{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-0c0b9b49edb42a94", "name": "Stray `console.log` in TS/JS \u2014 server.js:78", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server.js:78"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a0455baa23315058", "name": "`truncate` class without `title=` for hover reveal \u2014 src/App.jsx:340", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/App.jsx:340"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a1d864172c77bf1b", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/KoersAlerts.jsx:215", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/KoersAlerts.jsx:215"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b322e654b86dde46", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/EmailWijzigenModal.jsx:104", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/EmailWijzigenModal.jsx:104"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-77fdf2532693819a", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/PaymentFlow.jsx:340", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/PaymentFlow.jsx:340"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2d0483b98d550b15", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/CurrencySelector.jsx:120", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/CurrencySelector.jsx:120"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5dbfd3ef59a3ba26", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/Profiel.jsx:270", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/Profiel.jsx:270"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ab55ec38176c5536", "name": "TODO/FIXME marker in shipping code \u2014 src/components/KYCFlow.jsx:466", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 src/components/KYCFlow.jsx:466"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f166ec18409a3bf0", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/AccountantBeheer.jsx:135", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/AccountantBeheer.jsx:135"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d9dfa4b0f756797a", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/dashboard/RecentTransacties.jsx:250", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/dashboard/RecentTransacties.jsx:250"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-927b59636c5b67e9", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/dashboard/SaldoCard.jsx:82", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/dashboard/SaldoCard.jsx:82"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-17952a7367cdcc68", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/dashboard/QuickResend.jsx:80", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/dashboard/QuickResend.jsx:80"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4a49834ee5783a27", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/dashboard/Spaardoelen.jsx:242", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/dashboard/Spaardoelen.jsx:242"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2ee9aa624887e674", "name": "TODO/FIXME marker in shipping code \u2014 src/components/dashboard/Spaardoelen.jsx:173", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 src/components/dashboard/Spaardoelen.jsx:173"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-30ba07aa37faabae", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/beneficiaries/BeneficiaryKaart.jsx:43", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/beneficiaries/BeneficiaryKaart.jsx:43"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-94fff093a1dc4b45", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/beneficiaries/BeneficiaryKiezer.jsx:139", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/beneficiaries/BeneficiaryKiezer.jsx:139"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6a95c5998a0ee2d6", "name": "Icon-only button without accessible name \u2014 src/components/admin/UserManagement.jsx:645", "shortDescription": {"text": "Icon-only button without accessible name \u2014 src/components/admin/UserManagement.jsx:645"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-589b45017d2e6679", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/chat/SupportChat.jsx:272", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/chat/SupportChat.jsx:272"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0ef3644fd9497778", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/referral/ReferralKaart.jsx:187", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/referral/ReferralKaart.jsx:187"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-68e093e95ded60c4", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/referral/ReferralLeaderboard.jsx:73", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/referral/ReferralLeaderboard.jsx:73"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c60da8b8b9a34d5a", "name": "`truncate` class without `title=` for hover reveal \u2014 src/components/recurring/RecurringKaart.jsx:60", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/recurring/RecurringKaart.jsx:60"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-906345cdc00642dd", "name": "`truncate` class without `title=` for hover reveal \u2014 src/pages/AdminErrors.jsx:222", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/pages/AdminErrors.jsx:222"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f717cad1b1eaa8ac", "name": "Insecure pattern 'document_write' in src/components/TweeFactorInstellingen.jsx:142", "shortDescription": {"text": "Insecure pattern 'document_write' in src/components/TweeFactorInstellingen.jsx:142"}, "fullDescription": {"text": "Found a known-risky pattern (document_write). