{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-11bec7eb552e7f75", "name": "Stray `console.log` in TS/JS \u2014 units/update_enemy.js:129", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 units/update_enemy.js:129"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-abe90603d1f78eb7", "name": "Stray `console.log` in TS/JS \u2014 units/update_worm.js:191", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 units/update_worm.js:191"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6d3471aa450bf6d7", "name": "Stray `console.log` in TS/JS \u2014 src/units-main.ts:517", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/units-main.ts:517"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-69ee0d30be10918c", "name": "Stray `console.log` in TS/JS \u2014 src/main.ts:70", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/main.ts:70"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c255955c5063c21", "name": "Stray `console.log` in TS/JS \u2014 src/persistence/SaveManager.ts:41", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/persistence/SaveManager.ts:41"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ffc516a83eb42b7e", "name": "Stray `console.log` in TS/JS \u2014 src/persistence/SaveManagerV2.ts:23", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/persistence/SaveManagerV2.ts:23"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a1b4ac3ccdfac82f", "name": "Stray `console.log` in TS/JS \u2014 src/services/SupabaseService.ts:88", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/services/SupabaseService.ts:88"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2295fb9445a07074", "name": "Stray `console.log` in TS/JS \u2014 src/services/ColyseusService.ts:174", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/services/ColyseusService.ts:174"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-835b314a13ab249b", "name": "Stray `console.log` in TS/JS \u2014 src/services/MatchmakingService.ts:25", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/services/MatchmakingService.ts:25"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-814d7f51a5c74672", "name": "Stray `console.log` in TS/JS \u2014 lenta/update_enemy.js:129", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 lenta/update_enemy.js:129"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d979cb9d5995871b", "name": "Stray `console.log` in TS/JS \u2014 lenta/update_worm.js:191", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 lenta/update_worm.js:191"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d6515148f845269d", "name": "TODO/FIXME marker in shipping code \u2014 lenta/game.js:8367", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 lenta/game.js:8367"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c23ddf653852decf", "name": "Stray `console.log` in TS/JS \u2014 lenta/game.js:118", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 lenta/game.js:118"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1b7b72bfd7d43148", "name": "Stray `console.log` in TS/JS \u2014 colyseus-server/src/app.config.ts:47", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 colyseus-server/src/app.config.ts:47"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-437593163a3dc11e", "name": "Stray `console.log` in TS/JS \u2014 colyseus-server/src/rooms/UnitsRoom.ts:31", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 colyseus-server/src/rooms/UnitsRoom.ts:31"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-705258b8df6b221b", "name": "Stray `console.log` in TS/JS \u2014 colyseus-server/src/rooms/GameRoom.ts:546", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 colyseus-server/src/rooms/GameRoom.ts:546"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0231744233afb709", "name": "Stray `console.log` in TS/JS \u2014 colyseus-server/src/persistence/UnitsPersistence.ts:98", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 colyseus-server/src/persistence/UnitsPersistence.ts:98"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-48a7dbb1be969fba", "name": "Stray `console.log` in TS/JS \u2014 colyseus-server/src/services/UfoTicketService.ts:83", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 colyseus-server/src/services/UfoTicketService.ts:83"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-022a01503f73c6ed", "name": "Icon-only button without accessible name \u2014 public/lenta/wallet-ui.js:538", "shortDescription": {"text": "Icon-only button without accessible name \u2014 public/lenta/wallet-ui.js:538"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c60e32c02ebf923", "name": "Icon-only button without accessible name \u2014 public/lenta/village.js:365", "shortDescription": {"text": "Icon-only button without accessible name \u2014 public/lenta/village.js:365"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-041db795902ca20b", "name": "Stray `console.log` in TS/JS \u2014 public/lenta/wallet.js:1186", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 public/lenta/wallet.js:1186"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8a5d9361c8c01e30", "name": "Icon-only button without accessible name \u2014 public/lenta/ronke_faucet.js:1148", "shortDescription": {"text": "Icon-only button without accessible name \u2014 public/lenta/ronke_faucet.js:1148"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-87aaf49593140fd5", "name": "Stray `console.log` in TS/JS \u2014 public/lenta/ronke_faucet.js:1295", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 public/lenta/ronke_faucet.js:1295"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a3aa530244fff219", "name": "Icon-only button without accessible name \u2014 public/lenta/barracks_nft_modal.js:296", "shortDescription": {"text": "Icon-only button without accessible name \u2014 public/lenta/barracks_nft_modal.js:296"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-56780ad7ad51367a", "name": "Stray `console.log` in TS/JS \u2014 public/lenta/barracks_nft_modal.js:654", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 public/lenta/barracks_nft_modal.js:654"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6270ad9b415f1064", "name": "Stray `console.log` in TS/JS \u2014 public/lenta/.__local_server_8500.js:26", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 public/lenta/.__local_server_8500.js:26"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5385b04d41e074b7", "name": "Stray `console.log` in TS/JS \u2014 public/lenta/update_enemy.js:129", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 public/lenta/update_enemy.js:129"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d95138593b65190", "name": "Stray `console.log` in TS/JS \u2014 public/lenta/hog_rider_popup.js:832", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 public/lenta/hog_rider_popup.js:832"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c7ca6454335a1d4", "name": "Stray `console.log` in TS/JS \u2014 public/lenta/.__local_server_8501.js:27", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 public/lenta/.__local_server_8501.js:27"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b15816fed6bfcf43", "name": "Icon-only button without accessible name \u2014 public/lenta/leaderboard.js:227", "shortDescription": {"text": "Icon-only button without accessible name \u2014 public/lenta/leaderboard.js:227"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa01d16e0c50d182", "name": "Icon-only button without accessible name \u2014 public/lenta/f12_predeck_modal.js:55", "shortDescription": {"text": "Icon-only button without accessible name \u2014 public/lenta/f12_predeck_modal.js:55"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c0224392a539ce32", "name": "Stray `console.log` in TS/JS \u2014 public/lenta/floor12_merge.js:3277", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 public/lenta/floor12_merge.js:3277"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab1d76a2af900668", "name": "Stray `console.log` in TS/JS \u2014 public/lenta/update_worm.js:191", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 public/lenta/update_worm.js:191"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d764140ab08d914d", "name": "Icon-only button without accessible name \u2014 public/lenta/village/village.js:365", "shortDescription": {"text": "Icon-only button without accessible name \u2014 public/lenta/village/village.js:365"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3f267a1f769547f3", "name": "TODO/FIXME marker in shipping code \u2014 public/lenta/village/game.js:8570", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 public/lenta/village/game.js:8570"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f7f4d1a258bc5284", "name": "Stray `console.log` in TS/JS \u2014 public/lenta/village/game.js:118", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 public/lenta/village/game.js:118"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f1e71bcb549230b0", "name": "react insecure request \u2014 colyseus-server/src/rooms/GameRoom.ts:550", "shortDescription": {"text": "react insecure request \u2014 colyseus-server/src/rooms/GameRoom.ts:550"}, "fullDescription": {"text": "Unencrypted request over HTTP detected.\n\nRule: typescript.react.security.react-insecure-request.react-insecure-request\nSeverity: ERROR\nOWASP: A03:2017 - Sensitive Data Exposure, A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-319: Cleartext Transmission of Sensitive Information\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-834390f42713ac8e", "name": "react insecure request \u2014 colyseus-server/src/rooms/GameRoom.ts:579", "shortDescription": {"text": "react insecure request \u2014 colyseus-server/src/rooms/GameRoom.ts:579"}, "fullDescription": {"text": "Unencrypted request over HTTP detected.\n\nRule: typescript.react.security.react-insecure-request.react-insecure-request\nSeverity: ERROR\nOWASP: A03:2017 - Sensitive Data Exposure, A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-319: Cleartext Transmission of Sensitive Information\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a39ed5bead41f16b", "name": "react insecure request \u2014 colyseus-server/src/rooms/GameRoom.ts:1278", "shortDescription": {"text": "react insecure request \u2014 colyseus-server/src/rooms/GameRoom.ts:1278"}, "fullDescription": {"text": "Unencrypted request over HTTP detected.\n\nRule: typescript.react.security.react-insecure-request.react-insecure-request\nSeverity: ERROR\nOWASP: A03:2017 - Sensitive Data Exposure, A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-319: Cleartext Transmission of Sensitive Information\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3247a45ec61d9945", "name": "react insecure request \u2014 colyseus-server/src/rooms/GameRoom.ts:1391", "shortDescription": {"text": "react insecure request \u2014 colyseus-server/src/rooms/GameRoom.ts:1391"}, "fullDescription": {"text": "Unencrypted request over HTTP detected.\n\nRule: typescript.react.security.react-insecure-request.react-insecure-request\nSeverity: ERROR\nOWASP: A03:2017 - Sensitive Data Exposure, A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-319: Cleartext Transmission of Sensitive Information\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a747fa10c080a0b6", "name": "react insecure request \u2014 colyseus-server/src/rooms/GameRoom.ts:1392", "shortDescription": {"text": "react insecure request \u2014 colyseus-server/src/rooms/GameRoom.ts:1392"}, "fullDescription": {"text": "Unencrypted request over HTTP detected.