{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-81aaee1260f3d295", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/main-templates/berlin-press/AmCatalogClient.tsx", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/main-templates/berlin-press/AmCatalogClient.tsx:379"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a70261ed5f020b49", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/main-templates/berlin-press/ProductCard.tsx:292", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/main-templates/berlin-press/ProductCard.tsx:292"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-de88be057d48c675", "name": "TODO/FIXME marker in shipping code \u2014 apps/web/app/actions.ts:184", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 apps/web/app/actions.ts:184"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5325e9fca9080555", "name": "Icon-only button without accessible name \u2014 apps/web/app/super-admin/tenants/[id]/payment-providers/page.tsx:985", "shortDescription": {"text": "Icon-only button without accessible name \u2014 apps/web/app/super-admin/tenants/[id]/payment-providers/page.tsx:985"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-da1881977a4acc2d", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/app/t/[tenantSlug]/(tenant)/journal/[slug]/page.tsx:109", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/app/t/[tenantSlug]/(tenant)/journal/[slug]/page.tsx:109"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-05644a4e4f8a4805", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/app/t/[tenantSlug]/(tenant)/impressum/page.tsx:73", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/app/t/[tenantSlug]/(tenant)/impressum/page.tsx:73"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9bd2c0e7f9c84374", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/app/t/[tenantSlug]/(tenant)/terms/page.tsx:73", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/app/t/[tenantSlug]/(tenant)/terms/page.tsx:73"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2903348f0bfac791", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/app/t/[tenantSlug]/(tenant)/privacy/page.tsx:75", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/app/t/[tenantSlug]/(tenant)/privacy/page.tsx:75"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-92f1191b4ec89a96", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/app/t/[tenantSlug]/(storefront)/[branchSlug]/admin/journa", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/app/t/[tenantSlug]/(storefront)/[branchSlug]/admin/journal/[id]/page.tsx:648"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7b86d5218ea0ce27", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/app/t/[tenantSlug]/(storefront)/[branchSlug]/admin/conten", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/app/t/[tenantSlug]/(storefront)/[branchSlug]/admin/content/page.tsx:142"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-af74dec70e0c07d8", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/tools/smoke-test-bus.ts:6", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/tools/smoke-test-bus.ts:6"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d7549dcc3e2756fd", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/instrumentation.ts:17", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/instrumentation.ts:17"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d5c82a87bde15bd", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/__tests__/setup.ts:6", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/__tests__/setup.ts:6"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-655b942216a27c0f", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/__tests__/integration/audit-branches-tenant-auth.probe.ts:52", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/__tests__/integration/audit-branches-tenant-auth.probe.ts:52"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ed43891db98b6733", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/utils/timezone-helpers.ts:42", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/utils/timezone-helpers.ts:42"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-24c4bf6ffd90b02a", "name": "TODO/FIXME marker in shipping code \u2014 apps/bff/src/services/pubsub.ts:38", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 apps/bff/src/services/pubsub.ts:38"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-36fa182382aa219e", "name": "TODO/FIXME marker in shipping code \u2014 apps/bff/src/services/audit-logger.ts:52", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 apps/bff/src/services/audit-logger.ts:52"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-dfaaa8012b0afb20", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/services/audit-logger.ts:50", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/services/audit-logger.ts:50"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749ac7b3f56904f0", "name": "TODO/FIXME marker in shipping code \u2014 apps/bff/src/services/domain-provider/cloudflare.ts:16", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 apps/bff/src/services/domain-provider/cloudflare.ts:16"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c180aad55b5898ce", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdMollieManualPayVerify.ts:157", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdMollieManualPayVerify.ts:157"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce16fbdcee1c4ab8", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLiqpayTenantDiscovery.ts:145", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLiqpayTenantDiscovery.ts:145"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea817e0174017975", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/probeUpstream.ts:128", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/probeUpstream.ts:128"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-21d0af948fa74fb0", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLocalSmokeUnmatched.ts:129", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLocalSmokeUnmatched.ts:129"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-81181badf9c9e01a", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdMollieE2E.ts:248", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdMollieE2E.ts:248"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e92b08c11fc8339", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/captureUpstream.ts:35", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/captureUpstream.ts:35"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-abc415fcf6dd92c9", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdSmokeSweeperInitiatedTransaction.ts:145", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdSmokeSweeperInitiatedTransaction.ts:145"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-96bf0c3c80bcb1d3", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLocalSmokeUnmatchedBackoff.ts:139", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLocalSmokeUnmatchedBackoff.ts:139"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52c27f1f1ec3bcc0", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLocalSmokeResyncTransactionTransient.ts:156", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLocalSmokeResyncTransactionTransient.ts:156"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea53ae8ea40c76d5", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLiqpayLabSetup.ts:126", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLiqpayLabSetup.ts:126"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6ba0f65e074e0dcb", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsMonobankTenantDiscovery.ts:78", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsMonobankTenantDiscovery.ts:78"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-05b491583fc9cb68", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsIncidentDrillRunner.ts:132", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsIncidentDrillRunner.ts:132"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb113e89af9a512f", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLocalSmokeResyncTransactionMissingSecret.ts:137", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLocalSmokeResyncTransactionMissingSecret.ts:137"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7962cfb728cc2f83", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLiqpayGoLiveChecklist.ts:162", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLiqpayGoLiveChecklist.ts:162"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-51d4cfc50bf6d255", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdSmokeUnmatchedResyncExternal.ts:116", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdSmokeUnmatchedResyncExternal.ts:116"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ae9c46ff3229af02", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsMollieLabSetup.ts:104", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsMollieLabSetup.ts:104"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e3b1f93e4acc7d2e", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsMollieTenantDiscovery.ts:69", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsMollieTenantDiscovery.ts:69"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9077e926b65f823", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdSmokePreflight.ts:18", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdSmokePreflight.ts:18"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6e483936aa3dfcdd", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLocalSmokeCheckoutRecoverMissingSecret.ts:160", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLocalSmokeCheckoutRecoverMissingSecret.ts:160"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-963cabedc32f34c5", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsCleanupAudit.ts:185", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsCleanupAudit.ts:185"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f8dbc59191385b93", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsMollieGoLiveChecklist.ts:123", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsMollieGoLiveChecklist.ts:123"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a4c8274f9ebc2221", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdMollieManualPayPrep.ts:70", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdMollieManualPayPrep.ts:70"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7440228fba7439ef", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsMonobankLabSetup.ts:125", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsMonobankLabSetup.ts:125"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bb05f3f29cc1f53b", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsMonobankGoLiveChecklist.ts:141", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsMonobankGoLiveChecklist.ts:141"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-baf5db9e682b444a", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/upstreamHttpContractSmoke.ts:7", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/upstreamHttpContractSmoke.ts:7"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-85c00214ef395a25", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLocalSmokeCheckoutRecover.ts:151", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLocalSmokeCheckoutRecover.ts:151"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d3eb837938514e74", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLocalSmokeUnmatchedGiveUp.ts:129", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLocalSmokeUnmatchedGiveUp.ts:129"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1940be0aa0320a4a", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsDataIntegrityAudit.ts:255", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsDataIntegrityAudit.ts:255"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f86dcee8f8277757", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/upstreamHttpSmoke.ts:181", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/upstreamHttpSmoke.ts:181"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e16ec6c083456a22", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsMollieSetCredentialsRef.ts:38", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsMollieSetCredentialsRef.ts:38"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7ee6da445d384bf4", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdSmokeResyncTransaction.ts:123", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdSmokeResyncTransaction.ts:123"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-216912c2d21f90a9", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdSmokeCheckoutRecover.ts:153", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdSmokeCheckoutRecover.ts:153"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7f802ffdf46ba4c0", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsGoLiveRehearsal.ts:1009", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsGoLiveRehearsal.ts:1009"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ff9721e25326f555", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdSmokeWebhookProcess.ts:161", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdSmokeWebhookProcess.ts:161"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c51d009a80870cb", "name": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdSmokeSweeperReceivedEvent.ts:107", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdSmokeSweeperReceivedEvent.ts:107"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d1bc5f9d34b4ecf", "name": "TODO/FIXME