training-network-policy.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8cd20d539467d2c5", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "7145bd76a1c9ece3", "scanner": "scanner-primary", "fingerprint": "8cd20d539467d2c5", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-60427b03771411b6", "level": "warning", "message": {"text": "Dockerfile runs as root: frontend/Dockerfile"}, "properties": {"repobilityId": "735c01d8531dfd2c", "scanner": "scanner-primary", "fingerprint": "60427b03771411b6", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-bfb1caa8d76b37a1", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:18-alpine"}, "properties": {"repobilityId": "4a9791f3e2c7ac04", "scanner": "scanner-primary", "fingerprint": "bfb1caa8d76b37a1", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-b048d166901fd868", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: nginx:alpine"}, "properties": {"repobilityId": "bc2324da13c0cc0b", "scanner": "scanner-primary", "fingerprint": "b048d166901fd868", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/Dockerfile"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-ddd1f9f0f5da5a07", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in backend/src/modules/datasets/api/schemas/upload_schemas.py:62"}, "properties": {"repobilityId": "0271aa8280dc67e0", "scanner": "scanner-primary", "fingerprint": "ddd1f9f0f5da5a07", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/modules/datasets/api/schemas/upload_schemas.py"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-7a926d72cf92e2a3", "level": "error", "message": {"text": "Possible secret in infrastructure/gitops/monitoring/alerting-rules.yaml"}, "properties": {"repobilityId": "59d351032e2e75e8", "scanner": "scanner-primary", "fingerprint": "7a926d72cf92e2a3", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/gitops/monitoring/alerting-rules.yaml"}, "region": {"startLine": 117}}}]}, {"ruleId": "scanner-c3621ebf1b2ff0f5", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in frontend/docs/brand-palette-preview.html:561"}, "properties": {"repobilityId": "41c26d4962d82002", "scanner": "scanner-primary", "fingerprint": "c3621ebf1b2ff0f5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/docs/brand-palette-preview.html"}, "region": {"startLine": 561}}}]}, {"ruleId": "scanner-754112febdc95087", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/e2e/utils/auth.ts:77"}, "properties": {"repobilityId": "42114169fd0f7cdd", "scanner": "scanner-primary", "fingerprint": "754112febdc95087", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/e2e/utils/auth.ts"}, "region": {"startLine": 77}}}]}, {"ruleId": "scanner-1c33b79e1c3b45d0", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/e2e/audit/auditSetup.ts:46"}, "properties": {"repobilityId": "4afd0a046b3b3422", "scanner": "scanner-primary", "fingerprint": "1c33b79e1c3b45d0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/e2e/audit/auditSetup.ts"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-6c2ac4dc00e41b8a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bc431957a70600d3", "scanner": "scanner-primary", "fingerprint": "6c2ac4dc00e41b8a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yaml"}, "region": {"startLine": 123}}}]}, {"ruleId": "scanner-6c2ac4dc00e41b8a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f6c6973092d6dc30", "scanner": "scanner-primary", "fingerprint": "6c2ac4dc00e41b8a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yaml"}, "region": {"startLine": 126}}}]}, {"ruleId": "scanner-6c2ac4dc00e41b8a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c0534dcec675122a", "scanner": "scanner-primary", "fingerprint": "6c2ac4dc00e41b8a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yaml"}, "region": {"startLine": 155}}}]}, {"ruleId": "scanner-6c2ac4dc00e41b8a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "545403ff36d679d9", "scanner": "scanner-primary", "fingerprint": "6c2ac4dc00e41b8a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yaml"}, "region": {"startLine": 161}}}]}, {"ruleId": "scanner-6c2ac4dc00e41b8a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bc431957a70600d3", "scanner": "scanner-primary", "fingerprint": "6c2ac4dc00e41b8a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yaml"}, "region": {"startLine": 188}}}]}, {"ruleId": "scanner-6c2ac4dc00e41b8a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "dc36ac298b804ce7", "scanner": "scanner-primary", "fingerprint": "6c2ac4dc00e41b8a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yaml"}, "region": {"startLine": 