\n\nRule: typescript.react.security.react-insecure-request.react-insecure-request\nSeverity: ERROR\nOWASP: A03:2017 - Sensitive Data Exposure, A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-319: Cleartext Transmission of Sensitive Information\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-32c792283ab4bb6a", "name": "react insecure request \u2014 src/services/ColyseusService.ts:103", "shortDescription": {"text": "react insecure request \u2014 src/services/ColyseusService.ts:103"}, "fullDescription": {"text": "Unencrypted request over HTTP detected.\n\nRule: typescript.react.security.react-insecure-request.react-insecure-request\nSeverity: ERROR\nOWASP: A03:2017 - Sensitive Data Exposure, A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-319: Cleartext Transmission of Sensitive Information\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2576b7ec0ba44b61", "name": "react insecure request \u2014 src/services/ColyseusService.ts:313", "shortDescription": {"text": "react insecure request \u2014 src/services/ColyseusService.ts:313"}, "fullDescription": {"text": "Unencrypted request over HTTP detected.\n\nRule: typescript.react.security.react-insecure-request.react-insecure-request\nSeverity: ERROR\nOWASP: A03:2017 - Sensitive Data Exposure, A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-319: Cleartext Transmission of Sensitive Information\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c3b3269ecd50bccb", "name": "CVE-2026-4800: lodash 4.17.21 \u2014 colyseus-server/package-lock.json", "shortDescription": {"text": "CVE-2026-4800: lodash 4.17.21 \u2014 colyseus-server/package-lock.json"}, "fullDescription": {"text": "lodash: lodash: Arbitrary code execution via untrusted input in template imports\n\nImpact:\n\nThe fix for CVE-2021-23337 (https://github.com/advisories/GHSA-35jh-r3h4-6jhm) added validation for the variable option in _.template but did not apply the same validation to options.imports key names. Both paths flow into the same Function() constructor sink.\n\nWhen an application passes untrusted input as options.imports key names, an attacker can inject default-parameter expressions that execute arbitrary code at template compilation time.\n\nAdditionally, _.template uses assignInWith t\n\nPackage: lodash\nInstalled: 4.17.21\nFixed in: 4.18.0\nSeverity: HIGH\nFix: Upgrade lodash to 4.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-80a672bcfc728198", "name": "CVE-2025-13465: lodash 4.17.21 \u2014 colyseus-server/package-lock.json", "shortDescription": {"text": "CVE-2025-13465: lodash 4.17.21 \u2014 colyseus-server/package-lock.json"}, "fullDescription": {"text": "lodash: prototype pollution in _.unset and _.omit functions\n\nLodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset\u00a0and _.omit\u00a0functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.\n\nThe issue permits deletion of properties but does not allow overwriting their original behavior.\n\nThis issue is patched on 4.17.23\n\nPackage: lodash\nInstalled: 4.17.21\nFixed in: 4.17.23\nSeverity: MEDIUM\nFix: Upgrade lodash to 4.17.23"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-00f08e533b1d7496", "name": "CVE-2026-2950: lodash 4.17.21 \u2014 colyseus-server/package-lock.json", "shortDescription": {"text": "CVE-2026-2950: lodash 4.17.21 \u2014 colyseus-server/package-lock.json"}, "fullDescription": {"text": "lodash: Lodash: Prototype pollution allows deletion of built-in prototype properties via array path bypass\n\nImpact:\n\nLodash versions 4.17.23 and earlier are vulnerable to prototype pollution in the _.unset and _.omit functions. The fix for (CVE-2025-13465: https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg) only guards against string key members, so an attacker can bypass the check by passing array-wrapped path segments. This allows deletion of properties from built-in prototypes such as Object.prototype, Number.prototype, and String.prototype.\n\nThe issue permits deletion of prot\n\nPackage: lodash\nInstalled: 4.17.21\nFixed in: 4.18.0\nSeverity: MEDIUM\nFix: Upgrade lodash to 4.18.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-68bf049aeecd19cb", "name": "CVE-2024-55565: nanoid 2.1.11 \u2014 colyseus-server/package-lock.json", "shortDescription": {"text": "CVE-2024-55565: nanoid 2.1.11 \u2014 colyseus-server/package-lock.json"}, "fullDescription": {"text": "nanoid: nanoid mishandles non-integer values\n\nnanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.\n\nPackage: nanoid\nInstalled: 2.1.11\nFixed in: 5.0.9, 3.3.8\nSeverity: MEDIUM\nFix: Upgrade nanoid to 5.0.9, 3.3.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a7a2e6d68acfae3b", "name": "CVE-2026-4867: path-to-regexp 0.1.12 \u2014 colyseus-server/package-lock.json", "shortDescription": {"text": "CVE-2026-4867: path-to-regexp 0.1.12 \u2014 colyseus-server/package-lock.json"}, "fullDescription": {"text": "path-to-regexp: path-to-regexp: Denial of Service via catastrophic backtracking from malformed URL parameters\n\nImpact:\n\nA bad regular expression is generated any time you have three or more parameters within a single segment, separated by something that is not a period (.). For example, /:a-:b-:c or /:a-:b-:c-:d. The backtrack protection added in path-to-regexp@0.1.12 only prevents ambiguity for two parameters. With three or more, the generated lookahead does not block single separator characters, so capture groups overlap and cause catastrophic backtracking.\n\nPatches:\n\nUpgrade to path-to-regexp@0.1.13\n\n\n\nPackage: path-to-regexp\nInstalled: 0.1.12\nFixed in: 0.1.13\nSeverity: HIGH\nFix: Upgrade path-to-regexp to 0.1.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-472bd4aeebcbbb38", "name": "CVE-2025-15284: qs 6.13.0 \u2014 colyseus-server/package-lock.json", "shortDescription": {"text": "CVE-2025-15284: qs 6.13.0 \u2014 colyseus-server/package-lock.json"}, "fullDescription": {"text": "qs: qs: Denial of Service via improper input validation in array parsing\n\nImproper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.\n\n\nSummary\n\nThe arrayLimit\u00a0option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit\u00a0should apply uniformly across all array notations.\n\nNote:\u00a0The default parameterLimit\u00a0of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays la\n\nPackage: qs\nInstalled: 6.13.0\nFixed in: 6.14.1\nSeverity: MEDIUM\nFix: Upgrade qs to 6.14.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2f1ae0f98e770ef6", "name": "CVE-2026-8723: qs 6.13.0 \u2014 colyseus-server/package-lock.json", "shortDescription": {"text": "CVE-2026-8723: qs 6.13.0 \u2014 colyseus-server/package-lock.json"}, "fullDescription": {"text": "### Summary    `qs.stringify` throws `TypeError` when called with `arr ...\n\n### Summary\n\n\n\n`qs.stringify` throws `TypeError` when called with `arrayFormat: 'comma'` and `encodeValuesOnly: true` on an array containing `null` or `undefined`. The throw is synchronous and not handled by any of qs's null-related options (`skipNulls`, `strictNullHandling`).\n\n\n\n### Details\n\n\n\nIn the comma + `encodeValuesOnly` branch, `lib/stringify.js:145` mapped the array through the raw encoder before joining:\n\n\n\n```js\n\n\n\nobj = utils.maybeMap(obj, encoder);\n\n\n\n```\n\n\n\n`utils.encode` (`lib/uti\n\nPackage: qs\nInstalled: 6.13.0\nFixed in: 6.15.2\nSeverity: MEDIUM\nFix: Upgrade qs to 6.15.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dc540197eb99d590", "name": "CVE-2026-2391: qs 6.13.0 \u2014 colyseus-server/package-lock.json", "shortDescription": {"text": "CVE-2026-2391: qs 6.13.0 \u2014 colyseus-server/package-lock.json"}, "fullDescription": {"text": "qs: qs's arrayLimit bypass in comma parsing allows denial of service\n\n### Summary\nThe `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).\n\n### Details\nWhen the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?\n\nPackage: qs\nInstalled: 6.13.0\nFixed in: 6.14.2\nSeverity: LOW\nFix: Upgrade qs to 6.14.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-195d5cb4f1421b8f", "name": "CVE-2026-48779: ws 7.5.10 \u2014 colyseus-server/package-lock.json", "shortDescription": {"text": "CVE-2026-48779: ws 7.5.10 \u2014 colyseus-server/package-lock.json"}, "fullDescription": {"text": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments\n\nws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-si\n\nPackage: ws\nInstalled: 7.5.10\nFixed in: 5.2.5, 6.2.4, 7.5.11, 8.21.0\nSeverity: HIGH\nFix: Upgrade ws to 5.2.5, 6.2.4, 7.5.11, 8.21.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-af68503a75fcabb4", "name": "CVE-2026-48779: ws 8.17.1 \u2014 colyseus-server/package-lock.json", "shortDescription": {"text": "CVE-2026-48779: ws 8.17.1 \u2014 colyseus-server/package-lock.json"}, "fullDescription": {"text": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments\n\nws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-si\n\nPackage: ws\nInstalled: 8.17.1\nFixed in: 5.2.5, 6.2.4, 7.5.11, 8.21.0\nSeverity: HIGH\nFix: Upgrade ws to 5.2.5, 6.2.4, 7.5.11, 8.21.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fe989e2c52925631", "name": "CVE-2026-45736: ws 8.17.1 \u2014 colyseus-server/package-lock.json", "shortDescription": {"text": "CVE-2026-45736: ws 8.17.1 \u2014 colyseus-server/package-lock.json"}, "fullDescription": {"text": "ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`\n\nws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.\n\nPackage: ws\nInstalled: 8.17.1\nFixed in: 8.20.1\nSeverity: MEDIUM\nFix: Upgrade ws to 8.20.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-13059c3152d100ae", "name": "CVE-2026-48779: ws 8.18.3 \u2014 colyseus-server/package-lock.json", "shortDescription": {"text": "CVE-2026-48779: ws 8.18.3 \u2014 colyseus-server/package-lock.json"}, "fullDescription": {"text": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments\n\nws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-si\n\nPackage: ws\nInstalled: 8.18.3\nFixed in: 5.2.5, 6.2.4, 7.5.11, 8.21.0\nSeverity: HIGH\nFix: Upgrade ws to 5.2.5, 6.2.4, 7.5.11, 8.21.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-94e01d9ee75eeb11", "name": "CVE-2026-45736: ws 8.18.3 \u2014 colyseus-server/package-lock.json", "shortDescription": {"text": "CVE-2026-45736: ws 8.18.3 \u2014 colyseus-server/package-lock.json"}, "fullDescription": {"text": "ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`\n\nws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.\n\nPackage: ws\nInstalled: 8.18.3\nFixed in: 8.20.1\nSeverity: MEDIUM\nFix: Upgrade ws to 8.20.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4f99e458e29d9c56", "name": "CVE-2026-48779: ws 8.17.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-48779: ws 8.17.1 \u2014 package-lock.json"}, "fullDescription": {"text": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments\n\nws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-si\n\nPackage: ws\nInstalled: 8.17.1\nFixed in: 5.2.5, 6.2.4, 7.5.11, 8.21.0\nSeverity: HIGH\nFix: Upgrade ws to 5.2.5, 6.2.4, 7.5.11, 8.21.