{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-13998d18d60556d3", "name": "Insecure pattern 'direct_innerhtml_assignment' in web/index.html:706", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web/index.html:706"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ba29eb17ea23ed20", "name": "Insecure pattern 'local_storage_auth_token' in web/index.html:377", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in web/index.html:377"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-448d8837178ae57a", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "3 tests / 13 src (ratio 0.23)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-319e66a630e14977", "name": "2 env vars used in code but missing from .env.example", "shortDescription": {"text": "2 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `HOST`, `PORT`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-30ae8c63e1da3a30", "name": "FastAPI POST `watchlist_add` without auth dependency \u2014 api/routes_market.py:102", "shortDescription": {"text": "FastAPI POST `watchlist_add` without auth dependency \u2014 api/routes_market.py:102"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a4cf7648ab4e39d7", "name": "FastAPI DELETE `watchlist_remove` without auth dependency \u2014 api/routes_market.py:114", "shortDescription": {"text": "FastAPI DELETE `watchlist_remove` without auth dependency \u2014 api/routes_market.py:114"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2d17baba033104f7", "name": "FastAPI POST `update_settings` without auth dependency \u2014 api/routes_settings.py:134", "shortDescription": {"text": "FastAPI POST `update_settings` without auth dependency \u2014 api/routes_settings.py:134"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7f311f81cd6256ff", "name": "FastAPI POST `order_preview` without auth dependency \u2014 api/routes_trading.py:103", "shortDescription": {"text": "FastAPI POST `order_preview` without auth dependency \u2014 api/routes_trading.py:103"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-941ee31f624d8cdb", "name": "FastAPI POST `order_submit` without auth dependency \u2014 api/routes_trading.py:162", "shortDescription": {"text": "FastAPI POST `order_submit` without auth dependency \u2014 api/routes_trading.py:162"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e52f3f837e32ef44", "name": "FastAPI PATCH `journal_notes` without auth dependency \u2014 api/routes_trading.py:312", "shortDescription": {"text": "FastAPI PATCH `journal_notes` without auth dependency \u2014 api/routes_trading.py:312"}, "fullDescription": {"text": "`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bf0615e8490256f8", "name": "FastAPI POST `journal_close` without auth dependency \u2014 api/routes_trading.py:320", "shortDescription": {"text": "FastAPI POST `journal_close` without auth dependency \u2014 api/routes_trading.py:320"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-99ad8bd8b4fbf807", "name": "FastAPI POST `journal_sync` without auth dependency \u2014 api/routes_trading.py:340", "shortDescription": {"text": "FastAPI POST `journal_sync` without auth dependency \u2014 api/routes_trading.py:340"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-19dd5c7c9084ee92", "name": "FastAPI POST `alerts_mark_seen` without auth dependency \u2014 api/routes_trading.py:378", "shortDescription": {"text": "FastAPI POST `alerts_mark_seen` without auth dependency \u2014 api/routes_trading.py:378"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24078"}, "properties": {"repository": "alexreed122287/options-platform", "repoUrl": "https://github.com/alexreed122287/options-platform", "branch": "main"}, "results": [{"ruleId": "scanner-13998d18d60556d3", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web/index.html:706"}, "properties": {"repobilityId": "403cbb974bf02660", "scanner": "scanner-primary", "fingerprint": "13998d18d60556d3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/index.html"}, "region": {"startLine": 706}}}]}, {"ruleId": "scanner-ba29eb17ea23ed20", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in