191}}}]}, {"ruleId": "scanner-6c2ac4dc00e41b8a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c0534dcec675122a", "scanner": "scanner-primary", "fingerprint": "6c2ac4dc00e41b8a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yaml"}, "region": {"startLine": 224}}}]}, {"ruleId": "scanner-6c2ac4dc00e41b8a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "545403ff36d679d9", "scanner": "scanner-primary", "fingerprint": "6c2ac4dc00e41b8a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yaml"}, "region": {"startLine": 230}}}]}, {"ruleId": "scanner-6c2ac4dc00e41b8a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bc431957a70600d3", "scanner": "scanner-primary", "fingerprint": "6c2ac4dc00e41b8a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yaml"}, "region": {"startLine": 262}}}]}, {"ruleId": "scanner-6c2ac4dc00e41b8a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c0534dcec675122a", "scanner": "scanner-primary", "fingerprint": "6c2ac4dc00e41b8a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yaml"}, "region": {"startLine": 321}}}]}, {"ruleId": "scanner-c1d2a7344402394d", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "1c05e4f83e5ccdbb", "scanner": "scanner-primary", "fingerprint": "c1d2a7344402394d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f3dc88ac56f32ee8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d323ad6cce06af14", "scanner": "scanner-primary", "fingerprint": "f3dc88ac56f32ee8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.github/workflows/cdk-deploy.yml"}, "region": {"startLine": 97}}}]}, {"ruleId": "scanner-f3dc88ac56f32ee8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "46db8dd589b1004b", "scanner": "scanner-primary", "fingerprint": "f3dc88ac56f32ee8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.github/workflows/cdk-deploy.yml"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-f3dc88ac56f32ee8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1ae2d1bcdebcaac4", "scanner": "scanner-primary", "fingerprint": "f3dc88ac56f32ee8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.github/workflows/cdk-deploy.yml"}, "region": {"startLine": 105}}}]}, {"ruleId": "scanner-f3dc88ac56f32ee8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8175865224274227", "scanner": "scanner-primary", "fingerprint": "f3dc88ac56f32ee8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.github/workflows/cdk-deploy.yml"}, "region": {"startLine": 110}}}]}, {"ruleId": "scanner-f3dc88ac56f32ee8", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "123d4e1efe4601c7", "scanner": "scanner-primary", "fingerprint": "f3dc88ac56f32ee8", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.github/workflows/cdk-deploy.yml"}, "region": {"startLine": 126}}}]}, {"ruleId": "scanner-f3dc88ac56f32ee8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7758c15d265221e1", "scanner": "scanner-primary", "fingerprint": "f3dc88ac56f32ee8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.github/workflows/cdk-deploy.yml"}, "region": {"startLine": 211}}}]}, {"ruleId": "scanner-066b8deee4bf8178", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ccfb7593f99e9338", "scanner": "scanner-primary", "fingerprint": "066b8deee4bf8178", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.github/workflows/cdk-ci.yml"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-066b8deee4bf8178", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d0b7c0ba58a1fc9f", "scanner": "scanner-primary", "fingerprint": "066b8deee4bf8178", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.github/workflows/cdk-ci.yml"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-066b8deee4bf8178", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bec576d7b4e6ea8e", "scanner": "scanner-primary", "fingerprint": "066b8deee4bf8178", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.github/workflows/cdk-ci.yml"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-066b8deee4bf8178", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ccfb7593f99e9338", "scanner": "scanner-primary", "fingerprint": "066b8deee4bf8178", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.github/workflows/cdk-ci.yml"}, "region": {"startLine": 92}}}]}, {"ruleId": "scanner-066b8deee4bf8178", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d0b7c0ba58a1fc9f", "scanner": "scanner-primary", "fingerprint": "066b8deee4bf8178", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.github/workflows/cdk-ci.yml"}, "region": {"startLine": 95}}}]}, {"ruleId": "scanner-066b8deee4bf8178", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bec576d7b4e6ea8e", "scanner": "scanner-primary", "fingerprint": "066b8deee4bf8178", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.github/workflows/cdk-ci.yml"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-066b8deee4bf8178", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4749e9089a5de97e", "scanner": "scanner-primary", "fingerprint": "066b8deee4bf8178", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.github/workflows/cdk-ci.yml"}, "region": {"startLine": 