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d425c0e8ecf4763a", "name": "Insecure pattern 'local_storage_auth_token' in src/services/api.test.js:60", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in src/services/api.test.js:60"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bfdc9e47253d5e17", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0af575a40a203c99", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7f1e4527e6fecffa", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "snyk/actions/node@master can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e084c5072e7347a9", "name": "Very large file: src/components/PaymentFlow.jsx (1511 lines)", "shortDescription": {"text": "Very large file: src/components/PaymentFlow.jsx (1511 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-84c81fd3b08818cb", "name": "Very large file: src/i18n/tr.js (1244 lines)", "shortDescription": {"text": "Very large file: src/i18n/tr.js (1244 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c2709b281c615beb", "name": "Very large file: src/i18n/ru.js (1236 lines)", "shortDescription": {"text": "Very large file: src/i18n/ru.js (1236 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2537c39ff048dfc9", "name": "Very large file: src/i18n/az.js (1236 lines)", "shortDescription": {"text": "Very large file: src/i18n/az.js (1236 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-12234485a87d7851", "name": "Very large file: src/i18n/en.js (1244 lines)", "shortDescription": {"text": "Very large file: src/i18n/en.js (1244 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fc03bb820aa37fc4", "name": "Very large file: src/i18n/nl.js (1246 lines)", "shortDescription": {"text": "Very large file: src/i18n/nl.js (1246 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "8 test file(s) for 136 source file(s) (ratio 0.06). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 26 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 79 placeholder/mock markers across 31 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c5f98b152cddb6d", "name": "Agent authority lacks a verifier contract: .claude/launch.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/launch.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a7b7f0e6e4683c13", "name": "Commented-code block (5 lines) in vite.config.js:14", "shortDescription": {"text": "Commented-code block (5 lines) in vite.config.js:14"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-28fe5b5bf17fb076", "name": "Commented-code block (5 lines) in src/sw.js:28", "shortDescription": {"text": "Commented-code block (5 lines) in src/sw.js:28"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-851092455ae9d845", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/sw.js:22", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/sw.js:22"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2959e35cc545fbd9", "name": "Commented-code block (6 lines) in src/App.jsx:67", "shortDescription": {"text": "Commented-code block (6 lines) in src/App.jsx:67"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-548534003a36bec7", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/components/KoersAlerts.jsx:73", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/components/KoersAlerts.jsx:73"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-53fd8e2429c93095", "name": "Commented-code block (8 lines) in src/components/Dashboard.jsx:58", "shortDescription": {"text": "Commented-code block (8 lines) in src/components/Dashboard.jsx:58"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-67b5cdb44af493cc", "name": "Legacy-named symbol `swiftbridge_payment_draft_v2` in src/components/PaymentFlow.jsx:1183", "shortDescription": {"text": "Legacy-named symbol `swiftbridge_payment_draft_v2` in src/components/PaymentFlow.jsx:1183"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1c5e5a560d98674b", "name": "Commented-code block (5 lines) in src/components/PaymentFlow.jsx:276", "shortDescription": {"text": "Commented-code block (5 lines) in src/components/PaymentFlow.jsx:276"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b4095f6ff18bcd38", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/components/PaymentFlow.jsx:208", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/components/PaymentFlow.jsx:208"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d9b92285e0f8aaee", "name": "Commented-code block (5 lines) in src/components/KYCFlow.jsx:462", "shortDescription": {"text": "Commented-code block (5 lines) in