marker in shipping code \u2014 apps/bff/src/domains/storefront/customer/otp.service.ts:35", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 apps/bff/src/domains/storefront/customer/otp.service.ts:35"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ef5453f52717880c", "name": "Stray `console.log` in TS/JS \u2014 scripts/backfill-berlin-press-content.ts:75", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/backfill-berlin-press-content.ts:75"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4590f7fa5c49a6d3", "name": "Stray `console.log` in TS/JS \u2014 packages/database/create-super-admin.ts:11", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/database/create-super-admin.ts:11"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b788b91e44750b4c", "name": "Stray `console.log` in TS/JS \u2014 packages/database/check-super-admin.ts:14", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/database/check-super-admin.ts:14"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b687582eeb3b8427", "name": "Stray `console.log` in TS/JS \u2014 packages/database/scripts/create-user.ts:15", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/database/scripts/create-user.ts:15"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-395c5643044e0fa7", "name": "Stray `console.log` in TS/JS \u2014 packages/database/scripts/check-default-variant.ts:35", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/database/scripts/check-default-variant.ts:35"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-db370238f98f7288", "name": "Stray `console.log` in TS/JS \u2014 packages/database/scripts/clear-branch-timezones.ts:31", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/database/scripts/clear-branch-timezones.ts:31"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c2226664ec6b6697", "name": "Stray `console.log` in TS/JS \u2014 packages/database/scripts/isolation-test.ts:35", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/database/scripts/isolation-test.ts:35"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6581d34c866ffc93", "name": "Stray `console.log` in TS/JS \u2014 packages/database/scripts/import-journal-from-amcontent.ts:74", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/database/scripts/import-journal-from-amcontent.ts:74"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fcdcf6e69ed59cdc", "name": "Stray `console.log` in TS/JS \u2014 packages/database/prisma/seed.ts:5", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/database/prisma/seed.ts:5"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-82ea6c390c997bed", "name": "Stray `console.log` in TS/JS \u2014 packages/database/prisma/seed-berlin.ts:217", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/database/prisma/seed-berlin.ts:217"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7673561931a5dd33", "name": "Dockerfile runs as root: apps/web/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: apps/web/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9c5a68d50e3bbbc4", "name": "Docker base image is tag-pinned but not digest-pinned: node:20-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6aa94b493d5b29ce", "name": "Dockerfile runs as root: apps/bff/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: apps/bff/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-67231b5843beed45", "name": "Docker base image is tag-pinned but not digest-pinned: node:20-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-35c4ee1fc33c0892", "name": "Insecure pattern 'dangerous_innerhtml' in apps/web/app/t/[tenantSlug]/(tenant)/journal/[slug]/page.tsx:109", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/app/t/[tenantSlug]/(tenant)/journal/[slug]/page.tsx:109"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-49c10148b713eb24", "name": "Insecure pattern 'dangerous_innerhtml' in apps/web/app/t/[tenantSlug]/(tenant)/impressum/page.tsx:73", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/app/t/[tenantSlug]/(tenant)/impressum/page.tsx:73"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8127c275df0b919f", "name": "Insecure pattern 'dangerous_innerhtml' in apps/web/app/t/[tenantSlug]/(tenant)/terms/page.tsx:73", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/app/t/[tenantSlug]/(tenant)/terms/page.tsx:73"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e439175f1f975663", "name": "Insecure pattern 'dangerous_innerhtml' in apps/web/app/t/[tenantSlug]/(tenant)/privacy/page.tsx:75", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/app/t/[tenantSlug]/(tenant)/privacy/page.tsx:75"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-455fdab2c768a4b0", "name": "Insecure pattern 'dangerous_innerhtml' in apps/web/app/t/[tenantSlug]/(storefront)/[branchSlug]/admin/journal/[id]/page.", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/app/t/[tenantSlug]/(storefront)/[branchSlug]/admin/journal/[id]/page.tsx:648"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-38a579b60df113a2", "name": "Insecure pattern 'dangerous_innerhtml' in apps/web/app/t/[tenantSlug]/(storefront)/[branchSlug]/admin/content/page.tsx:1", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/app/t/[tenantSlug]/(storefront)/[branchSlug]/admin/content/page.tsx:142"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a7a0856e8cae52ac", "name": "Possible secret in apps/bff/src/tools/upstreamHttpSmoke.ts", "shortDescription": {"text": "Possible secret in apps/bff/src/tools/upstreamHttpSmoke.ts"}, "fullDescription": {"text": "Detected pattern matching generic_api_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-740c236adcc04193", "name": "Insecure pattern 'node_child_process' in apps/bff/src/tools/paymentsGoLiveRehearsal.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in apps/bff/src/tools/paymentsGoLiveRehearsal.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-688cdbe5289259a6", "name": "Insecure pattern 'node_child_process' in scripts/check-legacy-working-hours-selftest.mjs:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/check-legacy-working-hours-selftest.mjs:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-799096e08accfa41", "name": "Insecure pattern 'node_child_process' in scripts/run-e2e.mjs:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/run-e2e.mjs:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7beced2861f48bf7", "name": "Insecure pattern 'node_child_process' in scripts/run-lhci.mjs:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/run-lhci.mjs:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-81ac249bf3fb46aa", "name": "Insecure pattern 'node_child_process' in scripts/guardrails/themes.mjs:7", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/guardrails/themes.mjs:7"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9855bdc7f9c5d2ed", "name": "Insecure pattern 'node_child_process' in scripts/guardrails/themes-self-check.mjs:11", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/guardrails/themes-self-check.mjs:11"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-511dcc03c0709d1a", "name": "Insecure pattern 'node_child_process' in scripts/guardrails/test-bff-alias-bypass.mjs:11", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/guardrails/test-bff-alias-bypass.mjs:11"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9daf0d1d8bdd4272", "name": "Possible secret in packages/database/create-super-admin.ts", "shortDescription": {"text": "Possible secret in packages/database/create-super-admin.ts"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-6ac8127d13bde8be", "name": "Possible secret in tools/smoke-theme-propagation.sh", "shortDescription": {"text": "Possible secret in tools/smoke-theme-propagation.sh"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e9e20870d968e45d", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8883e975a3c6b57", "name": "Very large file: apps/web/app/super-admin/page.tsx (1295 lines)", "shortDescription": {"text": "Very large file: apps/web/app/super-admin/page.tsx (1295 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b11e488b7066e563", "name": "Very large file: apps/web/app/super-admin/tenants/[id]/payment-providers/page.tsx (1050 lines)", "shortDescription": {"text": "Very large file: apps/web/app/super-admin/tenants/[id]/payment-providers/page.tsx (1050 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9929605d11dd4d25", "name": "Very large file: apps/web/app/t/[tenantSlug]/(storefront)/[branchSlug]/admin/content/page.tsx (6403 lines)", "shortDescription": {"text": "Very large file: apps/web/app/t/[tenantSlug]/(storefront)/[branchSlug]/admin/content/page.tsx (6403 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ce501b7ae1e5c5d", "name": "Very large file: apps/web/app/t/[tenantSlug]/(storefront)/[branchSlug]/admin/menu/page.tsx (1253 lines)", "shortDescription": {"text": "Very large file: apps/web/app/t/[tenantSlug]/(storefront)/[branchSlug]/admin/menu/page.tsx (1253 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dcdbc3f795f8c5f1", "name": "Very large file: packages/database/scripts/isolation-test.ts (1189 lines)", "shortDescription": {"text": "Very large file: packages/database/scripts/isolation-test.ts (1189 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "113 tests / 453 src (ratio 0.25)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4a9eb7dc7c6e3880", "name": "Node manifest has dependencies but no lockfile: apps/web/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/web/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6dbe4b2b47f0602d", "name": "Node manifest has dependencies but no lockfile: apps/bff/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/bff/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a9ae6ff389a0d8d", "name": "Node manifest has dependencies but no lockfile: packages/tenant-resolver/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/tenant-resolver/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2699d5f16ae11282", "name": "Node manifest has dependencies but no lockfile: packages/shared/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/shared/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb01c01804de0b47", "name": "Node manifest has dependencies but no lockfile: packages/database/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/database/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f85d8f0719e22fa8", "name": "Node manifest has dependencies but no lockfile: packages/contracts/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/contracts/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 396 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 114 placeholder/mock markers across 33 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4e97b53cf620b2c2", "name": "Legacy-named symbol `am_berlin_search_history_v1` in apps/web/components/main-templates/berlin-press/AmHeaderSearch.tsx:", "shortDescription": {"text": "Legacy-named symbol `am_berlin_search_history_v1` in apps/web/components/main-templates/berlin-press/AmHeaderSearch.tsx:7"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f71b3077910e93ae", "name": "Legacy-named symbol `vendora_cart_v1` in apps/web/components/cart/CartProvider.tsx:10", "shortDescription": {"text": "Legacy-named symbol `vendora_cart_v1` in apps/web/components/cart/CartProvider.tsx:10"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-107a47aeea4e3951", "name": "Commented-code block (7 lines) in apps/web/components/profile/RepeatButton.tsx:24", "shortDescription": {"text": "Commented-code