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-caa03492da1d4238", "name": "CVE-2026-45736: ws 8.17.1 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-45736: ws 8.17.1 \u2014 package-lock.json"}, "fullDescription": {"text": "ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`\n\nws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.\n\nPackage: ws\nInstalled: 8.17.1\nFixed in: 8.20.1\nSeverity: MEDIUM\nFix: Upgrade ws to 8.20.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d3b41d24d73cf707", "name": "CVE-2026-48779: ws 8.18.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-48779: ws 8.18.3 \u2014 package-lock.json"}, "fullDescription": {"text": "ws: ws: Denial of Service via memory exhaustion from small WebSocket fragments\n\nws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-si\n\nPackage: ws\nInstalled: 8.18.3\nFixed in: 5.2.5, 6.2.4, 7.5.11, 8.21.0\nSeverity: HIGH\nFix: Upgrade ws to 5.2.5, 6.2.4, 7.5.11, 8.21.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9f5abd1f03b5df58", "name": "CVE-2026-45736: ws 8.18.3 \u2014 package-lock.json", "shortDescription": {"text": "CVE-2026-45736: ws 8.18.3 \u2014 package-lock.json"}, "fullDescription": {"text": "ws: ws: Uninitialized memory disclosure via `websocket.close()` with `TypedArray`\n\nws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close() implementation is vulnerable to uninitialized memory disclosure when a TypedArray is passed as the reason argument. This vulnerability is fixed in 8.20.1.\n\nPackage: ws\nInstalled: 8.18.3\nFixed in: 8.20.1\nSeverity: MEDIUM\nFix: Upgrade ws to 8.20.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4a8af105eeab8c88", "name": "Agent authority lacks a verifier contract: units/.claude/settings.local.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: units/.claude/settings.local.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6fc9757f0b501abf", "name": "Agent authority lacks a verifier contract: public/lenta/.claude/settings.local.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: public/lenta/.claude/settings.local.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e637c415447867e4", "name": "Run SkillSpector's LLM-backed analysis in your own pipeline", "shortDescription": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "fullDescription": {"text": "Repobility ran SkillSpector's static rules server-side. The deeper LLM-backed analyzers \u2014 tool-poisoning (TP*), semantic security discovery (SSD*), developer-intent mismatch (SDI*) \u2014 are meant to run on YOUR machine with YOUR model; repobility never sends your code to an LLM. Recipe:\n\n# 1. Install SkillSpector in your own isolated env\npipx install \"skillspector @ git+https://github.com/NVIDIA/SkillSpector.git\"\n\n# 2. Point it at YOUR LLM pipeline (pick one) - your code stays on your machine\nexport SKILLSPECTOR_PROVIDER=anthropic && export ANTHROPIC_API_KEY=sk-ant-...\n# export SKILLSPECTOR_PROVIDER=openai   && export OPENAI_API_KEY=sk-...\n# export SKILLSPECTOR_PROVIDER=openai OPENAI_API_KEY=ollama OPENAI_BASE_URL=http://localhost:11434/v1 SKILLSPECTOR_MODEL=llama3.1:8b\n# export SKILLSPECTOR_PROVIDER=nv_build && export NVIDIA_INFERENCE_KEY=nvapi-...\n\n# 3. Run the LLM-backed scan per skill (omit --no-llm to enable the LLM analyzers)\nskillspector scan public/lenta/_agents/skills/tileskill -"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a2b1628e8c6f817c", "name": "Insecure pattern 'direct_innerhtml_assignment' in units/game.js:343", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in units/game.js:343"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2a2645e64a1b4015", "name": "Insecure pattern 'direct_innerhtml_assignment' in lenta/game.js:177", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in lenta/game.js:177"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c78b6f32dd63a4d9", "name": "Insecure pattern 'cors_wildcard' in netlify/functions/agent.js:60", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in netlify/functions/agent.js:60"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-25f9e99df871e4d2", "name": "Insecure pattern 'direct_innerhtml_assignment' in wavebreaker/index.html:816", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in wavebreaker/index.html:816"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d12f185655b139b1", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/replay.html:257", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/replay.html:257"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cfa8efb71d92e467", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/units/game.js:263", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/units/game.js:263"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d751be959753fa8", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/wallet-ui.js:20", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/wallet-ui.js:20"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-61403314fe373474", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/barracks_nft_plots.js:56", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/barracks_nft_plots.js:56"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bbc34153683be0df", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/village.js:330", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/village.js:330"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dfb30533ad6e529e", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/ronke_faucet.js:231", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/ronke_faucet.js:231"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7437eb0efcb27170", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/barracks_nft_modal.js:54", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/barracks_nft_modal.js:54"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4956e9ef31abfde3", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/hog_rider_popup.js:92", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/hog_rider_popup.js:92"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3639f1b041411601", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/leaderboard.js:183", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/leaderboard.js:183"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d98c4c53ae3c4350", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/f12_predeck_modal.js:40", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/f12_predeck_modal.js:40"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-016e9c37d8d5408c", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/index.html:2281", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/index.html:2281"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a6dd5a56a8e84ca2", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/floor12_merge.js:3713", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/floor12_merge.js:3713"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-03c032b25e0aebc5", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/ronke_swap.js:44", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/ronke_swap.js:44"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-afe4115e87d37481", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/village/village.js:330", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/village/village.js:330"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-454b5fdb9daeac5c", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/village/index.html:1893", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/village/index.html:1893"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bccad5fd8931d75b", "name": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/village/game.js:177", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/village/game.js:177"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ed0a6b05dc6a1f5", "name": "Very large file: units/game.js (7654 lines)", "shortDescription": {"text": "Very large file: units/game.js (7654 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-659a7c1468c11d9b", "name": "Very large file: src/units-main.ts (8677 lines)", "shortDescription": {"text": "Very large file: src/units-main.ts (8677 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d92c3dbdba15f137", "name": "Very large file: lenta/game.js (13032 lines)", "shortDescription": {"text": "Very large file: lenta/game.js (13032 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a4be0c66ab9ef5c5", "name": "Very large file: colyseus-server/src/rooms/GameRoom.ts (2579 lines)", "shortDescription": {"text": "Very large file: colyseus-server/src/rooms/GameRoom.ts (2579 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f3d84205505ab12a", "name": "Very large file: public/units/game.js (6811 lines)", "shortDescription": {"text": "Very large file: public/units/game.js (6811 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0488ad1f35f56eb5", "name": "Very large file: public/lenta/barracks_nft.js (963 lines)", "shortDescription": {"text": "Very large file: public/lenta/barracks_nft.js (963 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2fa21c751fbff631", "name": "Very large file: public/lenta/wallet.js (1313 lines)", "shortDescription": {"text": "Very large file: public/lenta/wallet.js (1313 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9aa84ec7f0a1efe", "name": "Very large file: public/lenta/ronke_faucet.js (1298 lines)", "shortDescription": {"text": "Very large file: public/lenta/ronke_faucet.js (1298 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6bfd2c2c6cefcbc3", "name": "Very large file: public/lenta/barracks_nft_modal.js (1532 lines)", "shortDescription": {"text": "Very large file: public/lenta/barracks_nft_modal.js (1532 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce9262b6d2117825", "name": "Very large file: public/lenta/floor12_merge.js (23761 lines)", "shortDescription": {"text": "Very large file: public/lenta/floor12_merge.js (23761 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-162cff809a5ca7af", "name": "Very large file: public/lenta/village/game.js (15965 lines)", "shortDescription": {"text": "Very large file: public/lenta/village/game.js (15965 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 88 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 139 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 16 placeholder/mock markers across 8 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d79c4077342a7d0", "name": "Runtime service client appears to use placeholder configuration", "shortDescription": {"text": "Runtime service client appears to use placeholder configuration"}, "fullDescription": {"text": "A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci, tests. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1caf80e3492f4976", "name": "Legacy-named symbol `drawUnitsOld` in units/update_enemy.js:106", "shortDescription": {"text": "Legacy-named symbol `drawUnitsOld` in units/update_enemy.js:106"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-932c4911901b16a3", "name": "Legacy-named symbol `drawUnitsOld` in units/update_worm.js:163", "shortDescription": {"text": "Legacy-named symbol `drawUnitsOld` in units/update_worm.js:163"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fe786d4821244951", "name": "Legacy-named symbol `bothOld` in units/game.js:4954", "shortDescription": {"text": "Legacy-named symbol `bothOld` in units/game.js:4954"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9fdd26f63dc8f965", "name": "Commented-code block (6 lines) in src/units-main.ts:5550", "shortDescription": {"text": "Commented-code block (6 lines) in src/units-main.ts:5550"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-02bc213eec8b9132", "name": "Legacy-named symbol `dot_clicker_save_v1` in src/persistence/SaveManager.ts:21", "shortDescription": {"text": "Legacy-named symbol `dot_clicker_save_v1` in src/persistence/SaveManager.ts:21"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ef47be9ed9a1dc43", "name": "Legacy-named symbol `dot_clicker_save_v2` in src/persistence/SaveManagerV2.ts:4", "shortDescription": {"text": "Legacy-named symbol `dot_clicker_save_v2` in src/persistence/SaveManagerV2.ts:4"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bc94d95cd3a16534", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/services/ColyseusService.ts:313", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/services/ColyseusService.ts:313"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-32f6ef25460d1280", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/services/WalletService.ts:426", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/services/WalletService.ts:426"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7916ca9e8c563509", "name": "Legacy-named symbol `drawUnitsOld` in lenta/update_enemy.js:106", "shortDescription": {"text": "Legacy-named symbol `drawUnitsOld` in lenta/update_enemy.js:106"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7ab9cf3429860637", "name": "Legacy-named symbol `drawUnitsOld` in lenta/update_worm.js:163", "shortDescription": {"text": "Legacy-named symbol `drawUnitsOld` in lenta/update_worm.js:163"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d9683db6afc9fb6", "name": "Legacy-named symbol `bothOld` in lenta/game.js:8458", "shortDescription": {"text": "Legacy-named symbol `bothOld` in lenta/game.js:8458"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2755540cf9d575c9", "name": "`fetch()` without try/.catch or AbortSignal \u2014 colyseus-server/src/rooms/GameRoom.ts:1391", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 colyseus-server/src/rooms/GameRoom.ts:1391"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a322cae0605eaa2a", "name": "Legacy-named symbol `bothOld` in public/units/game.js:4160", "shortDescription": {"text": "Legacy-named symbol `bothOld` in public/units/game.js:4160"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e2c8c063aa52a18d", "name": "Commented-code block (5 lines) in public/lenta/barracks_nft.js:95", "shortDescription": {"text": "Commented-code block (5 lines) in public/lenta/barracks_nft.js:95"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6dd16f975929372a", "name": "`fetch()` without try/.catch or AbortSignal \u2014 public/lenta/phantom_ronin.js:68", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 public/lenta/phantom_ronin.js:68"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4666b53afd89f95a", "name": "Commented-code block (5 lines) in public/lenta/editor.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in public/lenta/editor.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5a7b392ff3dabeae", "name": "Commented-code block (5 lines) in public/lenta/wallet.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in public/lenta/wallet.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cb5f73e343ae8286", "name": "`fetch()` without try/.catch or AbortSignal \u2014 public/lenta/wallet.js:185", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 public/lenta/wallet.js:185"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c6d82e1afb5de7b6", "name": "Commented-code block (7 lines) in public/lenta/supabase_sync.js:4", "shortDescription": {"text": "Commented-code block (7 lines) in public/lenta/supabase_sync.js:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bba7aa8497281838", "name": "Commented-code block (5 lines) in public/lenta/ronke_faucet.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in public/lenta/ronke_faucet.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c2e0adf88e77420c", "name": "`fetch()` without try/.catch or AbortSignal \u2014 public/lenta/ronke_faucet.js:300", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 public/lenta/ronke_faucet.js:300"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c8705927e1999b43", "name": "Legacy-named symbol `drawUnitsOld` in public/lenta/update_enemy.js:106", "shortDescription": {"text": "Legacy-named symbol `drawUnitsOld` in public/lenta/update_enemy.js:106"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-36cc33b800f61065", "name": "Commented-code block (5 lines) in public/lenta/hog_rider_popup.js:16", "shortDescription": {"text": "Commented-code block (5 lines) in public/lenta/hog_rider_popup.js:16"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-da57c96f60e2e988", "name": "Commented-code block (6 lines) in public/lenta/trackslow01_music.js:1", "shortDescription": {"text": "Commented-code block (6 lines) in public/lenta/trackslow01_music.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3336bdeee808720e", "name": "Legacy-named symbol `f12_pending_settle_v1` in public/lenta/floor12_merge.js:3351", "shortDescription": {"text": "Legacy-named symbol `f12_pending_settle_v1` in public/lenta/floor12_merge.js:3351"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6dbbc74e0880562a", "name": "Legacy-named symbol `drawUnitsOld` in public/lenta/update_worm.js:163", "shortDescription": {"text": "Legacy-named symbol `drawUnitsOld` in public/lenta/update_worm.js:163"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b393872fda2b9a05", "name": "`fetch()` without try/.catch or AbortSignal \u2014 public/lenta/ronke_swap.js:315", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 public/lenta/ronke_swap.js:315"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a3d1b600bf086d7a", "name": "Commented-code block (5 lines) in public/lenta/village/editor.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in public/lenta/village/editor.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d6a53452550610ae", "name": "Legacy-named symbol `bothOld` in public/lenta/village/game.js:8672", "shortDescription": {"text": "Legacy-named symbol `bothOld` in public/lenta/village/game.js:8672"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e80999bb3b27cb63", "name": "`fetch()` without try/.catch or AbortSignal \u2014 public/lenta/village/game.js:15398", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 public/lenta/village/game.js:15398"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9e4157a8e347de8b", "name": "Dangling fetch: POST https://api.anthropic.com/v1/messages (netlify/functions/agent.js:33)", "shortDescription": {"text": "Dangling fetch: POST https://api.anthropic.com/v1/messages (netlify/functions/agent.js:33)"}, "fullDescription": {"text": "`netlify/functions/agent.js:33` calls `POST https://api.anthropic.com/v1/messages` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.anthropic.com/v1/messages`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4f900e206baf95e7", "name": "Dangling fetch: POST https://api.roninchain.com/rpc (public/lenta/leaderboard.js:30)", "shortDescription": {"text": "Dangling fetch: POST https://api.roninchain.com/rpc (public/lenta/leaderboard.js:30)"}, "fullDescription": {"text": "`public/lenta/leaderboard.js:30` calls `POST https://api.roninchain.com/rpc` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.roninchain.com/rpc`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3eac3cd9a40bc733", "name": "Dangling fetch: POST https://rbkivemouxwcgrpzazxb.supabase.co/functions/v1/gas-drip (public/lenta/ronke_swap.js:303)", "shortDescription": {"text": "Dangling fetch: POST https://rbkivemouxwcgrpzazxb.supabase.co/functions/v1/gas-drip (public/lenta/ronke_swap.js:303)"}, "fullDescription": {"text": "`public/lenta/ronke_swap.js:303` calls `POST https://rbkivemouxwcgrpzazxb.supabase.co/functions/v1/gas-drip` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/rbkivemouxwcgrpzazxb.supabase.co/functions/v1/gas-drip`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fc1056104197ef7e", "name": "Dangling fetch: POST /.netlify/functions/agent (public/lenta/village/game.js:15398)", "shortDescription": {"text": "Dangling fetch: POST /.netlify/functions/agent (public/lenta/village/game.js:15398)"}, "fullDescription": {"text": "`public/lenta/village/game.js:15398` calls `POST /.netlify/functions/agent` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/.netlify/functions/agent`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-28840e70eb156fd0", "name": "Dangling fetch: POST https://api.anthropic.com/v1/messages (public/lenta/village/game.js:15411)", "shortDescription": {"text": "Dangling fetch: POST https://api.anthropic.com/v1/messages (public/lenta/village/game.js:15411)"}, "fullDescription": {"text": "`public/lenta/village/game.js:15411` calls `POST https://api.anthropic.com/v1/messages` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.anthropic.com/v1/messages`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c19af528ffda9cb4", "name": "Dangling fetch: POST http://127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0 (src/services/ColyseusService.ts:", "shortDescription": {"text": "Dangling fetch: POST http://127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0 (src/services/ColyseusService.ts:103)"}, "fullDescription": {"text": "`src/services/ColyseusService.ts:103` calls `POST http://127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-07320a2acc553123", "name": "Dangling fetch: POST http://127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0 (src/services/ColyseusService.ts:", "shortDescription": {"text": "Dangling fetch: POST http://127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0 (src/services/ColyseusService.ts:313)"}, "fullDescription": {"text": "`src/services/ColyseusService.ts:313` calls `POST http://127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-91f46ed0e768c3ad", "name": "Dangling fetch: POST http://127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0 (colyseus-server/src/rooms/GameRo", "shortDescription": {"text": "Dangling fetch: POST http://127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0 (colyseus-server/src/rooms/GameRoom.ts:550)"}, "fullDescription": {"text": "`colyseus-server/src/rooms/GameRoom.ts:550` calls `POST http://127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-40b90a7b285ae74f", "name": "Dangling fetch: POST http://127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0 (colyseus-server/src/rooms/GameRo", "shortDescription": {"text": "Dangling fetch: POST http://127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0 (colyseus-server/src/rooms/GameRoom.ts:579)"}, "fullDescription": {"text": "`colyseus-server/src/rooms/GameRoom.ts:579` calls `POST http://127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0c04fb5c13a0d7f0", "name": "Dangling fetch: POST http://127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0 (colyseus-server/src/rooms/GameRo", "shortDescription": {"text": "Dangling