src/components/KYCFlow.jsx:462"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bc9f1d189bc2c6d0", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/components/KYCFlow.jsx:467", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/components/KYCFlow.jsx:467"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c361df17ea903676", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/services/pushNotificatie.js:39", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/services/pushNotificatie.js:39"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7245ca00b1090302", "name": "Commented-code block (6 lines) in src/services/api.js:8", "shortDescription": {"text": "Commented-code block (6 lines) in src/services/api.js:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b334d875f2339fa1", "name": "5 env vars used in code but missing from .env.example", "shortDescription": {"text": "5 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `DEV`, `PORT`, `PROD`, `VITE_EMI_LIVE`, `VITE_SWIFTNEWS_URL`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6826d0441f46b080", "name": "Frontend route `/wise-vs-swiftbridge` has no Link/navigate to it \u2014 src/App.jsx", "shortDescription": {"text": "Frontend route `/wise-vs-swiftbridge` has no Link/navigate to it \u2014 src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e1242cb437b8061c", "name": "Frontend route `/r/:code` has no Link/navigate to it \u2014 src/App.jsx", "shortDescription": {"text": "Frontend route `/r/:code` has no Link/navigate to it \u2014 src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f22fa3a1ecd47b0c", "name": "Frontend route `/verifieer-email` has no Link/navigate to it \u2014 src/App.jsx", "shortDescription": {"text": "Frontend route `/verifieer-email` has no Link/navigate to it \u2014 src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-63414d07304cf70a", "name": "Frontend route `/email-wijzigen-bevestigen` has no Link/navigate to it \u2014 src/App.jsx", "shortDescription": {"text": "Frontend route `/email-wijzigen-bevestigen` has no Link/navigate to it \u2014 src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9da2480bc8c9039e", "name": "Frontend route `/email-wijzigen-intrekken` has no Link/navigate to it \u2014 src/App.jsx", "shortDescription": {"text": "Frontend route `/email-wijzigen-intrekken` has no Link/navigate to it \u2014 src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a7b5faa28dafa080", "name": "Frontend route `/admin` has no Link/navigate to it \u2014 src/App.jsx", "shortDescription": {"text": "Frontend route `/admin` has no Link/navigate to it \u2014 src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-195cd6e79c554079", "name": "Frontend route `/admin/compliance` has no Link/navigate to it \u2014 src/App.jsx", "shortDescription": {"text": "Frontend route `/admin/compliance` has no Link/navigate to it \u2014 src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ac149be3c139f833", "name": "Frontend route `/tx/:token` has no Link/navigate to it \u2014 src/App.jsx", "shortDescription": {"text": "Frontend route `/tx/:token` has no Link/navigate to it \u2014 src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ff5bd46a05191a4a", "name": "Frontend route `/admin/overzicht` has no Link/navigate to it \u2014 src/App.jsx", "shortDescription": {"text": "Frontend route `/admin/overzicht` has no Link/navigate to it \u2014 src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2873dc0fd6511172", "name": "Frontend route `/admin/errors` has no Link/navigate to it \u2014 src/App.jsx", "shortDescription": {"text": "Frontend route `/admin/errors` has no Link/navigate to it \u2014 src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24425"}, "properties": {"repository": "Aydin-Dogan/swiftbridge-app", "repoUrl": "https://github.com/Aydin-Dogan/swiftbridge-app", "branch": "main"}, "results": [{"ruleId": "scanner-0c0b9b49edb42a94", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server.js:78"}, "properties": {"repobilityId": "a9deebb5fdc93edc", "scanner": "scanner-primary", "fingerprint": "0c0b9b49edb42a94", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a0455baa23315058", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/App.jsx:340"}, "properties": {"repobilityId": "eb5008e648a1f49c", "scanner": "scanner-primary", "fingerprint": "a0455baa23315058", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-a1d864172c77bf1b", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/KoersAlerts.jsx:215"}, "properties": {"repobilityId": "36953023bd163629", "scanner": "scanner-primary", "fingerprint": "a1d864172c77bf1b", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-b322e654b86dde46", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/EmailWijzigenModal.jsx:104"}, "properties": {"repobilityId": "a99585ea50de9482", "scanner": "scanner-primary", "fingerprint": "b322e654b86dde46", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-77fdf2532693819a", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/PaymentFlow.jsx:340"}, "properties": {"repobilityId": "64388142e48de81a", "scanner": "scanner-primary", "fingerprint": "77fdf2532693819a", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-2d0483b98d550b15", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/CurrencySelector.jsx:120"}, "properties": {"repobilityId": "8fbd0c5f0b968344", "scanner": "scanner-primary", "fingerprint": "2d0483b98d550b15", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-5dbfd3ef59a3ba26", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/Profiel.jsx:270"}, "properties": {"repobilityId": "0b0b583e4061bc65", "scanner": "scanner-primary", "fingerprint": "5dbfd3ef59a3ba26", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-ab55ec38176c5536", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 