block (7 lines) in apps/web/components/profile/RepeatButton.tsx:24"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-91ec669e56ba60e7", "name": "Legacy-named symbol `priceOld` in apps/web/components/menu/MenuClient.tsx:133", "shortDescription": {"text": "Legacy-named symbol `priceOld` in apps/web/components/menu/MenuClient.tsx:133"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d93c18cdfa95fdea", "name": "Commented-code block (5 lines) in apps/web/components/menu/MenuClient.tsx:46", "shortDescription": {"text": "Commented-code block (5 lines) in apps/web/components/menu/MenuClient.tsx:46"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-66045bdfddaa553f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/app/media/[...key]/route.ts:71", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/app/media/[...key]/route.ts:71"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-06fd875d740d4bf8", "name": "Commented-code block (6 lines) in apps/web/app/super-admin/page.tsx:275", "shortDescription": {"text": "Commented-code block (6 lines) in apps/web/app/super-admin/page.tsx:275"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b5e7085fa88a0a9e", "name": "Commented-code block (10 lines) in apps/web/app/super-admin/tenants/[id]/domains/page.tsx:44", "shortDescription": {"text": "Commented-code block (10 lines) in apps/web/app/super-admin/tenants/[id]/domains/page.tsx:44"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-feca796cca2857f6", "name": "Legacy-named symbol `priceOld` in apps/web/app/t/[tenantSlug]/(storefront)/[branchSlug]/page.tsx:87", "shortDescription": {"text": "Legacy-named symbol `priceOld` in apps/web/app/t/[tenantSlug]/(storefront)/[branchSlug]/page.tsx:87"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-96a244c2bd835f3d", "name": "Legacy-named symbol `priceOld` in apps/web/app/t/[tenantSlug]/(storefront)/[branchSlug]/p/[id]/page.tsx:75", "shortDescription": {"text": "Legacy-named symbol `priceOld` in apps/web/app/t/[tenantSlug]/(storefront)/[branchSlug]/p/[id]/page.tsx:75"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7fa962177d8eeef0", "name": "Commented-code block (12 lines) in apps/web/app/checkout/test-payment/page.tsx:37", "shortDescription": {"text": "Commented-code block (12 lines) in apps/web/app/checkout/test-payment/page.tsx:37"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-051a4733119961bc", "name": "Commented-code block (5 lines) in apps/web/lib/data.ts:172", "shortDescription": {"text": "Commented-code block (5 lines) in apps/web/lib/data.ts:172"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2a3afef0e1517e29", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/lib/data.ts:205", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/lib/data.ts:205"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5443887ebc15e31b", "name": "Commented-code block (5 lines) in apps/bff/test/delivery-routes.notfound-no-cache.test.ts:98", "shortDescription": {"text": "Commented-code block (5 lines) in apps/bff/test/delivery-routes.notfound-no-cache.test.ts:98"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-002c0862ff9dbecd", "name": "Commented-code block (6 lines) in apps/bff/src/index.ts:135", "shortDescription": {"text": "Commented-code block (6 lines) in apps/bff/src/index.ts:135"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9c701ad26d388a34", "name": "Commented-code block (5 lines) in apps/bff/src/__tests__/integration/multi-tenant-flow.test.ts:654", "shortDescription": {"text": "Commented-code block (5 lines) in apps/bff/src/__tests__/integration/multi-tenant-flow.test.ts:654"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-687202ea81111fb7", "name": "Commented-code block (5 lines) in apps/bff/src/cache/tiered.ts:123", "shortDescription": {"text": "Commented-code block (5 lines) in apps/bff/src/cache/tiered.ts:123"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0d8f49ac8a40d1df", "name": "Commented-code block (6 lines) in apps/bff/src/services/pubsub.ts:31", "shortDescription": {"text": "Commented-code block (6 lines) in apps/bff/src/services/pubsub.ts:31"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f424ba994b4bc5fa", "name": "Commented-code block (5 lines) in apps/bff/src/services/theme.ts:321", "shortDescription": {"text": "Commented-code block (5 lines) in apps/bff/src/services/theme.ts:321"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f5ac0b9e69cceec1", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/bff/src/services/http.ts:103", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/bff/src/services/http.ts:103"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ffe8d626f918fc5b", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/bff/src/tools/paymentsGoLiveRehearsal.ts:631", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/bff/src/tools/paymentsGoLiveRehearsal.ts:631"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1f12b7ff0110987d", "name": "Commented-code block (7 lines) in apps/bff/src/plugins/tenant-context.ts:81", "shortDescription": {"text": "Commented-code block (7 lines) in apps/bff/src/plugins/tenant-context.ts:81"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d15c2a47639d9d4b", "name": "Commented-code block (5 lines) in apps/bff/src/plugins/__tests__/tenant-guard.test.ts:351", "shortDescription": {"text": "Commented-code block (5 lines) in apps/bff/src/plugins/__tests__/tenant-guard.test.ts:351"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-40feef99e2afe4c4", "name": "Commented-code block (5 lines) in apps/bff/src/domains/super-admin/domains.routes.ts:34", "shortDescription": {"text": "Commented-code block (5 lines) in apps/bff/src/domains/super-admin/domains.routes.ts:34"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9c0205c73ff1d2e5", "name": "Commented-code block (9 lines) in apps/bff/src/domains/super-admin/tenants.routes.ts:296", "shortDescription": {"text": "Commented-code block (9 lines) in apps/bff/src/domains/super-admin/tenants.routes.ts:296"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fc6700177fdf69bc", "name": "Commented-code block (6 lines) in apps/bff/src/domains/storefront/ordering/validation.ts:288", "shortDescription": {"text": "Commented-code block (6 lines) in apps/bff/src/domains/storefront/ordering/validation.ts:288"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c5dcf404a1d6b2b4", "name": "Commented-code block (8 lines) in apps/bff/src/domains/storefront/ordering/timeslots.routes.ts:145", "shortDescription": {"text": "Commented-code block (8 lines) in apps/bff/src/domains/storefront/ordering/timeslots.routes.ts:145"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2ee93f6053ef674d", "name": "Commented-code block (6 lines) in apps/bff/src/domains/storefront/places/branches.routes.ts:28", "shortDescription": {"text": "Commented-code block (6 lines) in apps/bff/src/domains/storefront/places/branches.routes.ts:28"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a6c7afda2b3f5f08", "name": "Commented-code block (11 lines) in scripts/guardrails/themes-bff.mjs:46", "shortDescription": {"text": "Commented-code block (11 lines) in scripts/guardrails/themes-bff.mjs:46"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bf975e657461f196", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/guardrails/themes-web.mjs:100", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/guardrails/themes-web.mjs:100"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2153571a4d5dd99f", "name": "78 env vars used in code but missing from .env.example", "shortDescription": {"text": "78 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `BASE_DOMAIN`, `BFF_INTERNAL_BASE_URL`, `CACHE_L1_MAX`, `CACHE_L1_TTL`, `CACHE_L2_MAX`, `CACHE_L2_TTL`, `CACHE_WARMER_ENABLED`, `CREDENTIALS_REF` + 70 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-184b5595a7424d3d", "name": "Dangling fetch: GET /config (scripts/guardrails/themes-web.mjs:100)", "shortDescription": {"text": "Dangling fetch: GET /config (scripts/guardrails/themes-web.mjs:100)"}, "fullDescription": {"text": "`scripts/guardrails/themes-web.mjs:100` calls `GET /config` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/config`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6dfdb737e881ef3e", "name": "Dangling fetch: GET https://${domain}/.well-known/vendora-verification/${verificationToken} (apps/bff/src/services/dns-l", "shortDescription": {"text": "Dangling fetch: GET https://${domain}/.well-known/vendora-verification/${verificationToken} (apps/bff/src/services/dns-lookup.ts:111)"}, "fullDescription": {"text": "`apps/bff/src/services/dns-lookup.ts:111` calls `GET https://${domain}/.well-known/vendora-verification/${verificationToken}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/<p>/.well-known/vendora-verification/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-36406553ba87d204", "name": "Dangling fetch: POST https://api.vercel.com/v9/projects/${this.projectId}/domains (apps/bff/src/services/domain-provider", "shortDescription": {"text": "Dangling fetch: POST https://api.vercel.com/v9/projects/${this.projectId}/domains (apps/bff/src/services/domain-provider/vercel.ts:35)"}, "fullDescription": {"text": "`apps/bff/src/services/domain-provider/vercel.ts:35` calls `POST https://api.vercel.com/v9/projects/${this.projectId}/domains` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.vercel.com/v9/projects/<p>/domains`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6afbaceaee46915a", "name": "Dangling fetch: DELETE https://api.vercel.com/v9/projects/${this.projectId}/domains/${providerDomainId} (apps/bff/src/se", "shortDescription": {"text": "Dangling fetch: DELETE https://api.vercel.com/v9/projects/${this.projectId}/domains/${providerDomainId} (apps/bff/src/services/domain-provider/vercel.ts:96)"}, "fullDescription": {"text": "`apps/bff/src/services/domain-provider/vercel.ts:96` calls `DELETE https://api.vercel.com/v9/projects/${this.projectId}/domains/${providerDomainId}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.vercel.com/v9/projects/<p>/domains/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6e58fa552730c793", "name": "Dangling fetch: GET https://${domain}/.well-known/vendora-verification/${expectedToken} (packages/tenant-resolver/src/dn", "shortDescription": {"text": "Dangling fetch: GET https://${domain}/.well-known/vendora-verification/${expectedToken} (packages/tenant-resolver/src/dns.ts:122)"}, "fullDescription": {"text": "`packages/tenant-resolver/src/dns.ts:122` calls `GET https://${domain}/.well-known/vendora-verification/${expectedToken}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/<p>/.well-known/vendora-verification/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7b9bd99d6bbe8b8d", "name": "Unused endpoint: GET /example", "shortDescription": {"text": "Unused endpoint: GET /example"}, "fullDescription": {"text": "`apps/bff/src/types/routes.ts` declares `GET /example` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c059f57186114027", "name": "Unused endpoint: POST /auth/logout", "shortDescription": {"text": "Unused endpoint: POST /auth/logout"}, "fullDescription": {"text": "`apps/bff/src/domains/auth/auth.routes.ts` declares `POST /auth/logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dacb1640e17dcbe5", "name": "Unused endpoint: GET /internal/resolve-tenant", "shortDescription": {"text": "Unused endpoint: GET /internal/resolve-tenant"}, "fullDescription": {"text": "`apps/bff/src/domains/internal/internal.routes.ts` declares `GET /internal/resolve-tenant` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-648fc3a2166d5c27", "name": "Unused endpoint: POST /internal/payments/resync", "shortDescription": {"text": "Unused endpoint: POST /internal/payments/resync"}, "fullDescription": {"text": "`apps/bff/src/domains/internal/internal-payments.routes.ts` declares `POST /internal/payments/resync` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e85a83b0cd4671e", "name": "Unused endpoint: POST /internal/payments/resync/external", "shortDescription": {"text": "Unused endpoint: POST /internal/payments/resync/external"}, "fullDescription": {"text": "`apps/bff/src/domains/internal/internal-payments.routes.ts` declares `POST /internal/payments/resync/external` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-01b064324cf0ccbe", "name": "Unused endpoint: GET /integrations", "shortDescription": {"text": "Unused endpoint: GET /integrations"}, "fullDescription": {"text": "`apps/bff/src/domains/admin/integrations/integrations.routes.ts` declares `GET /integrations` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-841e50bf821e4158", "name": "Unused endpoint: GET /users", "shortDescription": {"text": "Unused endpoint: GET /users"}, "fullDescription": {"text": "`apps/bff/src/domains/admin/users/users.routes.ts` declares `GET /users` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1bca8100a44f7f25", "name": "Unused endpoint: POST /users", "shortDescription": {"text": "Unused endpoint: POST /users"}, "fullDescription": {"text": "`apps/bff/src/domains/admin/users/users.routes.ts` declares `POST /users` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d0b75c541565cd9", "name": "Unused endpoint: GET /journal", "shortDescription": {"text": "Unused endpoint: GET /journal"}, "fullDescription": {"text": "`apps/bff/src/domains/admin/journal/journal.routes.ts` declares `GET /journal` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6236b283b79811b8", "name": "Unused endpoint: POST /upload", "shortDescription": {"text": "Unused endpoint: POST /upload"}, "fullDescription": {"text": "`apps/bff/src/domains/admin/media/media.routes.ts` declares `POST /upload` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d7659b88734aa2b5", "name": "Unused endpoint: POST /admin/upload", "shortDescription": {"text": "Unused endpoint: POST /admin/upload"}, "fullDescription": {"text": "`apps/bff/src/domains/admin/media/media.routes.ts` declares `POST /admin/upload` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd1dc91abf32142d", "name": "Unused endpoint: GET /me", "shortDescription": {"text": "Unused endpoint: GET /me"}, "fullDescription": {"text": "`apps/bff/src/domains/admin/dashboard/dashboard.routes.ts` declares `GET /me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c95279f2a3ad3db", "name": "Unused endpoint: PUT /:branchSlug/catalog-items/:id/nutrition", "shortDescription": {"text": "Unused endpoint: PUT /:branchSlug/catalog-items/:id/nutrition"}, "fullDescription": {"text": "`apps/bff/src/domains/admin/catalog/nutrition.routes.ts` declares `PUT /:branchSlug/catalog-items/:id/nutrition` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c0adc9adab76f12b", "name": "Unused endpoint: GET /attribute-definitions", "shortDescription": {"text": "Unused endpoint: GET /attribute-definitions"}, "fullDescription": {"text": "`apps/bff/src/domains/admin/catalog/attribute-definitions.routes.ts` declares `GET /attribute-definitions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4e06fac8815605d6", "name": "Unused endpoint: POST /:branchSlug/option-groups", "shortDescription": {"text": "Unused endpoint: POST /:branchSlug/option-groups"}, "fullDescription": {"text": "`apps/bff/src/domains/admin/catalog/option-groups.routes.ts` declares `POST /:branchSlug/option-groups` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-51182056c45091fd", "name": "Unused endpoint: PATCH /:branchSlug/option-groups/:id", "shortDescription": {"text": "Unused endpoint: PATCH /:branchSlug/option-groups/:id"}, "fullDescription": {"text": "`apps/bff/src/domains/admin/catalog/option-groups.routes.ts` declares `PATCH /:branchSlug/option-groups/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5b4186a8e48b03d0", "name": "Unused endpoint: POST /:branchSlug/option-groups/:id/options", "shortDescription": {"text": "Unused endpoint: POST /:branchSlug/option-groups/:id/options"}, "fullDescription": {"text": "`apps/bff/src/domains/admin/catalog/option-groups.routes.ts` declares `POST /:branchSlug/option-groups/:id/options` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2bed484e65a6f796", "name": "Unused endpoint: PATCH /:branchSlug/option-groups/:optionGroupId/options/:id", "shortDescription": {"text": "Unused endpoint: PATCH /:branchSlug/option-groups/:optionGroupId/options/:id"}, "fullDescription": {"text": "`apps/bff/src/domains/admin/catalog/option-groups.routes.ts` declares `PATCH /:branchSlug/option-groups/:optionGroupId/options/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-369b73a24719fbb5", "name": "Unused endpoint: POST /:branchSlug/catalog-items/:id/option-groups", "shortDescription": {"text": "Unused endpoint: POST /:branchSlug/catalog-items/:id/option-groups"}, "fullDescription": {"text": "`apps/bff/src/domains/admin/catalog/option-groups.routes.ts` declares `POST /:branchSlug/catalog-items/:id/option-groups` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e13e23bbff75124d", "name": "Unused endpoint: POST /:branchSlug/products", "shortDescription": {"text": "Unused endpoint: POST /:branchSlug/products"}, "fullDescription": {"text": "`apps/bff/src/domains/admin/catalog/products.routes.ts` declares `POST /:branchSlug/products` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-32cae28ab6960c5b", "name": "Unused endpoint: PATCH /:branchSlug/products/:id", "shortDescription": {"text": "Unused endpoint: PATCH /:branchSlug/products/:id"}, "fullDescription": {"text": "`apps/bff/src/domains/admin/catalog/products.routes.ts` declares `PATCH /:branchSlug/products/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-26b827e6850fb492", "name": "Unused endpoint: PUT /:branchSlug/catalog-items/:id/allergens", "shortDescription": {"text": "Unused endpoint: PUT /:branchSlug/catalog-items/:id/allergens"}, "fullDescription": {"text": "`apps/bff/src/domains/admin/catalog/allergens.routes.ts` declares `PUT /:branchSlug/catalog-items/:id/allergens` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e9c3026c3b4b507b", "name": "Unused endpoint: GET /content", "shortDescription": {"text": "Unused endpoint: GET /content"}, "fullDescription": {"text": "`apps/bff/src/domains/admin/content/content.routes.ts` declares `GET /content` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-092d7b8020d70b38", "name": "Unused endpoint: GET /tenants", "shortDescription": {"text": "Unused endpoint: GET /tenants"}, "fullDescription": {"text": "`apps/bff/src/domains/super-admin/tenants.routes.ts` declares `GET /tenants` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-07a7fad711358625", "name": "Unused endpoint: POST /tenants", "shortDescription": {"text": "Unused endpoint: POST /tenants"}, "fullDescription": {"text": "`apps/bff/src/domains/super-admin/tenants.routes.ts` declares `POST /tenants` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-337fb383915fb65c", "name": "Unused endpoint: POST /tenants/:tenantId/branches", "shortDescription": {"text": "Unused endpoint: POST /tenants/:tenantId/branches"}, "fullDescription": {"text": "`apps/bff/src/domains/super-admin/tenants.routes.ts` declares `POST /tenants/:tenantId/branches` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-51dfaf62549c6ff3", "name": "Unused endpoint: PATCH /tenants/:tenantId/branches/:branchId", "shortDescription": {"text": "Unused endpoint: PATCH /tenants/:tenantId/branches/:branchId"}, "fullDescription": {"text": "`apps/bff/src/domains/super-admin/tenants.routes.ts` declares `PATCH /tenants/:tenantId/branches/:branchId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f7a9fb786d5265e9", "name": "Unused endpoint: POST /payments/checkout", "shortDescription": {"text": "Unused endpoint: POST /payments/checkout"}, "fullDescription": {"text": "`apps/bff/src/domains/storefront/payments.routes.ts` declares `POST /payments/checkout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`apps/bff/src/domains/storefront/config.routes.ts` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-55fa1d8dbbb8d441", "name": "Unused endpoint: GET /delivery/:branch", "shortDescription": {"text": "Unused endpoint: GET /delivery/:branch"}, "fullDescription": {"text": "`apps/bff/src/domains/storefront/fulfillment/delivery.routes.ts` declares `GET /delivery/:branch` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bfbe9140befc9317", "name": "Unused endpoint: GET /addresses", "shortDescription": {"text": "Unused endpoint: GET /addresses"}, "fullDescription": {"text": "`apps/bff/src/domains/storefront/customer/addresses.routes.ts` declares `GET /addresses` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a79badb3fb3a35cd", "name": "Unused endpoint: POST /addresses", "shortDescription": {"text": "Unused endpoint: POST /addresses"}, "fullDescription": {"text": "`apps/bff/src/domains/storefront/customer/addresses.routes.ts` declares `POST /addresses` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6efa67e39d93873d", "name": "Unused endpoint: DELETE /addresses/:id", "shortDescription": {"text": "Unused endpoint: DELETE /addresses/:id"}, "fullDescription": {"text": "`apps/bff/src/domains/storefront/customer/addresses.routes.ts` declares `DELETE /addresses/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0328e9bdbb61fa68", "name": "Unused endpoint: GET /orders", "shortDescription": {"text": "Unused endpoint: GET /orders"}, "fullDescription": {"text": "`apps/bff/src/domains/storefront/customer/orders.routes.ts` declares `GET /orders` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea575b61c121b733", "name": "Unused endpoint: PATCH /me", "shortDescription": {"text": "Unused endpoint: PATCH /me"}, "fullDescription": {"text": "`apps/bff/src/domains/storefront/customer/profile.routes.ts` declares `PATCH /me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-290b7834e43f5b66", "name": "Unused endpoint: GET /favorites", "shortDescription": {"text": "Unused endpoint: GET /favorites"}, "fullDescription": {"text": "`apps/bff/src/domains/storefront/customer/favorites.routes.ts` declares `GET /favorites` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a5ab4d9f18e66d72", "name": "Unused endpoint: GET /branches/default", "shortDescription": {"text": "Unused endpoint: GET /branches/default"}, "fullDescription": {"text": "`apps/bff/src/domains/storefront/places/branches.routes.ts` declares `GET /branches/default` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-785d50f121ed5854", "name": "Unused endpoint: POST /branches", "shortDescription": {"text": "Unused endpoint: POST /branches"}, "fullDescription": {"text": "`apps/bff/src/domains/storefront/places/branches.routes.ts` declares `POST /branches` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-94855e444ba296e1", "name": "Unused endpoint: PATCH /branches/:id", "shortDescription": {"text": "Unused endpoint: PATCH /branches/:id"}, "fullDescription": {"text": "`apps/bff/src/domains/storefront/places/branches.routes.ts` declares `PATCH /branches/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ba3f9292a5b69f29", "name": "Unused endpoint: DELETE /branches/:id", "shortDescription": {"text": "Unused endpoint: DELETE /branches/:id"}, "fullDescription": {"text": "`apps/bff/src/domains/storefront/places/branches.routes.ts` declares `DELETE /branches/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22414"}, "properties": {"repository": "Volodymyr4K/vendora", "repoUrl": "https://github.com/Volodymyr4K/vendora", "branch": "main"}, "results": [{"ruleId": "scanner-81aaee1260f3d295", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/main-templates/berlin-press/AmCatalogClient.tsx:379"}, "properties": {"repobilityId": "a06520933efad39b", "scanner": "scanner-primary", "fingerprint": "81aaee1260f3d295", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-a70261ed5f020b49", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/main-templates/berlin-press/ProductCard.tsx:292"}, "properties": {"repobilityId": "884e9d3bca0572cc", "scanner": "scanner-primary", "fingerprint": "a70261ed5f020b49", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-de88be057d48c675", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 apps/web/app/actions.ts:184"}, "properties": {"repobilityId": "bd7794e7770c1555", "scanner": "scanner-primary", "fingerprint": "de88be057d48c675", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-5325e9fca9080555", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 