126}}}]}, {"ruleId": "scanner-066b8deee4bf8178", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4849d14ec8b44d31", "scanner": "scanner-primary", "fingerprint": "066b8deee4bf8178", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.github/workflows/cdk-ci.yml"}, "region": {"startLine": 135}}}]}, {"ruleId": "scanner-066b8deee4bf8178", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ccfb7593f99e9338", "scanner": "scanner-primary", "fingerprint": "066b8deee4bf8178", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.github/workflows/cdk-ci.yml"}, "region": {"startLine": 158}}}]}, {"ruleId": "scanner-066b8deee4bf8178", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e0a860200cfaff31", "scanner": "scanner-primary", "fingerprint": "066b8deee4bf8178", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.github/workflows/cdk-ci.yml"}, "region": {"startLine": 161}}}]}, {"ruleId": "scanner-066b8deee4bf8178", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d0b7c0ba58a1fc9f", "scanner": "scanner-primary", "fingerprint": "066b8deee4bf8178", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.github/workflows/cdk-ci.yml"}, "region": {"startLine": 166}}}]}, {"ruleId": "scanner-066b8deee4bf8178", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bec576d7b4e6ea8e", "scanner": "scanner-primary", "fingerprint": "066b8deee4bf8178", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.github/workflows/cdk-ci.yml"}, "region": {"startLine": 171}}}]}, {"ruleId": "scanner-066b8deee4bf8178", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4749e9089a5de97e", "scanner": "scanner-primary", "fingerprint": "066b8deee4bf8178", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.github/workflows/cdk-ci.yml"}, "region": {"startLine": 194}}}]}, {"ruleId": "scanner-066b8deee4bf8178", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ccfb7593f99e9338", "scanner": "scanner-primary", "fingerprint": "066b8deee4bf8178", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.github/workflows/cdk-ci.yml"}, "region": {"startLine": 214}}}]}, {"ruleId": "scanner-066b8deee4bf8178", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e0a860200cfaff31", "scanner": "scanner-primary", "fingerprint": "066b8deee4bf8178", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.github/workflows/cdk-ci.yml"}, "region": {"startLine": 217}}}]}, {"ruleId": "scanner-066b8deee4bf8178", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d0b7c0ba58a1fc9f", "scanner": "scanner-primary", "fingerprint": "066b8deee4bf8178", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.github/workflows/cdk-ci.yml"}, "region": {"startLine": 222}}}]}, {"ruleId": "scanner-066b8deee4bf8178", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ce89631471c7e3ea", "scanner": "scanner-primary", "fingerprint": "066b8deee4bf8178", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.github/workflows/cdk-ci.yml"}, "region": {"startLine": 227}}}]}, {"ruleId": "scanner-066b8deee4bf8178", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0600996398af8cf7", "scanner": "scanner-primary", "fingerprint": "066b8deee4bf8178", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.github/workflows/cdk-ci.yml"}, "region": {"startLine": 257}}}]}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "a42d90d0d79fa906", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "2ef8062c1c70117a", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "b9b113026c74cc4b", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "d14c010b2c65e717", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "2167123079fd36c3", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-bea357a6497a2d5d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "properties": {"repobilityId": "aae72df3934829ac", "scanner": "scanner-primary", "fingerprint": "bea357a6497a2d5d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2da6fa5249dec9fb", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: infrastructure/cdk/.claude/rules/hyperpod.md"}, "properties": {"repobilityId": "2a6b1a888542a66e", "scanner": "scanner-primary", "fingerprint": "2da6fa5249dec9fb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.claude/rules/hyperpod.