src/components/KYCFlow.jsx:466"}, "properties": {"repobilityId": "abefc86717191c0a", "scanner": "scanner-primary", "fingerprint": "ab55ec38176c5536", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-f166ec18409a3bf0", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/AccountantBeheer.jsx:135"}, "properties": {"repobilityId": "c090ce3f1a302f22", "scanner": "scanner-primary", "fingerprint": "f166ec18409a3bf0", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-d9dfa4b0f756797a", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/dashboard/RecentTransacties.jsx:250"}, "properties": {"repobilityId": "3d239d67327a0dd1", "scanner": "scanner-primary", "fingerprint": "d9dfa4b0f756797a", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-927b59636c5b67e9", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/dashboard/SaldoCard.jsx:82"}, "properties": {"repobilityId": "ccf8d80104c36e51", "scanner": "scanner-primary", "fingerprint": "927b59636c5b67e9", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-17952a7367cdcc68", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/dashboard/QuickResend.jsx:80"}, "properties": {"repobilityId": "277154313b777b42", "scanner": "scanner-primary", "fingerprint": "17952a7367cdcc68", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-4a49834ee5783a27", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/dashboard/Spaardoelen.jsx:242"}, "properties": {"repobilityId": "2d2016e7eb649f17", "scanner": "scanner-primary", "fingerprint": "4a49834ee5783a27", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-2ee9aa624887e674", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 src/components/dashboard/Spaardoelen.jsx:173"}, "properties": {"repobilityId": "f50188d96f377bba", "scanner": "scanner-primary", "fingerprint": "2ee9aa624887e674", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-30ba07aa37faabae", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/beneficiaries/BeneficiaryKaart.jsx:43"}, "properties": {"repobilityId": "d2ff535e4ea7bfd3", "scanner": "scanner-primary", "fingerprint": "30ba07aa37faabae", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-94fff093a1dc4b45", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/beneficiaries/BeneficiaryKiezer.jsx:139"}, "properties": {"repobilityId": "9632c8f7f4bdd896", "scanner": "scanner-primary", "fingerprint": "94fff093a1dc4b45", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-6a95c5998a0ee2d6", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 src/components/admin/UserManagement.jsx:645"}, "properties": {"repobilityId": "13a0768303bafaea", "scanner": "scanner-primary", "fingerprint": "6a95c5998a0ee2d6", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-589b45017d2e6679", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/chat/SupportChat.jsx:272"}, "properties": {"repobilityId": "b1a8369765e2e4e4", "scanner": "scanner-primary", "fingerprint": "589b45017d2e6679", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-0ef3644fd9497778", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/referral/ReferralKaart.jsx:187"}, "properties": {"repobilityId": "58e2e12baea0d378", "scanner": "scanner-primary", "fingerprint": "0ef3644fd9497778", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-68e093e95ded60c4", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/referral/ReferralLeaderboard.jsx:73"}, "properties": {"repobilityId": "0c2f97da89479ac4", "scanner": "scanner-primary", "fingerprint": "68e093e95ded60c4", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-c60da8b8b9a34d5a", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/components/recurring/RecurringKaart.jsx:60"}, "properties": {"repobilityId": "c6ce9a91c5b53805", "scanner": "scanner-primary", "fingerprint": "c60da8b8b9a34d5a", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-906345cdc00642dd", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 src/pages/AdminErrors.jsx:222"}, "properties": {"repobilityId": "1ed605e5c0deb76b", "scanner": "scanner-primary", "fingerprint": "906345cdc00642dd", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-f717cad1b1eaa8ac", "level": "note", "message": {"text": "Insecure pattern 'document_write' in src/components/TweeFactorInstellingen.jsx:142"}, "properties": {"repobilityId": "165e09e25039cf4a", "scanner": "scanner-primary", "fingerprint": "f717cad1b1eaa8ac", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "document_write"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/components/TweeFactorInstellingen.jsx"}, "region": {"startLine": 142}}}]}, {"ruleId": "scanner-d425c0e8ecf4763a", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in src/services/api.test.js:60"}, "properties": {"repobilityId": "dcd673214c84824d", "scanner": "scanner-primary", "fingerprint": "d425c0e8ecf4763a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/services/api.test.js"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-bfdc9e47253d5e17", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "5365eda55705eb23", "scanner": "scanner-primary", "fingerprint": "bfdc9e47253d5e17", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/npm-publish-github-packages.