apps/web/app/super-admin/tenants/[id]/payment-providers/page.tsx:985"}, "properties": {"repobilityId": "79d7fc33bc94812e", "scanner": "scanner-primary", "fingerprint": "5325e9fca9080555", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-da1881977a4acc2d", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/app/t/[tenantSlug]/(tenant)/journal/[slug]/page.tsx:109"}, "properties": {"repobilityId": "f953c53d73d13561", "scanner": "scanner-primary", "fingerprint": "da1881977a4acc2d", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-05644a4e4f8a4805", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/app/t/[tenantSlug]/(tenant)/impressum/page.tsx:73"}, "properties": {"repobilityId": "27408bf2a510681a", "scanner": "scanner-primary", "fingerprint": "05644a4e4f8a4805", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-9bd2c0e7f9c84374", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/app/t/[tenantSlug]/(tenant)/terms/page.tsx:73"}, "properties": {"repobilityId": "58996a79200680f7", "scanner": "scanner-primary", "fingerprint": "9bd2c0e7f9c84374", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-2903348f0bfac791", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/app/t/[tenantSlug]/(tenant)/privacy/page.tsx:75"}, "properties": {"repobilityId": "b49e674c6f774cfd", "scanner": "scanner-primary", "fingerprint": "2903348f0bfac791", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-92f1191b4ec89a96", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/app/t/[tenantSlug]/(storefront)/[branchSlug]/admin/journal/[id]/page.tsx:648"}, "properties": {"repobilityId": "8f626c1058a08095", "scanner": "scanner-primary", "fingerprint": "92f1191b4ec89a96", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-7b86d5218ea0ce27", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/app/t/[tenantSlug]/(storefront)/[branchSlug]/admin/content/page.tsx:142"}, "properties": {"repobilityId": "821b18597ac1b2bf", "scanner": "scanner-primary", "fingerprint": "7b86d5218ea0ce27", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-af74dec70e0c07d8", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/tools/smoke-test-bus.ts:6"}, "properties": {"repobilityId": "06f8bb12b081cc5a", "scanner": "scanner-primary", "fingerprint": "af74dec70e0c07d8", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d7549dcc3e2756fd", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/instrumentation.ts:17"}, "properties": {"repobilityId": "82f5a214255d4738", "scanner": "scanner-primary", "fingerprint": "d7549dcc3e2756fd", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2d5c82a87bde15bd", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/__tests__/setup.ts:6"}, "properties": {"repobilityId": "b5a36c075a64ae7f", "scanner": "scanner-primary", "fingerprint": "2d5c82a87bde15bd", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-655b942216a27c0f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/__tests__/integration/audit-branches-tenant-auth.probe.ts:52"}, "properties": {"repobilityId": "2e15d0f876fbf693", "scanner": "scanner-primary", "fingerprint": "655b942216a27c0f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ed43891db98b6733", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/utils/timezone-helpers.ts:42"}, "properties": {"repobilityId": "64d46b017f4c56fe", "scanner": "scanner-primary", "fingerprint": "ed43891db98b6733", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-24c4bf6ffd90b02a", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 apps/bff/src/services/pubsub.ts:38"}, "properties": {"repobilityId": "9265c6cdf3bdf28c", "scanner": "scanner-primary", "fingerprint": "24c4bf6ffd90b02a", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-36fa182382aa219e", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 apps/bff/src/services/audit-logger.ts:52"}, "properties": {"repobilityId": "9ef18389cebab714", "scanner": "scanner-primary", "fingerprint": "36fa182382aa219e", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-dfaaa8012b0afb20", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/services/audit-logger.ts:50"}, "properties": {"repobilityId": "3bcd94f1523843ce", "scanner": "scanner-primary", "fingerprint": "dfaaa8012b0afb20", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-749ac7b3f56904f0", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 apps/bff/src/services/domain-provider/cloudflare.ts:16"}, "properties": {"repobilityId": "5de0040c1a824ed0", "scanner": "scanner-primary", "fingerprint": "749ac7b3f56904f0", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-c180aad55b5898ce", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdMollieManualPayVerify.ts:157"}, "properties": {"repobilityId": "8dd361139f518f78", "scanner": "scanner-primary", "fingerprint": "c180aad55b5898ce", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ce16fbdcee1c4ab8", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLiqpayTenantDiscovery.ts:145"}, "properties": {"repobilityId": "26cc095515ed0301", "scanner": "scanner-primary", "fingerprint": "ce16fbdcee1c4ab8", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ea817e0174017975", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/probeUpstream.ts:128"}, "properties": {"repobilityId": "8ab946f317eb4d7f", "scanner": "scanner-primary", "fingerprint": "ea817e0174017975", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-21d0af948fa74fb0", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLocalSmokeUnmatched.ts:129"}, "properties": {"repobilityId": "74b089ffc34110f2", "scanner": "scanner-primary", "fingerprint": "21d0af948fa74fb0", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-81181badf9c9e01a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdMollieE2E.ts:248"}, "properties": {"repobilityId": "1502f3ef3f9c3826", "scanner": "scanner-primary", "fingerprint": "81181badf9c9e01a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3e92b08c11fc8339", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/captureUpstream.ts:35"}, "properties": {"repobilityId": "8508f67a79d5d7bd", "scanner": "scanner-primary", "fingerprint": "3e92b08c11fc8339", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-abc415fcf6dd92c9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdSmokeSweeperInitiatedTransaction.ts:145"}, "properties": {"repobilityId": "de98eaf92495ad5c", "scanner": "scanner-primary", "fingerprint": "abc415fcf6dd92c9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-96bf0c3c80bcb1d3", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLocalSmokeUnmatchedBackoff.ts:139"}, "properties": {"repobilityId": "1676c94e57cc1c95", "scanner": "scanner-primary", "fingerprint": "96bf0c3c80bcb1d3", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-52c27f1f1ec3bcc0", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLocalSmokeResyncTransactionTransient.ts:156"}, "properties": {"repobilityId": "f47d21863be02288", "scanner": "scanner-primary", "fingerprint": "52c27f1f1ec3bcc0", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ea53ae8ea40c76d5", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLiqpayLabSetup.ts:126"}, "properties": {"repobilityId": "667b716900bd2d30", "scanner": "scanner-primary", "fingerprint": "ea53ae8ea40c76d5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6ba0f65e074e0dcb", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsMonobankTenantDiscovery.ts:78"}, "properties": {"repobilityId": "4605a212df1da7ab", "scanner": "scanner-primary", "fingerprint": "6ba0f65e074e0dcb", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-05b491583fc9cb68", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsIncidentDrillRunner.ts:132"}, "properties": {"repobilityId": "12168be36f16a1d3", "scanner": "scanner-primary", "fingerprint": "05b491583fc9cb68", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-cb113e89af9a512f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLocalSmokeResyncTransactionMissingSecret.ts:137"}, "properties": {"repobilityId": "4bfa0b296e8789ca", "scanner": "scanner-primary", "fingerprint": "cb113e89af9a512f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7962cfb728cc2f83", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLiqpayGoLiveChecklist.ts:162"}, "properties": {"repobilityId": "f60aa2aae823beb4", "scanner": "scanner-primary", "fingerprint": "7962cfb728cc2f83", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-51d4cfc50bf6d255", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdSmokeUnmatchedResyncExternal.ts:116"}, "properties": {"repobilityId": "765fa37f46f3259e", "scanner": "scanner-primary", "fingerprint": "51d4cfc50bf6d255", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ae9c46ff3229af02", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsMollieLabSetup.ts:104"}, "properties": {"repobilityId": "c4df93c826a1fc38", "scanner": "scanner-primary", "fingerprint": "ae9c46ff3229af02", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e3b1f93e4acc7d2e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsMollieTenantDiscovery.ts:69"}, "properties": {"repobilityId": "42f393ef178eb510", "scanner": "scanner-primary", "fingerprint": "e3b1f93e4acc7d2e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b9077e926b65f823", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdSmokePreflight.ts:18"}, "properties": {"repobilityId": "0ebf53e6f4527870", "scanner": "scanner-primary", "fingerprint": "b9077e926b65f823", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6e483936aa3dfcdd", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLocalSmokeCheckoutRecoverMissingSecret.ts:160"}, "properties": {"repobilityId": "451b55760fbfd6d0", "scanner": "scanner-primary", "fingerprint": "6e483936aa3dfcdd", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-963cabedc32f34c5", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsCleanupAudit.ts:185"}, "properties": {"repobilityId": "7d5fc982711a0e7d", "scanner": "scanner-primary", "fingerprint": "963cabedc32f34c5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f8dbc59191385b93", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsMollieGoLiveChecklist.ts:123"}, "properties": {"repobilityId": "35c816653ab1cc8e", "scanner": "scanner-primary", "fingerprint": "f8dbc59191385b93", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a4c8274f9ebc2221", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdMollieManualPayPrep.ts:70"}, "properties": {"repobilityId": "ca498cd3ca2226c2", "scanner": "scanner-primary", "fingerprint": "a4c8274f9ebc2221", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7440228fba7439ef", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsMonobankLabSetup.ts:125"}, "properties": {"repobilityId": "1858f78c2576e8f9", "scanner": "scanner-primary", "fingerprint": "7440228fba7439ef", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-bb05f3f29cc1f53b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsMonobankGoLiveChecklist.ts:141"}, "properties": {"repobilityId": "6daca383b374aba1", "scanner": "scanner-primary", "fingerprint": "bb05f3f29cc1f53b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-baf5db9e682b444a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/upstreamHttpContractSmoke.ts:7"}, "properties": {"repobilityId": "32dd0557f1de776b", "scanner": "scanner-primary", "fingerprint": "baf5db9e682b444a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-85c00214ef395a25", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLocalSmokeCheckoutRecover.ts:151"}, "properties": {"repobilityId": "7fe9ac4a53ca5511", "scanner": "scanner-primary", "fingerprint": "85c00214ef395a25", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d3eb837938514e74", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsLocalSmokeUnmatchedGiveUp.ts:129"}, "properties": {"repobilityId": "c5b42edc4092ef1e", "scanner": "scanner-primary", "fingerprint": "d3eb837938514e74", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1940be0aa0320a4a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsDataIntegrityAudit.ts:255"}, "properties": {"repobilityId": "638243eb02da03bf", "scanner": "scanner-primary", "fingerprint": "1940be0aa0320a4a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f86dcee8f8277757", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/upstreamHttpSmoke.ts:181"}, "properties": {"repobilityId": "430f3e9c19ef9390", "scanner": "scanner-primary", "fingerprint": "f86dcee8f8277757", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e16ec6c083456a22", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsMollieSetCredentialsRef.ts:38"}, "properties": {"repobilityId": "7798f5c3bf4b170b", "scanner": "scanner-primary", "fingerprint": "e16ec6c083456a22", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7ee6da445d384bf4", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdSmokeResyncTransaction.ts:123"}, "properties": {"repobilityId": "da333162e2792b96", "scanner": "scanner-primary", "fingerprint": "7ee6da445d384bf4", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-216912c2d21f90a9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdSmokeCheckoutRecover.ts:153"}, "properties": {"repobilityId": "5aaea98ad35fee69", "scanner": "scanner-primary", "fingerprint": "216912c2d21f90a9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7f802ffdf46ba4c0", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsGoLiveRehearsal.ts:1009"}, "properties": {"repobilityId": "5cad9bd444a8cc54", "scanner": "scanner-primary", "fingerprint": "7f802ffdf46ba4c0", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ff9721e25326f555", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdSmokeWebhookProcess.ts:161"}, "properties": {"repobilityId": "7163caf5f35367fe", "scanner": "scanner-primary", "fingerprint": "ff9721e25326f555", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0c51d009a80870cb", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/bff/src/tools/paymentsProdSmokeSweeperReceivedEvent.ts:107"}, "properties": {"repobilityId": "6404d39f705d3d51", "scanner": "scanner-primary", "fingerprint": "0c51d009a80870cb", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9d1bc5f9d34b4ecf", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 