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ddaba5a405d909d7", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: infrastructure/cdk/.claude/rules/construct-design.md"}, "properties": {"repobilityId": "99117dcc4e7b0b82", "scanner": "scanner-primary", "fingerprint": "ddaba5a405d909d7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.claude/rules/construct-design.md"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-301ffb23c779df46", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: infrastructure/cdk/.claude/rules/tech-stack.md"}, "properties": {"repobilityId": "4397061a2801090f", "scanner": "scanner-primary", "fingerprint": "301ffb23c779df46", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.claude/rules/tech-stack.md"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-16c8ab110dec671d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: infrastructure/cdk/.claude/rules/configuration.md"}, "properties": {"repobilityId": "806ac57a767cf120", "scanner": "scanner-primary", "fingerprint": "16c8ab110dec671d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.claude/rules/configuration.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-58235a38748d73df", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: infrastructure/cdk/.claude/rules/testing.md"}, "properties": {"repobilityId": "fabbb70f13bf62cb", "scanner": "scanner-primary", "fingerprint": "58235a38748d73df", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.claude/rules/testing.md"}, "region": {"startLine": 94}}}]}, {"ruleId": "scanner-2cda4c4462b10d5d", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: infrastructure/cdk/.claude/rules/architecture.md"}, "properties": {"repobilityId": "718ba1f1d8406aa1", "scanner": "scanner-primary", "fingerprint": "2cda4c4462b10d5d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "infrastructure/cdk/.claude/rules/architecture.md"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-0761b055c0067f28", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: frontend/.claude/rules/security.md"}, "properties": {"repobilityId": "48f5a8022e862d77", "scanner": "scanner-primary", "fingerprint": "0761b055c0067f28", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/.claude/rules/security.md"}, "region": {"startLine": 127}}}]}, {"ruleId": "scanner-c1b51e188bb56f79", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: frontend/.claude/rules/security.md"}, "properties": {"repobilityId": "07914424604f9900", "scanner": "scanner-primary", "fingerprint": "c1b51e188bb56f79", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/.claude/rules/security.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-257edcc2c06a032b", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: frontend/.claude/rules/interaction-states.md"}, "properties": {"repobilityId": "dda7a2bb9a37f33f", "scanner": "scanner-primary", "fingerprint": "257edcc2c06a032b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/.claude/rules/interaction-states.md"}, "region": {"startLine": 274}}}]}, {"ruleId": "scanner-cdbafdeb26d6720b", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: frontend/.claude/rules/state-management.md"}, "properties": {"repobilityId": "de9ad51738843258", "scanner": "scanner-primary", "fingerprint": "cdbafdeb26d6720b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/.claude/rules/state-management.md"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-80818b0ad579841d", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: .claude/plans/aws-deploy-e2e.md"}, "properties": {"repobilityId": "386b627959422478", "scanner": "scanner-primary", "fingerprint": "80818b0ad579841d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/plans/aws-deploy-e2e.md"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-8f6d508c9d48fa9e", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-git-validate/SKILL.md"}, "properties": {"repobilityId": "9fb229a9a4c411ec", "scanner": "scanner-primary", "fingerprint": "8f6d508c9d48fa9e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/speckit-git-validate/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c3b5bcae91be5465", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-plan/SKILL.md"}, "properties": {"repobilityId": "2341e0da3d41719a", "scanner": "scanner-primary", "fingerprint": "c3b5bcae91be5465", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/speckit-plan/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-68dfac0dc0956dd3", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-git-remote/SKILL.md"}, "properties": {"repobilityId": "36186e62c225cbd4", "scanner": "scanner-primary", "fingerprint": "68dfac0dc0956dd3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/speckit-git-remote/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ac8564ae12d191fd", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-git-commit/SKILL.md"}, "properties": {"repobilityId": "43b42fab5524ece2", "scanner": "scanner-primary", "fingerprint": "ac8564ae12d191fd", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/speckit-git-commit/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-373517c18f0b0dbb", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-checklist/SKILL.md"}, "properties": {"repobilityId": "1667a8e4fefd656b", "scanner": "scanner-primary", "fingerprint": "373517c18f0b0dbb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/speckit-checklist/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d6f94294a691b1fc", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/ui-audit/SKILL.md"}, "properties": {"repobilityId": "04472e67f0161f0f", "scanner": "scanner-primary", "fingerprint": "d6f94294a691b1fc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/ui-audit/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0446c25aa6e2896c", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-agent-context-update/SKILL.md"}, "properties": {"repobilityId": "a5d93608a9f849db", "scanner": "scanner-primary", "fingerprint": "0446c25aa6e2896c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/speckit-agent-context-update/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8492bc3758ab49c6", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-clarify/SKILL.md"}, "properties": {"repobilityId": "9a9507eca5c0fcc2", "scanner": "scanner-primary", "fingerprint": "8492bc3758ab49c6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/speckit-clarify/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-78ac78bc4ff3cf46", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-taskstoissues/SKILL.md"}, "properties": {"repobilityId": "6d7a8ed1d27102fc", "scanner": "scanner-primary", "fingerprint": "78ac78bc4ff3cf46", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/speckit-taskstoissues/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8d996699d6c06141", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/speckit-git-initialize/SKILL.md"}, "properties": {"repobilityId": "cee680aaebe12629", "scanner": "scanner-primary", "fingerprint": "8d996699d6c06141", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/speckit-git-initialize/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-92732a4847259da4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/hyperpod-scheduling/SKILL.md"}, "properties": {"repobilityId": "1fb837aed4ad02b8", "scanner": "scanner-primary", "fingerprint": "92732a4847259da4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/hyperpod-scheduling/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f2805f2c7f976aed", "level": "note", "message": {"text": "Legacy-named symbol `list_objects_v2` in backend/tests/unit/training/test_svc_hyperpod_client.py:48"}, "properties": {"repobilityId": "6c24d9fdb693838d", "scanner": "scanner-primary", "fingerprint": "f2805f2c7f976aed", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-238c05149b71ed43", "level": "note", "message": {"text": "Legacy-named symbol `mock_run_old` in backend/tests/unit/modules/training/application/services/test_mlflow_service.py:314"}, "properties": {"repobilityId": "1907b009a403748d", "scanner": "scanner-primary", "fingerprint": "238c05149b71ed43", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8f1ae6f7ed20ce4d", "level": "note", "message": {"text": "Legacy-named symbol `test_version_default_is_v1` in backend/tests/unit/modules/datasets/infrastructure/test_dataset_model.py:140"}, "properties": {"repobilityId": "a8fb7e799ad07fba", "scanner": "scanner-primary", "fingerprint": "8f1ae6f7ed20ce4d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-4c3e7aeaca4922b4", "level": "note", "message": {"text": "Legacy-named symbol `test_parse_version_v1` in backend/tests/unit/models/test_entity_model.py:184"}, "properties": {"repobilityId": "a7ef0a66949352b0", "scanner": "scanner-primary", "fingerprint": "4c3e7aeaca4922b4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c00c0ec8d02f95cd", "level": "note", "message": {"text": "Legacy-named symbol `model_v2` in backend/tests/unit/models/test_svc_model.py:106"}, "properties": {"repobilityId": "3c15723362f96065", "scanner": "scanner-primary", "fingerprint": "c00c0ec8d02f95cd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2a732de31a926d83", "level": "note", "message": {"text": "Legacy-named symbol `list_objects_v2` in backend/tests/unit/shared/test_svc_s3_client.py:124"}, "properties": {"repobilityId": "526cdbea4af0ac22", "scanner": "scanner-primary", "fingerprint": "2a732de31a926d83", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d236143bdeb5894e", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/tests/integration/contracts/test_api_contract_users.py:151"}, "properties": {"repobilityId": "31a82b5c5fe63637", "scanner": "scanner-primary", "fingerprint": "d236143bdeb5894e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9d08150fcbdcc552", "level": "note", "message": {"text": "Legacy-named