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0af575a40a203c99", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "88d9c94e92ddbbeb", "scanner": "scanner-primary", "fingerprint": "0af575a40a203c99", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deno.yml"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "989a74409a402368", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "989a74409a402368", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-7f1e4527e6fecffa", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "fe64a2eb883cb9d3", "scanner": "scanner-primary", "fingerprint": "7f1e4527e6fecffa", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "989a74409a402368", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a5d4ff07f3e302e3", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 97}}}]}, {"ruleId": "scanner-e084c5072e7347a9", "level": "note", "message": {"text": "Very large file: src/components/PaymentFlow.jsx (1511 lines)"}, "properties": {"repobilityId": "7058863529850c43", "scanner": "scanner-primary", "fingerprint": "e084c5072e7347a9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-84c81fd3b08818cb", "level": "note", "message": {"text": "Very large file: src/i18n/tr.js (1244 lines)"}, "properties": {"repobilityId": "03c80435b227eb15", "scanner": "scanner-primary", "fingerprint": "84c81fd3b08818cb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c2709b281c615beb", "level": "note", "message": {"text": "Very large file: src/i18n/ru.js (1236 lines)"}, "properties": {"repobilityId": "7130a7315ce1bcd7", "scanner": "scanner-primary", "fingerprint": "c2709b281c615beb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2537c39ff048dfc9", "level": "note", "message": {"text": "Very large file: src/i18n/az.js (1236 lines)"}, "properties": {"repobilityId": "270409f98683493e", "scanner": "scanner-primary", "fingerprint": "2537c39ff048dfc9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-12234485a87d7851", "level": "note", "message": {"text": "Very large file: src/i18n/en.js (1244 lines)"}, "properties": {"repobilityId": "6f72380421454d4f", "scanner": "scanner-primary", "fingerprint": "12234485a87d7851", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-fc03bb820aa37fc4", "level": "note", "message": {"text": "Very large file: src/i18n/nl.js (1246 lines)"}, "properties": {"repobilityId": "8449d5c52535b06f", "scanner": "scanner-primary", "fingerprint": "fc03bb820aa37fc4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "5144eff64b16119d", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "9e90ae0dd043392f", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "d30d8fdccda0747f", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "69089f13a1453184", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "6619ce769fc7a282", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2c5f98b152cddb6d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/launch.json"}, "properties": {"repobilityId": "0de48c0f4ab303d8", "scanner": "scanner-primary", "fingerprint": "2c5f98b152cddb6d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/launch.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a7b7f0e6e4683c13", "level": "none", "message": {"text": "Commented-code block (5 lines) in vite.config.js:14"}, "properties": {"repobilityId": "80f01d9d12f825d3", "scanner": "scanner-primary", "fingerprint": "a7b7f0e6e4683c13", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-28fe5b5bf17fb076", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/sw.js:28"}, "properties": {"repobilityId": "f42cc067526d5077", "scanner": "scanner-primary", "fingerprint": "28fe5b5bf17fb076", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-851092455ae9d845", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/sw.js:22"}, "properties": {"repobilityId": "7b67c87b7a30b3db", "scanner": "scanner-primary", "fingerprint": "851092455ae9d845", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2959e35cc545fbd9", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/App.jsx:67"}, "properties": {"repobilityId": "b0015c593ff1bd3c", "scanner": "scanner-primary", "fingerprint": "2959e35cc545fbd9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-548534003a36bec7", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/components/KoersAlerts.jsx:73"}, "properties": {"repobilityId": "8e37b17a204b1a52", "scanner": "scanner-primary", "fingerprint": "548534003a36bec7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-53fd8e2429c93095", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/components/Dashboard.jsx:58"}, "properties": {"repobilityId": "07d885baf589534c", "scanner": "scanner-primary", "fingerprint": "53fd8e2429c93095", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-67b5cdb44af493cc", "level": "note", "message": {"text": "Legacy-named symbol `swiftbridge_payment_draft_v2` in