apps/bff/src/domains/storefront/customer/otp.service.ts:35"}, "properties": {"repobilityId": "3e3833d2c66040f9", "scanner": "scanner-primary", "fingerprint": "9d1bc5f9d34b4ecf", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-ef5453f52717880c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/backfill-berlin-press-content.ts:75"}, "properties": {"repobilityId": "254305e3a20704b6", "scanner": "scanner-primary", "fingerprint": "ef5453f52717880c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-4590f7fa5c49a6d3", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/database/create-super-admin.ts:11"}, "properties": {"repobilityId": "47fb8923e4244b0a", "scanner": "scanner-primary", "fingerprint": "4590f7fa5c49a6d3", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b788b91e44750b4c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/database/check-super-admin.ts:14"}, "properties": {"repobilityId": "62f4d93988b26dd0", "scanner": "scanner-primary", "fingerprint": "b788b91e44750b4c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b687582eeb3b8427", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/database/scripts/create-user.ts:15"}, "properties": {"repobilityId": "b5398993acc9f7bb", "scanner": "scanner-primary", "fingerprint": "b687582eeb3b8427", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-395c5643044e0fa7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/database/scripts/check-default-variant.ts:35"}, "properties": {"repobilityId": "767010ac5f72009c", "scanner": "scanner-primary", "fingerprint": "395c5643044e0fa7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-db370238f98f7288", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/database/scripts/clear-branch-timezones.ts:31"}, "properties": {"repobilityId": "ec543c1ad0b83e24", "scanner": "scanner-primary", "fingerprint": "db370238f98f7288", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c2226664ec6b6697", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/database/scripts/isolation-test.ts:35"}, "properties": {"repobilityId": "69c2033a02a614db", "scanner": "scanner-primary", "fingerprint": "c2226664ec6b6697", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6581d34c866ffc93", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/database/scripts/import-journal-from-amcontent.ts:74"}, "properties": {"repobilityId": "ba10f04cfc258c4b", "scanner": "scanner-primary", "fingerprint": "6581d34c866ffc93", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-fcdcf6e69ed59cdc", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/database/prisma/seed.ts:5"}, "properties": {"repobilityId": "7d02f3de957c4f8e", "scanner": "scanner-primary", "fingerprint": "fcdcf6e69ed59cdc", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-82ea6c390c997bed", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/database/prisma/seed-berlin.ts:217"}, "properties": {"repobilityId": "1032787ce6342f41", "scanner": "scanner-primary", "fingerprint": "82ea6c390c997bed", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7673561931a5dd33", "level": "warning", "message": {"text": "Dockerfile runs as root: apps/web/Dockerfile"}, "properties": {"repobilityId": "d68d7937b96d047d", "scanner": "scanner-primary", "fingerprint": "7673561931a5dd33", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-9c5a68d50e3bbbc4", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-slim"}, "properties": {"repobilityId": "1a0b55c7b03592e1", "scanner": "scanner-primary", "fingerprint": "9c5a68d50e3bbbc4", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-9c5a68d50e3bbbc4", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-slim"}, "properties": {"repobilityId": "3e252c380d0574da", "scanner": "scanner-primary", "fingerprint": "9c5a68d50e3bbbc4", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/Dockerfile"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-6aa94b493d5b29ce", "level": "warning", "message": {"text": "Dockerfile runs as root: apps/bff/Dockerfile"}, "properties": {"repobilityId": "13192b0008a66bcc", "scanner": "scanner-primary", "fingerprint": "6aa94b493d5b29ce", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-67231b5843beed45", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-slim"}, "properties": {"repobilityId": "8354da97323522e3", "scanner": "scanner-primary", "fingerprint": "67231b5843beed45", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/bff/Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-67231b5843beed45", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-slim"}, "properties": {"repobilityId": "c28328d29dadb387", "scanner": "scanner-primary", "fingerprint": "67231b5843beed45", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/bff/Dockerfile"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-35c4ee1fc33c0892", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/app/t/[tenantSlug]/(tenant)/journal/[slug]/page.tsx:109"}, "properties": {"repobilityId": "2482f9952e0b7270", "scanner": "scanner-primary", "fingerprint": "35c4ee1fc33c0892", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/app/t/[tenantSlug]/(tenant)/journal/[slug]/page.tsx"}, "region": {"startLine": 109}}}]}, {"ruleId": "scanner-49c10148b713eb24", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/app/t/[tenantSlug]/(tenant)/impressum/page.tsx:73"}, "properties": {"repobilityId": "35217514d536ed27", "scanner": "scanner-primary", "fingerprint": "49c10148b713eb24", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/app/t/[tenantSlug]/(tenant)/impressum/page.tsx"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-8127c275df0b919f", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/app/t/[tenantSlug]/(tenant)/terms/page.tsx:73"}, "properties": {"repobilityId": "fa180e7d0eb7939c", "scanner": "scanner-primary", "fingerprint": "8127c275df0b919f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/app/t/[tenantSlug]/(tenant)/terms/page.tsx"}, "region": {"startLine": 73}}}]}, {"ruleId": "scanner-e439175f1f975663", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/app/t/[tenantSlug]/(tenant)/privacy/page.tsx:75"}, "properties": {"repobilityId": "cc86adbe52d9406b", "scanner": "scanner-primary", "fingerprint": "e439175f1f975663", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/app/t/[tenantSlug]/(tenant)/privacy/page.tsx"}, "region": {"startLine": 75}}}]}, {"ruleId": "scanner-455fdab2c768a4b0", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/app/t/[tenantSlug]/(storefront)/[branchSlug]/admin/journal/[id]/page.tsx:648"}, "properties": {"repobilityId": "5eb87e83b38608b6", "scanner": "scanner-primary", "fingerprint": "455fdab2c768a4b0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/app/t/[tenantSlug]/(storefront)/[branchSlug]/admin/journal/[id]/page.tsx"}, "region": {"startLine": 648}}}]}, {"ruleId": "scanner-38a579b60df113a2", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/app/t/[tenantSlug]/(storefront)/[branchSlug]/admin/content/page.tsx:142"}, "properties": {"repobilityId": "474d1de5674f6100", "scanner": "scanner-primary", "fingerprint": "38a579b60df113a2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/app/t/[tenantSlug]/(storefront)/[branchSlug]/admin/content/page.tsx"}, "region": {"startLine": 142}}}]}, {"ruleId": "scanner-a7a0856e8cae52ac", "level": "error", "message": {"text": "Possible secret in apps/bff/src/tools/upstreamHttpSmoke.ts"}, "properties": {"repobilityId": "724b1ed33b62fc5a", "scanner": "scanner-primary", "fingerprint": "a7a0856e8cae52ac", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/bff/src/tools/upstreamHttpSmoke.ts"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-740c236adcc04193", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in apps/bff/src/tools/paymentsGoLiveRehearsal.ts:1"}, "properties": {"repobilityId": "2cf3901d81b1d036", "scanner": "scanner-primary", "fingerprint": "740c236adcc04193", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/bff/src/tools/paymentsGoLiveRehearsal.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-688cdbe5289259a6", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/check-legacy-working-hours-selftest.mjs:2"}, "properties": {"repobilityId": "b750dc4e2c9b9042", "scanner": "scanner-primary", "fingerprint": "688cdbe5289259a6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/check-legacy-working-hours-selftest.mjs"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-799096e08accfa41", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/run-e2e.mjs:1"}, "properties": {"repobilityId": "6f3f0290bcb74670", "scanner": "scanner-primary", "fingerprint": "799096e08accfa41", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/run-e2e.mjs"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7beced2861f48bf7", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/run-lhci.mjs:1"}, "properties": {"repobilityId": "89fb6ee794819b43", "scanner": "scanner-primary", "fingerprint": "7beced2861f48bf7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/run-lhci.mjs"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-81ac249bf3fb46aa", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/guardrails/themes.mjs:7"}, "properties": {"repobilityId": "ab3e688dce71f7e2", "scanner": "scanner-primary", "fingerprint": "81ac249bf3fb46aa", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/guardrails/themes.mjs"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-9855bdc7f9c5d2ed", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/guardrails/themes-self-check.mjs:11"}, "properties": {"repobilityId": "d0cb73450a24dde7", "scanner": "scanner-primary", "fingerprint": "9855bdc7f9c5d2ed", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/guardrails/themes-self-check.mjs"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-511dcc03c0709d1a", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/guardrails/test-bff-alias-bypass.mjs:11"}, "properties": {"repobilityId": "30d438d79034f933", "scanner": "scanner-primary", "fingerprint": "511dcc03c0709d1a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/guardrails/test-bff-alias-bypass.mjs"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-9daf0d1d8bdd4272", "level": "error", "message": {"text": "Possible secret in packages/database/create-super-admin.ts"}, "properties": {"repobilityId": "ba4d2e58dcc219bd", "scanner": "scanner-primary", "fingerprint": "9daf0d1d8bdd4272", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/database/create-super-admin.ts"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-6ac8127d13bde8be", "level": "error", "message": {"text": "Possible secret in tools/smoke-theme-propagation.sh"}, "properties": {"repobilityId": "0c5093a40c057ba4", "scanner": "scanner-primary", "fingerprint": "6ac8127d13bde8be", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/smoke-theme-propagation.sh"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae16880318b99912", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "54597edb7f5bad38", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "989a74409a402368", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-e9e20870d968e45d", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "1af921ecce3e0f6d", "scanner": "scanner-primary", "fingerprint": "e9e20870d968e45d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/database/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b8883e975a3c6b57", "level": "note", "message": {"text": "Very large file: apps/web/app/super-admin/page.tsx (1295 