symbol `list_objects_v2` in backend/src/modules/training/infrastructure/hyperpod/checkpoint_client.py:63"}, "properties": {"repobilityId": "77ad1766e0318a39", "scanner": "scanner-primary", "fingerprint": "9d08150fcbdcc552", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-40cf12dfdd33cc60", "level": "none", "message": {"text": "Commented-code block (7 lines) in backend/src/modules/datasets/__init__.py:20"}, "properties": {"repobilityId": "85925f24eaa342e4", "scanner": "scanner-primary", "fingerprint": "40cf12dfdd33cc60", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bb9a2c6f6e74e08f", "level": "note", "message": {"text": "Legacy-named symbol `list_objects_v2` in backend/src/shared/infrastructure/storage/s3_client.py:80"}, "properties": {"repobilityId": "867d9f6634359516", "scanner": "scanner-primary", "fingerprint": "bb9a2c6f6e74e08f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2bd82c8edc62e253", "level": "none", "message": {"text": "Commented-code block (7 lines) in infrastructure/cdk/stacks/compute/eks_stack.py:262"}, "properties": {"repobilityId": "b9a8e7380a4b47f9", "scanner": "scanner-primary", "fingerprint": "2bd82c8edc62e253", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-49a086156641316d", "level": "note", "message": {"text": "Legacy-named symbol `compare_v1` in frontend/src/features/models/api/modelApi.ts:49"}, "properties": {"repobilityId": "f6383735c1020bbf", "scanner": "scanner-primary", "fingerprint": "49a086156641316d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-57f015e217d327a5", "level": "note", "message": {"text": "Legacy-named symbol `compare_v1` in frontend/src/features/models/api/queries.ts:49"}, "properties": {"repobilityId": "6405e76e618efcac", "scanner": "scanner-primary", "fingerprint": "57f015e217d327a5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2f0b21cc1644190c", "level": "note", "message": {"text": "Legacy-named symbol `compare_v1` in frontend/src/features/models/pages/ModelVersionsPage.tsx:63"}, "properties": {"repobilityId": "ba58fbb6532590b5", "scanner": "scanner-primary", "fingerprint": "2f0b21cc1644190c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b4af897e825b12c2", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/e2e/audit/routes-manifest.ts:350"}, "properties": {"repobilityId": "6f7d0b613479ce07", "scanner": "scanner-primary", "fingerprint": "b4af897e825b12c2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d0b17c8c07a7421d", "level": "note", "message": {"text": "8 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "17fe720e8247f9df", "scanner": "scanner-primary", "fingerprint": "d0b17c8c07a7421d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "66edc7cbf442e52e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e9c1f634542c8451", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "2c15905a09d1734d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "b8ed77e80afda856", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e1c7985214d25f92", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "1102aed4af3d6704", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "058713eb85a7a82b", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "321fb618308781df", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "29a4d01a4e6191c9", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "72ee877620eb489e", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "3d1d6d912eaa0e5a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "58ad947ce6e2faf6", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "b3f2b92dc2528500", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "299a21b7df80b5d8", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "7ab389c82047b695", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c4c76594a075dfa0", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "0e558bc328dba7d5", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "006256863d8aabf3", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "418905d298bd6fd3", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "b011be6a09f3c1be", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-1ba13502cd24b226", "level": "warning", "message": {"text": "Frontend route `/home` has no Link/navigate to it \u2014 frontend/tests/unit/app/router/RoleGuard.test.tsx"}, "properties": {"repobilityId": "09269d40c88942e2", "scanner": "scanner-primary", "fingerprint": "1ba13502cd24b226", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-33df11f3d86c46e8", "level": "warning", "message": {"text": "Frontend