src/components/PaymentFlow.jsx:1183"}, "properties": {"repobilityId": "1a2870b087378b11", "scanner": "scanner-primary", "fingerprint": "67b5cdb44af493cc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-1c5e5a560d98674b", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/components/PaymentFlow.jsx:276"}, "properties": {"repobilityId": "7bee5e47ddf9d9dd", "scanner": "scanner-primary", "fingerprint": "1c5e5a560d98674b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b4095f6ff18bcd38", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/components/PaymentFlow.jsx:208"}, "properties": {"repobilityId": "cc8d16b9f381ee6f", "scanner": "scanner-primary", "fingerprint": "b4095f6ff18bcd38", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d9b92285e0f8aaee", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/components/KYCFlow.jsx:462"}, "properties": {"repobilityId": "03c11af4284b08fc", "scanner": "scanner-primary", "fingerprint": "d9b92285e0f8aaee", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bc9f1d189bc2c6d0", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/components/KYCFlow.jsx:467"}, "properties": {"repobilityId": "8639e7b0cbc7038e", "scanner": "scanner-primary", "fingerprint": "bc9f1d189bc2c6d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c361df17ea903676", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/services/pushNotificatie.js:39"}, "properties": {"repobilityId": "6462bda897907259", "scanner": "scanner-primary", "fingerprint": "c361df17ea903676", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-7245ca00b1090302", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/services/api.js:8"}, "properties": {"repobilityId": "e4f0cc801dbc333e", "scanner": "scanner-primary", "fingerprint": "7245ca00b1090302", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b334d875f2339fa1", "level": "note", "message": {"text": "5 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "faa38682016f5d53", "scanner": "scanner-primary", "fingerprint": "b334d875f2339fa1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-6826d0441f46b080", "level": "warning", "message": {"text": "Frontend route `/wise-vs-swiftbridge` has no Link/navigate to it \u2014 src/App.jsx"}, "properties": {"repobilityId": "a05b1b3b4f230dde", "scanner": "scanner-primary", "fingerprint": "6826d0441f46b080", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-e1242cb437b8061c", "level": "warning", "message": {"text": "Frontend route `/r/:code` has no Link/navigate to it \u2014 src/App.jsx"}, "properties": {"repobilityId": "d875941aefc3db87", "scanner": "scanner-primary", "fingerprint": "e1242cb437b8061c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-f22fa3a1ecd47b0c", "level": "warning", "message": {"text": "Frontend route `/verifieer-email` has no Link/navigate to it \u2014 src/App.jsx"}, "properties": {"repobilityId": "5e8a3f64c1069d4d", "scanner": "scanner-primary", "fingerprint": "f22fa3a1ecd47b0c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-63414d07304cf70a", "level": "warning", "message": {"text": "Frontend route `/email-wijzigen-bevestigen` has no Link/navigate to it \u2014 src/App.jsx"}, "properties": {"repobilityId": "a4113304ff0a0a6b", "scanner": "scanner-primary", "fingerprint": "63414d07304cf70a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-9da2480bc8c9039e", "level": "warning", "message": {"text": "Frontend route `/email-wijzigen-intrekken` has no Link/navigate to it \u2014 src/App.jsx"}, "properties": {"repobilityId": "0639d39b0d83d9a5", "scanner": "scanner-primary", "fingerprint": "9da2480bc8c9039e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-a7b5faa28dafa080", "level": "warning", "message": {"text": "Frontend route `/admin` has no Link/navigate to it \u2014 src/App.jsx"}, "properties": {"repobilityId": "a88d2c6ef0af681a", "scanner": "scanner-primary", "fingerprint": "a7b5faa28dafa080", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-195cd6e79c554079", "level": "warning", "message": {"text": "Frontend route `/admin/compliance` has no Link/navigate to it \u2014 src/App.jsx"}, "properties": {"repobilityId": "bb7769e21d1d86ce", "scanner": "scanner-primary", "fingerprint": "195cd6e79c554079", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-ac149be3c139f833", "level": "warning", "message": {"text": "Frontend route `/tx/:token` has no Link/navigate to it \u2014 src/App.jsx"}, "properties": {"repobilityId": "5d2b444697b2ba1a", "scanner": "scanner-primary", "fingerprint": "ac149be3c139f833", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-ff5bd46a05191a4a", "level": "warning", "message": {"text": "Frontend route `/admin/overzicht` has no Link/navigate to it \u2014 src/App.jsx"}, "properties": {"repobilityId": "5c3c8c896bf8d3b1", "scanner": "scanner-primary", "fingerprint": "ff5bd46a05191a4a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-2873dc0fd6511172", "level": "warning", "message": {"text": "Frontend route `/admin/errors` has no Link/navigate to it \u2014 src/App.jsx"}, "properties": {"repobilityId": "72004f3894ec0e6c", "scanner": "scanner-primary", "fingerprint": "2873dc0fd6511172", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}]}]}