lines)"}, "properties": {"repobilityId": "058d7d2630476659", "scanner": "scanner-primary", "fingerprint": "b8883e975a3c6b57", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b11e488b7066e563", "level": "note", "message": {"text": "Very large file: apps/web/app/super-admin/tenants/[id]/payment-providers/page.tsx (1050 lines)"}, "properties": {"repobilityId": "a984364cfc2f0d3f", "scanner": "scanner-primary", "fingerprint": "b11e488b7066e563", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9929605d11dd4d25", "level": "note", "message": {"text": "Very large file: apps/web/app/t/[tenantSlug]/(storefront)/[branchSlug]/admin/content/page.tsx (6403 lines)"}, "properties": {"repobilityId": "d57dc8fabf2efea3", "scanner": "scanner-primary", "fingerprint": "9929605d11dd4d25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2ce501b7ae1e5c5d", "level": "note", "message": {"text": "Very large file: apps/web/app/t/[tenantSlug]/(storefront)/[branchSlug]/admin/menu/page.tsx (1253 lines)"}, "properties": {"repobilityId": "99839dc81253d2c3", "scanner": "scanner-primary", "fingerprint": "2ce501b7ae1e5c5d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-dcdbc3f795f8c5f1", "level": "note", "message": {"text": "Very large file: packages/database/scripts/isolation-test.ts (1189 lines)"}, "properties": {"repobilityId": "86695b3d3d75fd77", "scanner": "scanner-primary", "fingerprint": "dcdbc3f795f8c5f1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-4a9eb7dc7c6e3880", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/web/package.json"}, "properties": {"repobilityId": "6c1704bf24cf19ac", "scanner": "scanner-primary", "fingerprint": "4a9eb7dc7c6e3880", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6dbe4b2b47f0602d", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/bff/package.json"}, "properties": {"repobilityId": "c7662911bf4cfc8f", "scanner": "scanner-primary", "fingerprint": "6dbe4b2b47f0602d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/bff/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2a9ae6ff389a0d8d", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/tenant-resolver/package.json"}, "properties": {"repobilityId": "660ac0675629bd18", "scanner": "scanner-primary", "fingerprint": "2a9ae6ff389a0d8d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/tenant-resolver/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2699d5f16ae11282", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/shared/package.json"}, "properties": {"repobilityId": "37ac218a4ef9b430", "scanner": "scanner-primary", "fingerprint": "2699d5f16ae11282", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/shared/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cb01c01804de0b47", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/database/package.json"}, "properties": {"repobilityId": "9b313fab9370ec72", "scanner": "scanner-primary", "fingerprint": "cb01c01804de0b47", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/database/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f85d8f0719e22fa8", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/contracts/package.json"}, "properties": {"repobilityId": "9533b27beaa7d171", "scanner": "scanner-primary", "fingerprint": "f85d8f0719e22fa8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/contracts/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "2c73a35376c412f2", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "63a5e54bb3f5f5af", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "7cf68319fd6678f5", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "571581f27b1b38ca", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "5d66fdfd1a90c1c0", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-4e97b53cf620b2c2", "level": "note", "message": {"text": "Legacy-named symbol `am_berlin_search_history_v1` in apps/web/components/main-templates/berlin-press/AmHeaderSearch.tsx:7"}, "properties": {"repobilityId": "ceeca864e47b36e5", "scanner": "scanner-primary", "fingerprint": "4e97b53cf620b2c2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f71b3077910e93ae", "level": "note", "message": {"text": "Legacy-named symbol `vendora_cart_v1` in apps/web/components/cart/CartProvider.tsx:10"}, "properties": {"repobilityId": "a49bd6d5d6d4ee8d", "scanner": "scanner-primary", "fingerprint": "f71b3077910e93ae", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-107a47aeea4e3951", "level": "none", "message": {"text": "Commented-code block (7 lines) in apps/web/components/profile/RepeatButton.tsx:24"}, "properties": {"repobilityId": "41c43c5170628ab0", "scanner": "scanner-primary", "fingerprint": "107a47aeea4e3951", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-91ec669e56ba60e7", "level": "note", "message": {"text": "Legacy-named symbol `priceOld` in apps/web/components/menu/MenuClient.tsx:133"}, "properties": {"repobilityId": "436063bfa99dd5ce", "scanner": "scanner-primary", "fingerprint": "91ec669e56ba60e7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d93c18cdfa95fdea", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/web/components/menu/MenuClient.tsx:46"}, "properties": {"repobilityId": "e563b856cdf91383", "scanner": "scanner-primary", "fingerprint": "d93c18cdfa95fdea", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-66045bdfddaa553f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/app/media/[...key]/route.ts:71"}, "properties": {"repobilityId": "a85cb578f974b6e9", "scanner": "scanner-primary", "fingerprint": "66045bdfddaa553f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-06fd875d740d4bf8", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/web/app/super-admin/page.tsx:275"}, "properties": {"repobilityId": "606d380d869ad1d3", "scanner": "scanner-primary", "fingerprint": "06fd875d740d4bf8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b5e7085fa88a0a9e", "level": "none", "message": {"text": "Commented-code block (10 lines) in apps/web/app/super-admin/tenants/[id]/domains/page.tsx:44"}, "properties": {"repobilityId": "6854255eacbac01f", "scanner": "scanner-primary", "fingerprint": "b5e7085fa88a0a9e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-feca796cca2857f6", "level": "note", "message": {"text": "Legacy-named symbol `priceOld` in apps/web/app/t/[tenantSlug]/(storefront)/[branchSlug]/page.tsx:87"}, "properties": {"repobilityId": "289e8e5a69ec4280", "scanner": "scanner-primary", "fingerprint": "feca796cca2857f6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-96a244c2bd835f3d", "level": "note", "message": {"text": "Legacy-named symbol `priceOld` in apps/web/app/t/[tenantSlug]/(storefront)/[branchSlug]/p/[id]/page.tsx:75"}, "properties": {"repobilityId": "6953e0402294ee1b", "scanner": "scanner-primary", "fingerprint": "96a244c2bd835f3d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7fa962177d8eeef0", "level": "none", "message": {"text": "Commented-code block (12 lines) in apps/web/app/checkout/test-payment/page.tsx:37"}, "properties": {"repobilityId": "399921d6df2a3cd6", "scanner": "scanner-primary", "fingerprint": "7fa962177d8eeef0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-051a4733119961bc", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/web/lib/data.ts:172"}, "properties": {"repobilityId": "5fe14b060f3148e1", "scanner": "scanner-primary", "fingerprint": "051a4733119961bc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2a3afef0e1517e29", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/lib/data.ts:205"}, "properties": {"repobilityId": "67553857e3e57a80", "scanner": "scanner-primary", "fingerprint": "2a3afef0e1517e29", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-5443887ebc15e31b", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/bff/test/delivery-routes.notfound-no-cache.test.ts:98"}, "properties": {"repobilityId": "92a640ba627912af", "scanner": "scanner-primary", "fingerprint": "5443887ebc15e31b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-002c0862ff9dbecd", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/bff/src/index.ts:135"}, "properties": {"repobilityId": "8864055673c0c0d9", "scanner": "scanner-primary", "fingerprint": "002c0862ff9dbecd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9c701ad26d388a34", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/bff/src/__tests__/integration/multi-tenant-flow.test.ts:654"}, "properties": {"repobilityId": "c560a5f667127474", "scanner": "scanner-primary", "fingerprint": "9c701ad26d388a34", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-687202ea81111fb7", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/bff/src/cache/tiered.ts:123"}, "properties": {"repobilityId": "4431a22cc4f39e7d", "scanner": "scanner-primary", "fingerprint": "687202ea81111fb7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0d8f49ac8a40d1df", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/bff/src/services/pubsub.ts:31"}, "properties": {"repobilityId": "db638ed211c8a2dc", "scanner": "scanner-primary", "fingerprint": "0d8f49ac8a40d1df", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f424ba994b4bc5fa", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/bff/src/services/theme.ts:321"}, "properties": {"repobilityId": "0ba70d694f956bb8", "scanner": "scanner-primary", "fingerprint": "f424ba994b4bc5fa", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f5ac0b9e69cceec1", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/bff/src/services/http.ts:103"}, "properties": {"repobilityId": "90ef9b6187cc06d3", "scanner": "scanner-primary", "fingerprint": "f5ac0b9e69cceec1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ffe8d626f918fc5b", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/bff/src/tools/paymentsGoLiveRehearsal.ts:631"}, "properties": {"repobilityId": "26817debb692930d", "scanner": "scanner-primary", "fingerprint": "ffe8d626f918fc5b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1f12b7ff0110987d", "level": "none", "message": {"text": "Commented-code block (7 lines) in apps/bff/src/plugins/tenant-context.ts:81"}, "properties": {"repobilityId": "82cfe98ec263391a", "scanner": "scanner-primary", "fingerprint": "1f12b7ff0110987d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d15c2a47639d9d4b", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/bff/src/plugins/__tests__/tenant-guard.test.ts:351"}, "properties": {"repobilityId": "5eece17302f7f717", "scanner": "scanner-primary", "fingerprint": "d15c2a47639d9d4b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-40feef99e2afe4c4", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/bff/src/domains/super-admin/domains.routes.ts:34"}, "properties": {"repobilityId": "f2862e18bb33f0d9", "scanner": "scanner-primary", "fingerprint": "40feef99e2afe4c4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9c0205c73ff1d2e5", "level": "none", "message": {"text": "Commented-code block (9 lines) in apps/bff/src/domains/super-admin/tenants.routes.ts:296"}, "properties": {"repobilityId": "d7318216cdc0b049", "scanner": "scanner-primary", "fingerprint": "9c0205c73ff1d2e5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fc6700177fdf69bc", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/bff/src/domains/storefront/ordering/validation.ts:288"}, "properties": {"repobilityId": "52fc74b5eda117f3", "scanner": "scanner-primary", "fingerprint": "fc6700177fdf69bc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c5dcf404a1d6b2b4", "level": "none", "message": {"text": "Commented-code block (8 lines) in apps/bff/src/domains/storefront/ordering/timeslots.routes.ts:145"}, "properties": {"repobilityId": "7d58ccadf5b95233", "scanner": "scanner-primary", "fingerprint": "c5dcf404a1d6b2b4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2ee93f6053ef674d", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/bff/src/domains/storefront/places/branches.routes.ts:28"}, "properties": {"repobilityId": "83c375dabc750df8", "scanner": "scanner-primary", "fingerprint": "2ee93f6053ef674d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a6c7afda2b3f5f08", "level": "none", "message": {"text": "Commented-code block (11 lines) in scripts/guardrails/themes-bff.mjs:46"}, "properties": {"repobilityId": "1ea8bbd6d5d9c37f", "scanner": "scanner-primary", "fingerprint": "a6c7afda2b3f5f08", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bf975e657461f196", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/guardrails/themes-web.mjs:100"}, "properties": {"repobilityId": "2c5dbe77cd68c4da", "scanner": "scanner-primary", "fingerprint": "bf975e657461f196", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2153571a4d5dd99f", "level": "note", "message": {"text": "78 