route `/protected` has no Link/navigate to it \u2014 frontend/tests/unit/app/router/AuthGuard.test.tsx"}, "properties": {"repobilityId": "d7e0b01f417cc036", "scanner": "scanner-primary", "fingerprint": "33df11f3d86c46e8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-eabb1c0f3181556c", "level": "error", "message": {"text": "FastAPI PATCH `update_dataset` without auth dependency \u2014 backend/src/modules/datasets/api/endpoints/datasets.py:138"}, "properties": {"repobilityId": "03dbb51e5554bd13", "scanner": "scanner-primary", "fingerprint": "eabb1c0f3181556c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/modules/datasets/api/endpoints/datasets.py"}, "region": {"startLine": 138}}}]}, {"ruleId": "scanner-cd243e1fb3b33edb", "level": "error", "message": {"text": "FastAPI DELETE `delete_dataset` without auth dependency \u2014 backend/src/modules/datasets/api/endpoints/datasets.py:153"}, "properties": {"repobilityId": "82a8590e2cc1d064", "scanner": "scanner-primary", "fingerprint": "cd243e1fb3b33edb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/modules/datasets/api/endpoints/datasets.py"}, "region": {"startLine": 153}}}]}, {"ruleId": "scanner-768e9ebf7ae2203c", "level": "error", "message": {"text": "FastAPI POST `create_dataset_version` without auth dependency \u2014 backend/src/modules/datasets/api/endpoints/datasets.py:164"}, "properties": {"repobilityId": "239a97471665c8fb", "scanner": "scanner-primary", "fingerprint": "768e9ebf7ae2203c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/modules/datasets/api/endpoints/datasets.py"}, "region": {"startLine": 164}}}]}, {"ruleId": "scanner-e07bcd25b4105b26", "level": "error", "message": {"text": "FastAPI POST `initiate_fsx_sync` without auth dependency \u2014 backend/src/modules/datasets/api/endpoints/fsx.py:26"}, "properties": {"repobilityId": "de8d69749c2b0918", "scanner": "scanner-primary", "fingerprint": "e07bcd25b4105b26", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/modules/datasets/api/endpoints/fsx.py"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-f62357ab6a01e955", "level": "error", "message": {"text": "FastAPI POST `prefetch_dataset_to_fsx` without auth dependency \u2014 backend/src/modules/datasets/api/endpoints/fsx.py:66"}, "properties": {"repobilityId": "e4ada68d7a5f9592", "scanner": "scanner-primary", "fingerprint": "f62357ab6a01e955", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/modules/datasets/api/endpoints/fsx.py"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-7e6abd03eb8ddcb1", "level": "error", "message": {"text": "FastAPI DELETE `release_dataset_cache` without auth dependency \u2014 backend/src/modules/datasets/api/endpoints/fsx.py:88"}, "properties": {"repobilityId": "546c94ee8d7ea1c0", "scanner": "scanner-primary", "fingerprint": "7e6abd03eb8ddcb1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/modules/datasets/api/endpoints/fsx.py"}, "region": {"startLine": 88}}}]}, {"ruleId": "scanner-4fe4b69b9f955a99", "level": "error", "message": {"text": "FastAPI POST `request_password_reset` without auth dependency \u2014 backend/src/modules/auth/api/endpoints/password.py:50"}, "properties": {"repobilityId": "363a2e3072b7d94e", "scanner": "scanner-primary", "fingerprint": "4fe4b69b9f955a99", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/modules/auth/api/endpoints/password.py"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-12c5daf7ea39e88a", "level": "error", "message": {"text": "FastAPI POST `confirm_password_reset` without auth dependency \u2014 backend/src/modules/auth/api/endpoints/password.py:67"}, "properties": {"repobilityId": "c0c214a5dda67884", "scanner": "scanner-primary", "fingerprint": "12c5daf7ea39e88a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/modules/auth/api/endpoints/password.py"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-8bf3648c4427634c", "level": "error", "message": {"text": "FastAPI POST `create_user` without auth dependency \u2014 backend/src/modules/auth/api/endpoints/users.py:69"}, "properties": {"repobilityId": "3993dcd4cf5e470b", "scanner": "scanner-primary", "fingerprint": "8bf3648c4427634c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/modules/auth/api/endpoints/users.py"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-c268219cf650fec7", "level": "error", "message": {"text": "FastAPI PUT `update_user` without auth dependency \u2014 backend/src/modules/auth/api/endpoints/users.py:119"}, "properties": {"repobilityId": "6de3e38e40ef1407", "scanner": "scanner-primary", "fingerprint": "c268219cf650fec7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/modules/auth/api/endpoints/users.py"}, "region": {"startLine": 119}}}]}]}]}