fetch: POST http://127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0 (colyseus-server/src/rooms/GameRoom.ts:1278)"}, "fullDescription": {"text": "`colyseus-server/src/rooms/GameRoom.ts:1278` calls `POST http://127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-02a22d61f0996c76", "name": "Dangling fetch: POST http://127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0 (colyseus-server/src/rooms/GameRo", "shortDescription": {"text": "Dangling fetch: POST http://127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0 (colyseus-server/src/rooms/GameRoom.ts:1391)"}, "fullDescription": {"text": "`colyseus-server/src/rooms/GameRoom.ts:1391` calls `POST http://127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-27b98248bb067ae0", "name": "Dangling fetch: POST http://127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0 (colyseus-server/src/rooms/GameRo", "shortDescription": {"text": "Dangling fetch: POST http://127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0 (colyseus-server/src/rooms/GameRoom.ts:1392)"}, "fullDescription": {"text": "`colyseus-server/src/rooms/GameRoom.ts:1392` calls `POST http://127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`colyseus-server/src/app.config.ts` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6a9d365615f18159", "name": "Unused endpoint: GET /replays", "shortDescription": {"text": "Unused endpoint: GET /replays"}, "fullDescription": {"text": "`colyseus-server/src/app.config.ts` declares `GET /replays` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a4f7f6b9498a6f90", "name": "Unused endpoint: GET /replays/:id", "shortDescription": {"text": "Unused endpoint: GET /replays/:id"}, "fullDescription": {"text": "`colyseus-server/src/app.config.ts` declares `GET /replays/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24607"}, "properties": {"repository": "bitcointeamlt-blip/ok5", "repoUrl": "https://github.com/bitcointeamlt-blip/ok5", "branch": "main"}, "results": [{"ruleId": "scanner-11bec7eb552e7f75", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 units/update_enemy.js:129"}, "properties": {"repobilityId": "417f8a3523e10f37", "scanner": "scanner-primary", "fingerprint": "11bec7eb552e7f75", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-abe90603d1f78eb7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 units/update_worm.js:191"}, "properties": {"repobilityId": "1ca6f55d7f7a3934", "scanner": "scanner-primary", "fingerprint": "abe90603d1f78eb7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6d3471aa450bf6d7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/units-main.ts:517"}, "properties": {"repobilityId": "57d0c30ff38fff6a", "scanner": "scanner-primary", "fingerprint": "6d3471aa450bf6d7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-69ee0d30be10918c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/main.ts:70"}, "properties": {"repobilityId": "981eedf4f52fff93", "scanner": "scanner-primary", "fingerprint": "69ee0d30be10918c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7c255955c5063c21", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/persistence/SaveManager.ts:41"}, "properties": {"repobilityId": "8aec96c2a1316b88", "scanner": "scanner-primary", "fingerprint": "7c255955c5063c21", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ffc516a83eb42b7e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/persistence/SaveManagerV2.ts:23"}, "properties": {"repobilityId": "f107a7c75ac9b1fa", "scanner": "scanner-primary", "fingerprint": "ffc516a83eb42b7e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a1b4ac3ccdfac82f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/services/SupabaseService.ts:88"}, "properties": {"repobilityId": "2c7ea6f61ad1f7ce", "scanner": "scanner-primary", "fingerprint": "a1b4ac3ccdfac82f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2295fb9445a07074", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/services/ColyseusService.ts:174"}, "properties": {"repobilityId": "4c8a826a3fc448c0", "scanner": "scanner-primary", "fingerprint": "2295fb9445a07074", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-835b314a13ab249b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/services/MatchmakingService.ts:25"}, "properties": {"repobilityId": "4cd2e37cabf7ffaf", "scanner": "scanner-primary", "fingerprint": "835b314a13ab249b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-814d7f51a5c74672", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 lenta/update_enemy.js:129"}, "properties": {"repobilityId": "c583fad5ce47f020", "scanner": "scanner-primary", "fingerprint": "814d7f51a5c74672", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d979cb9d5995871b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 lenta/update_worm.js:191"}, "properties": {"repobilityId": "a2b3a0c0c06e9524", "scanner": "scanner-primary", "fingerprint": "d979cb9d5995871b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d6515148f845269d", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 lenta/game.js:8367"}, "properties": {"repobilityId": "134d759aef50535b", "scanner": "scanner-primary", "fingerprint": "d6515148f845269d", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-c23ddf653852decf", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 lenta/game.js:118"}, "properties": {"repobilityId": "e8c974bf709b2169", "scanner": "scanner-primary", "fingerprint": "c23ddf653852decf", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1b7b72bfd7d43148", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 colyseus-server/src/app.config.ts:47"}, "properties": {"repobilityId": "a0a9ed0188ebff31", "scanner": "scanner-primary", "fingerprint": "1b7b72bfd7d43148", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-437593163a3dc11e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 colyseus-server/src/rooms/UnitsRoom.ts:31"}, "properties": {"repobilityId": "47fe3b70fd260630", "scanner": "scanner-primary", "fingerprint": "437593163a3dc11e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-705258b8df6b221b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 colyseus-server/src/rooms/GameRoom.ts:546"}, "properties": {"repobilityId": "df7c58091a65d9c5", "scanner": "scanner-primary", "fingerprint": "705258b8df6b221b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0231744233afb709", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 colyseus-server/src/persistence/UnitsPersistence.ts:98"}, "properties": {"repobilityId": "c552e4c8bdba9ea4", "scanner": "scanner-primary", "fingerprint": "0231744233afb709", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-48a7dbb1be969fba", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 colyseus-server/src/services/UfoTicketService.ts:83"}, "properties": {"repobilityId": "b7131cfe40859d65", "scanner": "scanner-primary", "fingerprint": "48a7dbb1be969fba", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-022a01503f73c6ed", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 public/lenta/wallet-ui.js:538"}, "properties": {"repobilityId": "d33dd6e0a90ee59a", "scanner": "scanner-primary", "fingerprint": "022a01503f73c6ed", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-0c60e32c02ebf923", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 public/lenta/village.js:365"}, "properties": {"repobilityId": "4a0734f16b51f32f", "scanner": "scanner-primary", "fingerprint": "0c60e32c02ebf923", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-041db795902ca20b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 public/lenta/wallet.js:1186"}, "properties": {"repobilityId": "3942a6703a55b37d", "scanner": "scanner-primary", "fingerprint": "041db795902ca20b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8a5d9361c8c01e30", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 public/lenta/ronke_faucet.js:1148"}, "properties": {"repobilityId": "379bc77159094cd9", "scanner": "scanner-primary", "fingerprint": "8a5d9361c8c01e30", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-87aaf49593140fd5", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 public/lenta/ronke_faucet.js:1295"}, "properties": {"repobilityId": "3c14979cfd36c094", "scanner": "scanner-primary", "fingerprint": "87aaf49593140fd5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a3aa530244fff219", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 public/lenta/barracks_nft_modal.js:296"}, "properties": {"repobilityId": "a4c87214d4ba99cf", "scanner": "scanner-primary", "fingerprint": "a3aa530244fff219", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-56780ad7ad51367a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 public/lenta/barracks_nft_modal.js:654"}, "properties": {"repobilityId": "a013033963980934", "scanner": "scanner-primary", "fingerprint": "56780ad7ad51367a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6270ad9b415f1064", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 public/lenta/.__local_server_8500.js:26"}, "properties": {"repobilityId": "0a41a12cbf972966", "scanner": "scanner-primary", "fingerprint": "6270ad9b415f1064", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5385b04d41e074b7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 public/lenta/update_enemy.js:129"}, "properties": {"repobilityId": "49bdeb027e15e0bf", "scanner": "scanner-primary", "fingerprint": "5385b04d41e074b7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9d95138593b65190", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 public/lenta/hog_rider_popup.js:832"}, "properties": {"repobilityId": "59de166166cf278a", "scanner": "scanner-primary", "fingerprint": "9d95138593b65190", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7c7ca6454335a1d4", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 public/lenta/.