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "7a9eb2130cdb9da2", "scanner": "scanner-primary", "fingerprint": "2153571a4d5dd99f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-184b5595a7424d3d", "level": "error", "message": {"text": "Dangling fetch: GET /config (scripts/guardrails/themes-web.mjs:100)"}, "properties": {"repobilityId": "9680a7b432413034", "scanner": "scanner-primary", "fingerprint": "184b5595a7424d3d", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-6dfdb737e881ef3e", "level": "error", "message": {"text": "Dangling fetch: GET https://${domain}/.well-known/vendora-verification/${verificationToken} (apps/bff/src/services/dns-lookup.ts:111)"}, "properties": {"repobilityId": "ebef1520dd6f3e57", "scanner": "scanner-primary", "fingerprint": "6dfdb737e881ef3e", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-36406553ba87d204", "level": "error", "message": {"text": "Dangling fetch: POST https://api.vercel.com/v9/projects/${this.projectId}/domains (apps/bff/src/services/domain-provider/vercel.ts:35)"}, "properties": {"repobilityId": "ccc5191bf6656cda", "scanner": "scanner-primary", "fingerprint": "36406553ba87d204", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-6afbaceaee46915a", "level": "error", "message": {"text": "Dangling fetch: DELETE https://api.vercel.com/v9/projects/${this.projectId}/domains/${providerDomainId} (apps/bff/src/services/domain-provider/vercel.ts:96)"}, "properties": {"repobilityId": "f5865503af699b87", "scanner": "scanner-primary", "fingerprint": "6afbaceaee46915a", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-6e58fa552730c793", "level": "error", "message": {"text": "Dangling fetch: GET https://${domain}/.well-known/vendora-verification/${expectedToken} (packages/tenant-resolver/src/dns.ts:122)"}, "properties": {"repobilityId": "cd229f29da43e995", "scanner": "scanner-primary", "fingerprint": "6e58fa552730c793", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-7b9bd99d6bbe8b8d", "level": "note", "message": {"text": "Unused endpoint: GET /example"}, "properties": {"repobilityId": "bd1b3bc967d41e99", "scanner": "scanner-primary", "fingerprint": "7b9bd99d6bbe8b8d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c059f57186114027", "level": "note", "message": {"text": "Unused endpoint: POST /auth/logout"}, "properties": {"repobilityId": "91a51b6cabfdc001", "scanner": "scanner-primary", "fingerprint": "c059f57186114027", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-dacb1640e17dcbe5", "level": "note", "message": {"text": "Unused endpoint: GET /internal/resolve-tenant"}, "properties": {"repobilityId": "f103053d33475b2c", "scanner": "scanner-primary", "fingerprint": "dacb1640e17dcbe5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-648fc3a2166d5c27", "level": "note", "message": {"text": "Unused endpoint: POST /internal/payments/resync"}, "properties": {"repobilityId": "7221ce2b6101aef5", "scanner": "scanner-primary", "fingerprint": "648fc3a2166d5c27", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8e85a83b0cd4671e", "level": "note", "message": {"text": "Unused endpoint: POST /internal/payments/resync/external"}, "properties": {"repobilityId": "7ccc0359828721a9", "scanner": "scanner-primary", "fingerprint": "8e85a83b0cd4671e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-01b064324cf0ccbe", "level": "note", "message": {"text": "Unused endpoint: GET /integrations"}, "properties": {"repobilityId": "5408409e9996497e", "scanner": "scanner-primary", "fingerprint": "01b064324cf0ccbe", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-841e50bf821e4158", "level": "note", "message": {"text": "Unused endpoint: GET /users"}, "properties": {"repobilityId": "691b49a00e6c1446", "scanner": "scanner-primary", "fingerprint": "841e50bf821e4158", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1bca8100a44f7f25", "level": "note", "message": {"text": "Unused endpoint: POST /users"}, "properties": {"repobilityId": "ffd607e9c226dc78", "scanner": "scanner-primary", "fingerprint": "1bca8100a44f7f25", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4d0b75c541565cd9", "level": "note", "message": {"text": "Unused endpoint: GET /journal"}, "properties": {"repobilityId": "aac19e36c63070f2", "scanner": "scanner-primary", "fingerprint": "4d0b75c541565cd9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6236b283b79811b8", "level": "note", "message": {"text": "Unused endpoint: POST /upload"}, "properties": {"repobilityId": "6733a3d50f91c237", "scanner": "scanner-primary", "fingerprint": "6236b283b79811b8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d7659b88734aa2b5", "level": "note", "message": {"text": "Unused endpoint: POST /admin/upload"}, "properties": {"repobilityId": "116cb00006ed7939", "scanner": "scanner-primary", "fingerprint": "d7659b88734aa2b5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd1dc91abf32142d", "level": "note", "message": {"text": "Unused endpoint: GET /me"}, "properties": {"repobilityId": "1199255d414fa234", "scanner": "scanner-primary", "fingerprint": "fd1dc91abf32142d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5c95279f2a3ad3db", "level": "note", "message": {"text": "Unused endpoint: PUT /:branchSlug/catalog-items/:id/nutrition"}, "properties": {"repobilityId": "8976befc6251605d", "scanner": "scanner-primary", "fingerprint": "5c95279f2a3ad3db", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c0adc9adab76f12b", "level": "note", "message": {"text": "Unused endpoint: GET /attribute-definitions"}, "properties": {"repobilityId": "48c1ec42e78fbf0a", "scanner": "scanner-primary", "fingerprint": "c0adc9adab76f12b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4e06fac8815605d6", "level": "note", "message": {"text": "Unused endpoint: POST /:branchSlug/option-groups"}, "properties": {"repobilityId": "1ee7523206751aa3", "scanner": "scanner-primary", "fingerprint": "4e06fac8815605d6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-51182056c45091fd", "level": "note", "message": {"text": "Unused endpoint: PATCH /:branchSlug/option-groups/:id"}, "properties": {"repobilityId": "98b1616830537526", "scanner": "scanner-primary", "fingerprint": "51182056c45091fd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5b4186a8e48b03d0", "level": "note", "message": {"text": "Unused endpoint: POST /:branchSlug/option-groups/:id/options"}, "properties": {"repobilityId": "fec481c51b97a362", "scanner": "scanner-primary", "fingerprint": "5b4186a8e48b03d0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2bed484e65a6f796", "level": "note", "message": {"text": "Unused endpoint: PATCH /:branchSlug/option-groups/:optionGroupId/options/:id"}, "properties": {"repobilityId": "cb3211e1ea1a496d", "scanner": "scanner-primary", "fingerprint": "2bed484e65a6f796", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-369b73a24719fbb5", "level": "note", "message": {"text": "Unused endpoint: POST /:branchSlug/catalog-items/:id/option-groups"}, "properties": {"repobilityId": "242153f71322376b", "scanner": "scanner-primary", "fingerprint": "369b73a24719fbb5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e13e23bbff75124d", "level": "note", "message": {"text": "Unused endpoint: POST /:branchSlug/products"}, "properties": {"repobilityId": "51e2b661a50915fa", "scanner": "scanner-primary", "fingerprint": "e13e23bbff75124d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-32cae28ab6960c5b", "level": "note", "message": {"text": "Unused endpoint: PATCH /:branchSlug/products/:id"}, "properties": {"repobilityId": "49b882526578b532", "scanner": "scanner-primary", "fingerprint": "32cae28ab6960c5b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-26b827e6850fb492", "level": "note", "message": {"text": "Unused endpoint: PUT /:branchSlug/catalog-items/:id/allergens"}, "properties": {"repobilityId": "d9b293aa666c9097", "scanner": "scanner-primary", "fingerprint": "26b827e6850fb492", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e9c3026c3b4b507b", "level": "note", "message": {"text": "Unused endpoint: GET /content"}, "properties": {"repobilityId": "f247f64f095ba28b", "scanner": "scanner-primary", "fingerprint": "e9c3026c3b4b507b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-092d7b8020d70b38", "level": "note", "message": {"text": "Unused endpoint: GET /tenants"}, "properties": {"repobilityId": "3c54c96fec0ea28c", "scanner": "scanner-primary", "fingerprint": "092d7b8020d70b38", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-07a7fad711358625", "level": "note", "message": {"text": "Unused endpoint: POST /tenants"}, "properties": {"repobilityId": "f7a3a1110356f28c", "scanner": "scanner-primary", "fingerprint": "07a7fad711358625", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-337fb383915fb65c", "level": "note", "message": {"text": "Unused endpoint: POST /tenants/:tenantId/branches"}, "properties": {"repobilityId": "3601770d6931e594", "scanner": "scanner-primary", "fingerprint": "337fb383915fb65c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-51dfaf62549c6ff3", "level": "note", "message": {"text": "Unused endpoint: PATCH /tenants/:tenantId/branches/:branchId"}, "properties": {"repobilityId": "2f1ad28cd78b07ad", "scanner": "scanner-primary", "fingerprint": "51dfaf62549c6ff3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f7a9fb786d5265e9", "level": "note", "message": {"text": "Unused endpoint: POST /payments/checkout"}, "properties": {"repobilityId": "32b42c60e35dfdc7", "scanner": "scanner-primary", "fingerprint": "f7a9fb786d5265e9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "daa3e0faf89f4bc7", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-55fa1d8dbbb8d441", "level": "note", "message": {"text": "Unused endpoint: GET /delivery/:branch"}, "properties": {"repobilityId": "fbf9e016a9d77959", "scanner": "scanner-primary", "fingerprint": "55fa1d8dbbb8d441", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bfbe9140befc9317", "level": "note", "message": {"text": "Unused endpoint: GET /addresses"}, "properties": {"repobilityId": "405378a072e5127a", "scanner": "scanner-primary", "fingerprint": "bfbe9140befc9317", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a79badb3fb3a35cd", "level": "note", "message": {"text": "Unused endpoint: POST /addresses"}, "properties": {"repobilityId": "98adeb76c71780ee", "scanner": "scanner-primary", "fingerprint": "a79badb3fb3a35cd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6efa67e39d93873d", "level": "note", "message": {"text": "Unused endpoint: DELETE /addresses/:id"}, "properties": {"repobilityId": "9f64199bd911729e", "scanner": "scanner-primary", "fingerprint": "6efa67e39d93873d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0328e9bdbb61fa68", "level": "note", "message": {"text": "Unused endpoint: GET /orders"}, "properties": {"repobilityId": "d8fef85d7bf0ae60", "scanner": "scanner-primary", "fingerprint": "0328e9bdbb61fa68", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ea575b61c121b733", "level": "note", "message": {"text": "Unused endpoint: PATCH /me"}, "properties": {"repobilityId": "895e151535d37db6", "scanner": "scanner-primary", "fingerprint": "ea575b61c121b733", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-290b7834e43f5b66", "level": "note", "message": {"text": "Unused endpoint: GET /favorites"}, "properties": {"repobilityId": "890a9ce601554b54", "scanner": "scanner-primary", "fingerprint": "290b7834e43f5b66", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a5ab4d9f18e66d72", "level": "note", "message": {"text": "Unused endpoint: GET /branches/default"}, "properties": {"repobilityId": "5be85210bd5b3736", "scanner": "scanner-primary", "fingerprint": "a5ab4d9f18e66d72", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-785d50f121ed5854", "level": "note", "message": {"text": "Unused endpoint: POST /branches"}, "properties": {"repobilityId": "01e6141c183cc46a", "scanner": "scanner-primary", "fingerprint": "785d50f121ed5854", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-94855e444ba296e1", "level": "note", "message": {"text": "Unused endpoint: PATCH /branches/:id"}, "properties": {"repobilityId": "6c6ad96fc35443f4", "scanner": "scanner-primary", "fingerprint": "94855e444ba296e1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ba3f9292a5b69f29", "level": "note", "message": {"text": "Unused endpoint: DELETE /branches/:id"}, "properties": {"repobilityId": "eb5f1b7aa55d54fc", "scanner": "scanner-primary", "fingerprint": "ba3f9292a5b69f29", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}