web/index.html:377"}, "properties": {"repobilityId": "3d783b7b59aba88b", "scanner": "scanner-primary", "fingerprint": "ba29eb17ea23ed20", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/index.html"}, "region": {"startLine": 377}}}]}, {"ruleId": "scanner-448d8837178ae57a", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "13af6451e15656fc", "scanner": "scanner-primary", "fingerprint": "448d8837178ae57a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "d8a835c5c12cfbed", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-319e66a630e14977", "level": "none", "message": {"text": "2 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "d838d1fc5d8231c9", "scanner": "scanner-primary", "fingerprint": "319e66a630e14977", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-30ae8c63e1da3a30", "level": "error", "message": {"text": "FastAPI POST `watchlist_add` without auth dependency \u2014 api/routes_market.py:102"}, "properties": {"repobilityId": "43e531600f2e1261", "scanner": "scanner-primary", "fingerprint": "30ae8c63e1da3a30", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/routes_market.py"}, "region": {"startLine": 102}}}]}, {"ruleId": "scanner-a4cf7648ab4e39d7", "level": "error", "message": {"text": "FastAPI DELETE `watchlist_remove` without auth dependency \u2014 api/routes_market.py:114"}, "properties": {"repobilityId": "2a2c3b39faf1c370", "scanner": "scanner-primary", "fingerprint": "a4cf7648ab4e39d7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/routes_market.py"}, "region": {"startLine": 114}}}]}, {"ruleId": "scanner-2d17baba033104f7", "level": "error", "message": {"text": "FastAPI POST `update_settings` without auth dependency \u2014 api/routes_settings.py:134"}, "properties": {"repobilityId": "624efa0794f339fd", "scanner": "scanner-primary", "fingerprint": "2d17baba033104f7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/routes_settings.py"}, "region": {"startLine": 134}}}]}, {"ruleId": "scanner-7f311f81cd6256ff", "level": "error", "message": {"text": "FastAPI POST `order_preview` without auth dependency \u2014 api/routes_trading.py:103"}, "properties": {"repobilityId": "46cac0d1dc2f7fb6", "scanner": "scanner-primary", "fingerprint": "7f311f81cd6256ff", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/routes_trading.py"}, "region": {"startLine": 103}}}]}, {"ruleId": "scanner-941ee31f624d8cdb", "level": "error", "message": {"text": "FastAPI POST `order_submit` without auth dependency \u2014 api/routes_trading.py:162"}, "properties": {"repobilityId": "d2142ee4ac0b0b60", "scanner": "scanner-primary", "fingerprint": "941ee31f624d8cdb", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/routes_trading.py"}, "region": {"startLine": 162}}}]}, {"ruleId": "scanner-e52f3f837e32ef44", "level": "error", "message": {"text": "FastAPI PATCH `journal_notes` without auth dependency \u2014 api/routes_trading.py:312"}, "properties": {"repobilityId": "3acc5af47f78e29b", "scanner": "scanner-primary", "fingerprint": "e52f3f837e32ef44", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/routes_trading.py"}, "region": {"startLine": 312}}}]}, {"ruleId": "scanner-bf0615e8490256f8", "level": "error", "message": {"text": "FastAPI POST `journal_close` without auth dependency \u2014 api/routes_trading.py:320"}, "properties": {"repobilityId": "36a44f82c2ad9c3a", "scanner": "scanner-primary", "fingerprint": "bf0615e8490256f8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/routes_trading.py"}, "region": {"startLine": 320}}}]}, {"ruleId": "scanner-99ad8bd8b4fbf807", "level": "error", "message": {"text": "FastAPI POST `journal_sync` without auth dependency \u2014 api/routes_trading.py:340"}, "properties": {"repobilityId": "f2ecac616f4b3395", "scanner": "scanner-primary", "fingerprint": "99ad8bd8b4fbf807", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/routes_trading.py"}, "region": {"startLine": 340}}}]}, {"ruleId": "scanner-19dd5c7c9084ee92", "level": "error", "message": {"text": "FastAPI POST `alerts_mark_seen` without auth dependency \u2014 api/routes_trading.py:378"}, "properties": {"repobilityId": "fcfdefc7c036b021", "scanner": "scanner-primary", "fingerprint": "19dd5c7c9084ee92", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/routes_trading.py"}, "region": {"startLine": 378}}}]}]}]}