__local_server_8501.js:27"}, "properties": {"repobilityId": "1ecd855b6dd43294", "scanner": "scanner-primary", "fingerprint": "7c7ca6454335a1d4", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b15816fed6bfcf43", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 public/lenta/leaderboard.js:227"}, "properties": {"repobilityId": "08768c9f14e45b1d", "scanner": "scanner-primary", "fingerprint": "b15816fed6bfcf43", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-aa01d16e0c50d182", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 public/lenta/f12_predeck_modal.js:55"}, "properties": {"repobilityId": "f166fdc80f9fde4a", "scanner": "scanner-primary", "fingerprint": "aa01d16e0c50d182", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-c0224392a539ce32", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 public/lenta/floor12_merge.js:3277"}, "properties": {"repobilityId": "d23bdd8b5d9bccb1", "scanner": "scanner-primary", "fingerprint": "c0224392a539ce32", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ab1d76a2af900668", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 public/lenta/update_worm.js:191"}, "properties": {"repobilityId": "1b998e5689961c48", "scanner": "scanner-primary", "fingerprint": "ab1d76a2af900668", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d764140ab08d914d", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 public/lenta/village/village.js:365"}, "properties": {"repobilityId": "05524d845b65b9b7", "scanner": "scanner-primary", "fingerprint": "d764140ab08d914d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-3f267a1f769547f3", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 public/lenta/village/game.js:8570"}, "properties": {"repobilityId": "ce94933003e54f57", "scanner": "scanner-primary", "fingerprint": "3f267a1f769547f3", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-f7f4d1a258bc5284", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 public/lenta/village/game.js:118"}, "properties": {"repobilityId": "17abf34046fb5de5", "scanner": "scanner-primary", "fingerprint": "f7f4d1a258bc5284", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f1e71bcb549230b0", "level": "error", "message": {"text": "react insecure request \u2014 colyseus-server/src/rooms/GameRoom.ts:550"}, "properties": {"repobilityId": "a228ef1d48df1f1b", "scanner": "scanner-primary", "fingerprint": "f1e71bcb549230b0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["semgrep", "security", "react"]}}, {"ruleId": "scanner-834390f42713ac8e", "level": "error", "message": {"text": "react insecure request \u2014 colyseus-server/src/rooms/GameRoom.ts:579"}, "properties": {"repobilityId": "a10a30c1fe01ff86", "scanner": "scanner-primary", "fingerprint": "834390f42713ac8e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["semgrep", "security", "react"]}}, {"ruleId": "scanner-a39ed5bead41f16b", "level": "error", "message": {"text": "react insecure request \u2014 colyseus-server/src/rooms/GameRoom.ts:1278"}, "properties": {"repobilityId": "564a1b009b9a0a69", "scanner": "scanner-primary", "fingerprint": "a39ed5bead41f16b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["semgrep", "security", "react"]}}, {"ruleId": "scanner-3247a45ec61d9945", "level": "error", "message": {"text": "react insecure request \u2014 colyseus-server/src/rooms/GameRoom.ts:1391"}, "properties": {"repobilityId": "814e1f795b52c00f", "scanner": "scanner-primary", "fingerprint": "3247a45ec61d9945", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["semgrep", "security", "react"]}}, {"ruleId": "scanner-a747fa10c080a0b6", "level": "error", "message": {"text": "react insecure request \u2014 colyseus-server/src/rooms/GameRoom.ts:1392"}, "properties": {"repobilityId": "15576f151b98aa18", "scanner": "scanner-primary", "fingerprint": "a747fa10c080a0b6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["semgrep", "security", "react"]}}, {"ruleId": "scanner-32c792283ab4bb6a", "level": "error", "message": {"text": "react insecure request \u2014 src/services/ColyseusService.ts:103"}, "properties": {"repobilityId": "4baaba1476ebe19b", "scanner": "scanner-primary", "fingerprint": "32c792283ab4bb6a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["semgrep", "security", "react"]}}, {"ruleId": "scanner-2576b7ec0ba44b61", "level": "error", "message": {"text": "react insecure request \u2014 src/services/ColyseusService.ts:313"}, "properties": {"repobilityId": "f4b3c7a5fe49b208", "scanner": "scanner-primary", "fingerprint": "2576b7ec0ba44b61", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["semgrep", "security", "react"]}}, {"ruleId": "scanner-c3b3269ecd50bccb", "level": "error", "message": {"text": "CVE-2026-4800: lodash 4.17.21 \u2014 colyseus-server/package-lock.json"}, "properties": {"repobilityId": "00d386cb8edeb4e2", "scanner": "scanner-primary", "fingerprint": "c3b3269ecd50bccb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4800"]}}, {"ruleId": "scanner-80a672bcfc728198", "level": "warning", "message": {"text": "CVE-2025-13465: lodash 4.17.21 \u2014 colyseus-server/package-lock.json"}, "properties": {"repobilityId": "f125d36473b3f635", "scanner": "scanner-primary", "fingerprint": "80a672bcfc728198", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-13465"]}}, {"ruleId": "scanner-00f08e533b1d7496", "level": "warning", "message": {"text": "CVE-2026-2950: lodash 4.17.21 \u2014 colyseus-server/package-lock.json"}, "properties": {"repobilityId": "b4b3c9a62adc14f8", "scanner": "scanner-primary", "fingerprint": "00f08e533b1d7496", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2950"]}}, {"ruleId": "scanner-68bf049aeecd19cb", "level": "warning", "message": {"text": "CVE-2024-55565: nanoid 2.1.11 \u2014 colyseus-server/package-lock.json"}, "properties": {"repobilityId": "e29ec9ef0c183d5c", "scanner": "scanner-primary", "fingerprint": "68bf049aeecd19cb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2024-55565"]}}, {"ruleId": "scanner-a7a2e6d68acfae3b", "level": "error", "message": {"text": "CVE-2026-4867: path-to-regexp 0.1.12 \u2014 colyseus-server/package-lock.json"}, "properties": {"repobilityId": "111f21f41e768036", "scanner": "scanner-primary", "fingerprint": "a7a2e6d68acfae3b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-4867"]}}, {"ruleId": "scanner-472bd4aeebcbbb38", "level": "warning", "message": {"text": "CVE-2025-15284: qs 6.13.0 \u2014 colyseus-server/package-lock.json"}, "properties": {"repobilityId": "e0f4176fabb227a8", "scanner": "scanner-primary", "fingerprint": "472bd4aeebcbbb38", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-15284"]}}, {"ruleId": "scanner-2f1ae0f98e770ef6", "level": "warning", "message": {"text": "CVE-2026-8723: qs 6.13.0 \u2014 colyseus-server/package-lock.json"}, "properties": {"repobilityId": "7a4a012c647a2140", "scanner": "scanner-primary", "fingerprint": "2f1ae0f98e770ef6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-8723"]}}, {"ruleId": "scanner-dc540197eb99d590", "level": "note", "message": {"text": "CVE-2026-2391: qs 6.13.0 \u2014 colyseus-server/package-lock.json"}, "properties": {"repobilityId": "3b15aa8cbcc72277", "scanner": "scanner-primary", "fingerprint": "dc540197eb99d590", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-2391"]}}, {"ruleId": "scanner-195d5cb4f1421b8f", "level": "error", "message": {"text": "CVE-2026-48779: ws 7.5.10 \u2014 colyseus-server/package-lock.json"}, "properties": {"repobilityId": "cce7c359b74164a2", "scanner": "scanner-primary", "fingerprint": "195d5cb4f1421b8f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48779"]}}, {"ruleId": "scanner-af68503a75fcabb4", "level": "error", "message": {"text": "CVE-2026-48779: ws 8.17.1 \u2014 colyseus-server/package-lock.json"}, "properties": {"repobilityId": "cce7c359b74164a2", "scanner": "scanner-primary", "fingerprint": "af68503a75fcabb4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48779"]}}, {"ruleId": "scanner-fe989e2c52925631", "level": "warning", "message": {"text": "CVE-2026-45736: ws 8.17.1 \u2014 colyseus-server/package-lock.json"}, "properties": {"repobilityId": "641f2f7696759722", "scanner": "scanner-primary", "fingerprint": "fe989e2c52925631", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45736"]}}, {"ruleId": "scanner-13059c3152d100ae", "level": "error", "message": {"text": "CVE-2026-48779: ws 8.18.3 \u2014 colyseus-server/package-lock.json"}, "properties": {"repobilityId": "cce7c359b74164a2", "scanner": "scanner-primary", "fingerprint": "13059c3152d100ae", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48779"]}}, {"ruleId": "scanner-94e01d9ee75eeb11", "level": "warning", "message": {"text": "CVE-2026-45736: ws 8.18.3 \u2014 colyseus-server/package-lock.json"}, "properties": {"repobilityId": "641f2f7696759722", "scanner": "scanner-primary", "fingerprint": "94e01d9ee75eeb11", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45736"]}}, {"ruleId": "scanner-4f99e458e29d9c56", "level": "error", "message": {"text": "CVE-2026-48779: ws 8.17.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "f7e31279300ec7e6", "scanner": "scanner-primary", "fingerprint": "4f99e458e29d9c56", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48779"]}}, {"ruleId": "scanner-caa03492da1d4238", "level": "warning", "message": {"text": "CVE-2026-45736: ws 8.17.1 \u2014 package-lock.json"}, "properties": {"repobilityId": "7635a49db32e4699", "scanner": "scanner-primary", "fingerprint": "caa03492da1d4238", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45736"]}}, {"ruleId": "scanner-d3b41d24d73cf707", "level": "error", "message": {"text": "CVE-2026-48779: ws 8.18.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "f7e31279300ec7e6", "scanner": "scanner-primary", "fingerprint": "d3b41d24d73cf707", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48779"]}}, {"ruleId": "scanner-9f5abd1f03b5df58", "level": "warning", "message": {"text": "CVE-2026-45736: ws 8.18.3 \u2014 package-lock.json"}, "properties": {"repobilityId": "7635a49db32e4699", "scanner": "scanner-primary", "fingerprint": "9f5abd1f03b5df58", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45736"]}}, {"ruleId": "scanner-4a8af105eeab8c88", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: units/.claude/settings.local.json"}, "properties": {"repobilityId": "ccd6e12d64fe4b3a", "scanner": "scanner-primary", "fingerprint": "4a8af105eeab8c88", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "units/.claude/settings.local.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6fc9757f0b501abf", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: public/lenta/.claude/settings.local.json"}, "properties": {"repobilityId": "629ca0950c07c86e", "scanner": "scanner-primary", "fingerprint": "6fc9757f0b501abf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/lenta/.claude/settings.local.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e637c415447867e4", "level": "none", "message": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "properties": {"repobilityId": "1936f198ff5212bf", "scanner": "scanner-primary", "fingerprint": "e637c415447867e4", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["skillspector", "mcp-skill", "llm-advisory", "ai-coder"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-a2b1628e8c6f817c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in units/game.js:343"}, "properties": {"repobilityId": "eb635b5d8a647ba5", "scanner": "scanner-primary", "fingerprint": "a2b1628e8c6f817c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "units/game.js"}, "region": {"startLine": 343}}}]}, {"ruleId": "scanner-2a2645e64a1b4015", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in lenta/game.js:177"}, "properties": {"repobilityId": "505a08d794778408", "scanner": "scanner-primary", "fingerprint": "2a2645e64a1b4015", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "lenta/game.js"}, "region": {"startLine": 177}}}]}, {"ruleId": "scanner-c78b6f32dd63a4d9", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in netlify/functions/agent.js:60"}, "properties": {"repobilityId": "691e06bea1d5612f", "scanner": "scanner-primary", "fingerprint": "c78b6f32dd63a4d9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "netlify/functions/agent.js"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-25f9e99df871e4d2", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in wavebreaker/index.html:816"}, "properties": {"repobilityId": "0ac9d82324f8e30d", "scanner": "scanner-primary", "fingerprint": "25f9e99df871e4d2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "wavebreaker/index.html"}, "region": {"startLine": 816}}}]}, {"ruleId": "scanner-d12f185655b139b1", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/replay.html:257"}, "properties": {"repobilityId": "f2f0469c7c97c569", "scanner": "scanner-primary", "fingerprint": "d12f185655b139b1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/replay.html"}, "region": {"startLine": 257}}}]}, {"ruleId": "scanner-cfa8efb71d92e467", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/units/game.js:263"}, "properties": {"repobilityId": "d8c955a3be7dd7c8", "scanner": "scanner-primary", "fingerprint": "cfa8efb71d92e467", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/units/game.js"}, "region": {"startLine": 263}}}]}, {"ruleId": "scanner-2d751be959753fa8", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/wallet-ui.js:20"}, "properties": {"repobilityId": "38112ccb0be17dde", "scanner": "scanner-primary", "fingerprint": "2d751be959753fa8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/lenta/wallet-ui.js"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-61403314fe373474", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/barracks_nft_plots.js:56"}, "properties": {"repobilityId": "9614d3d894329cf8", "scanner": "scanner-primary", "fingerprint": "61403314fe373474", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/lenta/barracks_nft_plots.js"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-bbc34153683be0df", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/village.js:330"}, "properties": {"repobilityId": "11b349e295784502", "scanner": "scanner-primary", "fingerprint": "bbc34153683be0df", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/lenta/village.js"}, "region": {"startLine": 330}}}]}, {"ruleId": "scanner-dfb30533ad6e529e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/ronke_faucet.js:231"}, "properties": {"repobilityId": "0d6f1551e7a48672", "scanner": "scanner-primary", "fingerprint": "dfb30533ad6e529e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/lenta/ronke_faucet.js"}, "region": {"startLine": 231}}}]}, {"ruleId": "scanner-7437eb0efcb27170", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/barracks_nft_modal.js:54"}, "properties": {"repobilityId": "17fdc2b6ccf8cf1f", "scanner": "scanner-primary", "fingerprint": "7437eb0efcb27170", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/lenta/barracks_nft_modal.js"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-4956e9ef31abfde3", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/hog_rider_popup.js:92"}, "properties": {"repobilityId": "1fbaff154ff1ca92", "scanner": "scanner-primary", "fingerprint": "4956e9ef31abfde3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/lenta/hog_rider_popup.js"}, "region": {"startLine": 92}}}]}, {"ruleId": "scanner-3639f1b041411601", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/leaderboard.js:183"}, "properties": {"repobilityId": "be88488d9b92bb6b", "scanner": "scanner-primary", "fingerprint": "3639f1b041411601", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/lenta/leaderboard.js"}, "region": {"startLine": 183}}}]}, {"ruleId": "scanner-d98c4c53ae3c4350", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/f12_predeck_modal.js:40"}, "properties": {"repobilityId": "344d0b20e1e811b6", "scanner": "scanner-primary", "fingerprint": "d98c4c53ae3c4350", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/lenta/f12_predeck_modal.js"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-016e9c37d8d5408c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/index.html:2281"}, "properties": {"repobilityId": "d658d281de377af4", "scanner": "scanner-primary", "fingerprint": "016e9c37d8d5408c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/lenta/index.html"}, "region": {"startLine": 2281}}}]}, {"ruleId": "scanner-a6dd5a56a8e84ca2", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/floor12_merge.js:3713"}, "properties": {"repobilityId": "9c431ad68f8e95fe", "scanner": "scanner-primary", "fingerprint": "a6dd5a56a8e84ca2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/lenta/floor12_merge.js"}, "region": {"startLine": 3713}}}]}, {"ruleId": "scanner-03c032b25e0aebc5", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/ronke_swap.js:44"}, "properties": {"repobilityId": "e3f77a6d6c024a2b", "scanner": "scanner-primary", "fingerprint": "03c032b25e0aebc5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/lenta/ronke_swap.js"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-afe4115e87d37481", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/village/village.js:330"}, "properties": {"repobilityId": "b90871207869ebf7", "scanner": "scanner-primary", "fingerprint": "afe4115e87d37481", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/lenta/village/village.js"}, "region": {"startLine": 330}}}]}, {"ruleId": "scanner-454b5fdb9daeac5c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/village/index.html:1893"}, "properties": {"repobilityId": "526a55025fda2742", "scanner": "scanner-primary", "fingerprint": "454b5fdb9daeac5c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/lenta/village/index.html"}, "region": {"startLine": 1893}}}]}, {"ruleId": "scanner-bccad5fd8931d75b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in public/lenta/village/game.js:177"}, "properties": {"repobilityId": "acd4b1bd2f43628a", "scanner": "scanner-primary", "fingerprint": "bccad5fd8931d75b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "public/lenta/village/game.js"}, "region": {"startLine": 177}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-3ed0a6b05dc6a1f5", "level": "note", "message": {"text": "Very large file: units/game.js (7654 lines)"}, "properties": {"repobilityId": "eed5f6807c329ad7", "scanner": "scanner-primary", "fingerprint": "3ed0a6b05dc6a1f5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-659a7c1468c11d9b", "level": "note", "message": {"text": "Very large file: src/units-main.ts (8677 lines)"}, "properties": {"repobilityId": "a55d603e24b6e680", "scanner": "scanner-primary", "fingerprint": "659a7c1468c11d9b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d92c3dbdba15f137", "level": "note", "message": {"text": "Very large file: lenta/game.js (13032 lines)"}, "properties": {"repobilityId": "8efc8a60328cff0a", "scanner": "scanner-primary", "fingerprint": "d92c3dbdba15f137", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a4be0c66ab9ef5c5", "level": "note", "message": {"text": "Very large file: colyseus-server/src/rooms/GameRoom.ts (2579 lines)"}, "properties": {"repobilityId": "b71abc5c3d8a4acd", "scanner": "scanner-primary", "fingerprint": "a4be0c66ab9ef5c5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f3d84205505ab12a", "level": "note", "message": {"text": "Very large file: public/units/game.js (6811 lines)"}, "properties": {"repobilityId": "e49b89285cbbe91b", "scanner": "scanner-primary", "fingerprint": "f3d84205505ab12a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0488ad1f35f56eb5", "level": "note", "message": {"text": "Very large file: public/lenta/barracks_nft.js (963 lines)"}, "properties": {"repobilityId": "b2fa976a979c8254", "scanner": "scanner-primary", "fingerprint": "0488ad1f35f56eb5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2fa21c751fbff631", "level": "note", "message": {"text": "Very large file: public/lenta/wallet.js (1313 lines)"}, "properties": {"repobilityId": "a7aff57f338354b6", "scanner": "scanner-primary", "fingerprint": "2fa21c751fbff631", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b9aa84ec7f0a1efe", "level": "note", "message": {"text": "Very large file: public/lenta/ronke_faucet.js (1298 lines)"}, "properties": {"repobilityId": "dba66a8076606dff", "scanner": "scanner-primary", "fingerprint": "b9aa84ec7f0a1efe", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6bfd2c2c6cefcbc3", "level": "note", "message": {"text": "Very large file: public/lenta/barracks_nft_modal.js (1532 lines)"}, "properties": {"repobilityId": "4f3d55f2ea3891b7", "scanner": "scanner-primary", "fingerprint": "6bfd2c2c6cefcbc3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ce9262b6d2117825", "level": "note", "message": {"text": "Very large file: public/lenta/floor12_merge.js (23761 lines)"}, "properties": {"repobilityId": "df44487282873700", "scanner": "scanner-primary", "fingerprint": "ce9262b6d2117825", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-162cff809a5ca7af", "level": "note", "message": {"text": "Very large file: public/lenta/village/game.js (15965 lines)"}, "properties": {"repobilityId": "7e4d0a10e3e4a1d0", "scanner": "scanner-primary", "fingerprint": "162cff809a5ca7af", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "9c12d04c751510f5", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "04d6ad417a073f0b", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "b76a62c6f7d5f59b", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-9d79c4077342a7d0", "level": "warning", "message": {"text": "Runtime service client appears to use placeholder configuration"}, "properties": {"repobilityId": "4ae11a951f18341c", "scanner": "scanner-primary", "fingerprint": "9d79c4077342a7d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "runtime-config", "service-client", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "cb4a2d2c07c1d424", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "a2f4f27f5aa6f931", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "f3c4d08dce1bbe8d", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-1caf80e3492f4976", "level": "note", "message": {"text": "Legacy-named symbol `drawUnitsOld` in units/update_enemy.js:106"}, "properties": {"repobilityId": "6825b55ec1af1a88", "scanner": "scanner-primary", "fingerprint": "1caf80e3492f4976", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-932c4911901b16a3", "level": "note", "message": {"text": "Legacy-named symbol `drawUnitsOld` in units/update_worm.js:163"}, "properties": {"repobilityId": "9b55347438b94cc7", "scanner": "scanner-primary", "fingerprint": "932c4911901b16a3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-fe786d4821244951", "level": "note", "message": {"text": "Legacy-named symbol `bothOld` in units/game.js:4954"}, "properties": {"repobilityId": "f9bbd5415162d40d", "scanner": "scanner-primary", "fingerprint": "fe786d4821244951", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-9fdd26f63dc8f965", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/units-main.ts:5550"}, "properties": {"repobilityId": "025249f23625cf6f", "scanner": "scanner-primary", "fingerprint": "9fdd26f63dc8f965", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-02bc213eec8b9132", "level": "note", "message": {"text": "Legacy-named symbol `dot_clicker_save_v1` in src/persistence/SaveManager.ts:21"}, "properties": {"repobilityId": "a9ddffb4b6711661", "scanner": "scanner-primary", "fingerprint": "02bc213eec8b9132", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-ef47be9ed9a1dc43", "level": "note", "message": {"text": "Legacy-named symbol `dot_clicker_save_v2` in src/persistence/SaveManagerV2.ts:4"}, "properties": {"repobilityId": "fffaf097e054e6ef", "scanner": "scanner-primary", "fingerprint": "ef47be9ed9a1dc43", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-bc94d95cd3a16534", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/services/ColyseusService.ts:313"}, "properties": {"repobilityId": "c7426dcb465a4c9b", "scanner": "scanner-primary", "fingerprint": "bc94d95cd3a16534", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-32f6ef25460d1280", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/services/WalletService.ts:426"}, "properties": {"repobilityId": "2f2369fe2e73d96b", "scanner": "scanner-primary", "fingerprint": "32f6ef25460d1280", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-7916ca9e8c563509", "level": "note", "message": {"text": "Legacy-named symbol `drawUnitsOld` in lenta/update_enemy.js:106"}, "properties": {"repobilityId": "284c5674b444376d", "scanner": "scanner-primary", "fingerprint": "7916ca9e8c563509", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-7ab9cf3429860637", "level": "note", "message": {"text": "Legacy-named symbol `drawUnitsOld` in lenta/update_worm.js:163"}, "properties": {"repobilityId": "39e6406c1323edae", "scanner": "scanner-primary", "fingerprint": "7ab9cf3429860637", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-0d9683db6afc9fb6", "level": "note", "message": {"text": "Legacy-named symbol `bothOld` in lenta/game.js:8458"}, "properties": {"repobilityId": "e415ca8165161355", "scanner": "scanner-primary", "fingerprint": "0d9683db6afc9fb6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2755540cf9d575c9", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 colyseus-server/src/rooms/GameRoom.ts:1391"}, "properties": {"repobilityId": "9a793d4f8572fbf0", "scanner": "scanner-primary", "fingerprint": "2755540cf9d575c9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a322cae0605eaa2a", "level": "note", "message": {"text": "Legacy-named symbol `bothOld` in public/units/game.js:4160"}, "properties": {"repobilityId": "bec084d765c40d18", "scanner": "scanner-primary", "fingerprint": "a322cae0605eaa2a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e2c8c063aa52a18d", "level": "none", "message": {"text": "Commented-code block (5 lines) in public/lenta/barracks_nft.js:95"}, "properties": {"repobilityId": "0941e26ed1c5d643", "scanner": "scanner-primary", "fingerprint": "e2c8c063aa52a18d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6dd16f975929372a", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 public/lenta/phantom_ronin.js:68"}, "properties": {"repobilityId": "34abfca574d290b3", "scanner": "scanner-primary", "fingerprint": "6dd16f975929372a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-4666b53afd89f95a", "level": "none", "message": {"text": "Commented-code block (5 lines) in public/lenta/editor.js:1"}, "properties": {"repobilityId": "36a6f5c93e0277fb", "scanner": "scanner-primary", "fingerprint": "4666b53afd89f95a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5a7b392ff3dabeae", "level": "none", "message": {"text": "Commented-code block (5 lines) in public/lenta/wallet.js:1"}, "properties": {"repobilityId": "1423a3e5d3221efd", "scanner": "scanner-primary", "fingerprint": "5a7b392ff3dabeae", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cb5f73e343ae8286", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 public/lenta/wallet.js:185"}, "properties": {"repobilityId": "44a61c6ad58cfc89", "scanner": "scanner-primary", "fingerprint": "cb5f73e343ae8286", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c6d82e1afb5de7b6", "level": "none", "message": {"text": "Commented-code block (7 lines) in public/lenta/supabase_sync.js:4"}, "properties": {"repobilityId": "dea922da3eab9e63", "scanner": "scanner-primary", "fingerprint": "c6d82e1afb5de7b6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bba7aa8497281838", "level": "none", "message": {"text": "Commented-code block (5 lines) in public/lenta/ronke_faucet.js:1"}, "properties": {"repobilityId": "c168472d2ddc7f72", "scanner": "scanner-primary", "fingerprint": "bba7aa8497281838", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c2e0adf88e77420c", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 public/lenta/ronke_faucet.js:300"}, "properties": {"repobilityId": "9d152fc74ec18487", "scanner": "scanner-primary", "fingerprint": "c2e0adf88e77420c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c8705927e1999b43", "level": "note", "message": {"text": "Legacy-named symbol `drawUnitsOld` in public/lenta/update_enemy.js:106"}, "properties": {"repobilityId": "75745cae5a57af3f", "scanner": "scanner-primary", "fingerprint": "c8705927e1999b43", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-36cc33b800f61065", "level": "none", "message": {"text": "Commented-code block (5 lines) in public/lenta/hog_rider_popup.js:16"}, "properties": {"repobilityId": "b9f8a21a05e27277", "scanner": "scanner-primary", "fingerprint": "36cc33b800f61065", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-da57c96f60e2e988", "level": "none", "message": {"text": "Commented-code block (6 lines) in public/lenta/trackslow01_music.js:1"}, "properties": {"repobilityId": "def92962b2a0976b", "scanner": "scanner-primary", "fingerprint": "da57c96f60e2e988", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3336bdeee808720e", "level": "note", "message": {"text": "Legacy-named symbol `f12_pending_settle_v1` in public/lenta/floor12_merge.js:3351"}, "properties": {"repobilityId": "83874d0eb2956a00", "scanner": "scanner-primary", "fingerprint": "3336bdeee808720e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-6dbbc74e0880562a", "level": "note", "message": {"text": "Legacy-named symbol `drawUnitsOld` in public/lenta/update_worm.js:163"}, "properties": {"repobilityId": "af49e51553edaa87", "scanner": "scanner-primary", "fingerprint": "6dbbc74e0880562a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b393872fda2b9a05", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 public/lenta/ronke_swap.js:315"}, "properties": {"repobilityId": "fa7ebbd1396d1900", "scanner": "scanner-primary", "fingerprint": "b393872fda2b9a05", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a3d1b600bf086d7a", "level": "none", "message": {"text": "Commented-code block (5 lines) in public/lenta/village/editor.js:1"}, "properties": {"repobilityId": "fc8e939492b4fd18", "scanner": "scanner-primary", "fingerprint": "a3d1b600bf086d7a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d6a53452550610ae", "level": "note", "message": {"text": "Legacy-named symbol `bothOld` in public/lenta/village/game.js:8672"}, "properties": {"repobilityId": "f5e78b8af595dea4", "scanner": "scanner-primary", "fingerprint": "d6a53452550610ae", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-e80999bb3b27cb63", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 public/lenta/village/game.js:15398"}, "properties": {"repobilityId": "210e91020ff182b3", "scanner": "scanner-primary", "fingerprint": "e80999bb3b27cb63", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9e4157a8e347de8b", "level": "error", "message": {"text": "Dangling fetch: POST https://api.anthropic.com/v1/messages (netlify/functions/agent.js:33)"}, "properties": {"repobilityId": "7d25ea79e682fd94", "scanner": "scanner-primary", "fingerprint": "9e4157a8e347de8b", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-4f900e206baf95e7", "level": "error", "message": {"text": "Dangling fetch: POST https://api.roninchain.com/rpc (public/lenta/leaderboard.js:30)"}, "properties": {"repobilityId": "a91fdd7a3a32319d", "scanner": "scanner-primary", "fingerprint": "4f900e206baf95e7", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-3eac3cd9a40bc733", "level": "error", "message": {"text": "Dangling fetch: POST https://rbkivemouxwcgrpzazxb.supabase.co/functions/v1/gas-drip (public/lenta/ronke_swap.js:303)"}, "properties": {"repobilityId": "51859f3ee46c0362", "scanner": "scanner-primary", "fingerprint": "3eac3cd9a40bc733", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-fc1056104197ef7e", "level": "error", "message": {"text": "Dangling fetch: POST /.netlify/functions/agent (public/lenta/village/game.js:15398)"}, "properties": {"repobilityId": "321bcdd293f136cf", "scanner": "scanner-primary", "fingerprint": "fc1056104197ef7e", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-28840e70eb156fd0", "level": "error", "message": {"text": "Dangling fetch: POST https://api.anthropic.com/v1/messages (public/lenta/village/game.js:15411)"}, "properties": {"repobilityId": "2771e3020ee0d1c6", "scanner": "scanner-primary", "fingerprint": "28840e70eb156fd0", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-c19af528ffda9cb4", "level": "error", "message": {"text": "Dangling fetch: POST http://127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0 (src/services/ColyseusService.ts:103)"}, "properties": {"repobilityId": "bbf1687c645ba8ff", "scanner": "scanner-primary", "fingerprint": "c19af528ffda9cb4", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-07320a2acc553123", "level": "error", "message": {"text": "Dangling fetch: POST http://127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0 (src/services/ColyseusService.ts:313)"}, "properties": {"repobilityId": "04bb9e48522d1329", "scanner": "scanner-primary", "fingerprint": "07320a2acc553123", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-91f46ed0e768c3ad", "level": "error", "message": {"text": "Dangling fetch: POST http://127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0 (colyseus-server/src/rooms/GameRoom.ts:550)"}, "properties": {"repobilityId": "39cb9bcc99d5f8f1", "scanner": "scanner-primary", "fingerprint": "91f46ed0e768c3ad", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-40b90a7b285ae74f", "level": "error", "message": {"text": "Dangling fetch: POST http://127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0 (colyseus-server/src/rooms/GameRoom.ts:579)"}, "properties": {"repobilityId": "6c4ea1859e6834ca", "scanner": "scanner-primary", "fingerprint": "40b90a7b285ae74f", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-0c04fb5c13a0d7f0", "level": "error", "message": {"text": "Dangling fetch: POST http://127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0 (colyseus-server/src/rooms/GameRoom.ts:1278)"}, "properties": {"repobilityId": "2cc2e87aaff38d6a", "scanner": "scanner-primary", "fingerprint": "0c04fb5c13a0d7f0", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-02a22d61f0996c76", "level": "error", "message": {"text": "Dangling fetch: POST http://127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0 (colyseus-server/src/rooms/GameRoom.ts:1391)"}, "properties": {"repobilityId": "45f7acaaf461fa7e", "scanner": "scanner-primary", "fingerprint": "02a22d61f0996c76", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-27b98248bb067ae0", "level": "error", "message": {"text": "Dangling fetch: POST http://127.0.0.1:7242/ingest/b2c16d13-1eb7-4cea-94bc-55ab1f89cac0 (colyseus-server/src/rooms/GameRoom.ts:1392)"}, "properties": {"repobilityId": "8d88df2bfa5b029e", "scanner": "scanner-primary", "fingerprint": "27b98248bb067ae0", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "68ba00cb87d8bf1d", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6a9d365615f18159", "level": "note", "message": {"text": "Unused endpoint: GET /replays"}, "properties": {"repobilityId": "6f229227c2b6f1f9", "scanner": "scanner-primary", "fingerprint": "6a9d365615f18159", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a4f7f6b9498a6f90", "level": "note", "message": {"text": "Unused endpoint: GET /replays/:id"}, "properties": {"repobilityId": "f0672cee705334fb", "scanner": "scanner-primary", "fingerprint": "a4f7f6b9498a6f90", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}