{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-bbe172e7f3fdcfc1", "name": "Possibly dead Python function: step", "shortDescription": {"text": "Possibly dead Python function: step"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-293192278e648bc4", "name": "Possibly dead Python function: handle", "shortDescription": {"text": "Possibly dead Python function: handle"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7005368faefc423c", "name": "Insecure pattern 'new_function_used' in crazyflie-blockly/frontend/app.js:1144", "shortDescription": {"text": "Insecure pattern 'new_function_used' in crazyflie-blockly/frontend/app.js:1144"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6e69c7dd79918989", "name": "Insecure pattern 'direct_innerhtml_assignment' in crazyflie-blockly/frontend/app.js:76", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in crazyflie-blockly/frontend/app.js:76"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f6a94db7f7ab9582", "name": "Insecure pattern 'exec_used' in crazyflie-blockly/bridge/server.py:83", "shortDescription": {"text": "Insecure pattern 'exec_used' in crazyflie-blockly/bridge/server.py:83"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e4f658c0c00de0d4", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-448d8837178ae57a", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-26684501c3799d53", "name": "Very large file: crazyflie-blockly/frontend/simulator.js (1882 lines)", "shortDescription": {"text": "Very large file: crazyflie-blockly/frontend/simulator.js (1882 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f3935b72c8375e77", "name": "Very large file: crazyflie-blockly/frontend/app.js (1368 lines)", "shortDescription": {"text": "Very large file: crazyflie-blockly/frontend/app.js (1368 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b541049b8cb1125b", "name": "Commented-code block (7 lines) in crazyflie-blockly/frontend/simulator.js:111", "shortDescription": {"text": "Commented-code block (7 lines) in crazyflie-blockly/frontend/simulator.js:111"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-98ecccc31bb9901f", "name": "Commented-code block (9 lines) in crazyflie-blockly/frontend/blocks.js:86", "shortDescription": {"text": "Commented-code block (9 lines) in crazyflie-blockly/frontend/blocks.js:86"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b8969e30150e55f7", "name": "Commented-code block (5 lines) in crazyflie-blockly/frontend/levels.js:85", "shortDescription": {"text": "Commented-code block (5 lines) in crazyflie-blockly/frontend/levels.js:85"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c7d9c0e838e52434", "name": "Commented-code block (6 lines) in crazyflie-blockly/frontend/app.js:85", "shortDescription": {"text": "Commented-code block (6 lines) in crazyflie-blockly/frontend/app.js:85"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ee24f30e8e63b541", "name": "Commented-code block (7 lines) in crazyflie-blockly/frontend/generator.js:79", "shortDescription": {"text": "Commented-code block (7 lines) in crazyflie-blockly/frontend/generator.js:79"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-db689c9cbda22a2c", "name": "Commented-code block (7 lines) in crazyflie-blockly/frontend/viewfit.js:17", "shortDescription": {"text": "Commented-code block (7 lines) in crazyflie-blockly/frontend/viewfit.js:17"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c5c81a2d92d6750b", "name": "Commented-code block (5 lines) in crazyflie-blockly/frontend/sound.js:153", "shortDescription": {"text": "Commented-code block (5 lines) in crazyflie-blockly/frontend/sound.js:153"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0b3aed7faa616757", "name": "Commented-code block (8 lines) in crazyflie-blockly/frontend/blockflow.js:27", "shortDescription": {"text": "Commented-code block (8 lines) in crazyflie-blockly/frontend/blockflow.js:27"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f5e6c5814cfb997b", "name": "Commented-code block (10 lines) in crazyflie-blockly/frontend/test/viewfit.test.mjs:1", "shortDescription": {"text": "Commented-code block (10 lines) in crazyflie-blockly/frontend/test/viewfit.test.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9f0e0cca42aabf15", "name": "Commented-code block (5 lines) in crazyflie-blockly/frontend/test/linking-repeat-body.test.mjs:98", "shortDescription": {"text": "Commented-code block (5 lines) in crazyflie-blockly/frontend/test/linking-repeat-body.test.mjs:98"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4b9f6b8ef94ae7df", "name": "Commented-code block (6 lines) in crazyflie-blockly/frontend/test/linking-fresh-tower.test.mjs:3", "shortDescription": {"text": "Commented-code block (6 lines) in crazyflie-blockly/frontend/test/linking-fresh-tower.test.mjs:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b6cc9d7cb047704b", "name": "Commented-code block (5 lines) in crazyflie-blockly/frontend/test/linking-mixed-sequences.test.mjs:3", "shortDescription": {"text": "Commented-code block (5 lines) in crazyflie-blockly/frontend/test/linking-mixed-sequences.test.mjs:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ce15e561d56d29ea", "name": "Commented-code block (7 lines) in crazyflie-blockly/frontend/test/linking-startover-then-insert.test.mjs:1", "shortDescription": {"text": "Commented-code block (7 lines) in crazyflie-blockly/frontend/test/linking-startover-then-insert.test.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7295b3ca12bc820d", "name": "Commented-code block (8 lines) in crazyflie-blockly/frontend/test/linking-value-input.test.mjs:4", "shortDescription": {"text": "Commented-code block (8 lines) in crazyflie-blockly/frontend/test/linking-value-input.test.mjs:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-72a8681215680e3e", "name": "Commented-code block (7 lines) in crazyflie-blockly/frontend/test/linking-terminator-and-starter.test.mjs:1", "shortDescription": {"text": "Commented-code block (7 lines) in crazyflie-blockly/frontend/test/linking-terminator-and-starter.test.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0c69e9e7de04bb61", "name": "Commented-code block (6 lines) in crazyflie-blockly/frontend/test/harness.mjs:3", "shortDescription": {"text": "Commented-code block (6 lines) in crazyflie-blockly/frontend/test/harness.mjs:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a15fe37b52658087", "name": "Commented-code block (5 lines) in crazyflie-blockly/frontend/test/smoke.test.mjs:1", "shortDescription": {"text": "Commented-code block (5 lines) in crazyflie-blockly/frontend/test/smoke.test.mjs:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-56faaaf902a9f422", "name": "Commented-code block (7 lines) in crazyflie-blockly/frontend/test/linking-delete-then-insert.test.mjs:4", "shortDescription": {"text": "Commented-code block (7 lines) in crazyflie-blockly/frontend/test/linking-delete-then-insert.test.mjs:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-112171241bb21f4b", "name": "Commented-code block (5 lines) in crazyflie-blockly/frontend/test/linking-toolbar-moves.test.mjs:3", "shortDescription": {"text": "Commented-code block (5 lines) in crazyflie-blockly/frontend/test/linking-toolbar-moves.test.mjs:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ncrazyflie-blockly/bridge/drone.py:takeoff, crazyflie-blockly/bridge/drone.py:takeoff, crazyflie-blockly/bridge/drone.py:takeoff\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02525d39071dd2c7", "name": "Near-duplicate function bodies in 5 places", "shortDescription": {"text": "Near-duplicate function bodies in 5 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ncrazyflie-blockly/bridge/drone.py:step, crazyflie-blockly/bridge/drone.py:step, crazyflie-blockly/bridge/drone.py:step, crazyflie-blockly/bridge/drone.py:step\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/21181"}, "properties": {"repository": "Thibaud-gh/drone-lab", "repoUrl": "https://github.com/Thibaud-gh/drone-lab", "branch": "main"}, "results": [{"ruleId": "scanner-bbe172e7f3fdcfc1", "level": "note", "message": {"text": "Possibly dead Python function: step"}, "properties": {"repobilityId": "5628817d8e692d14", "scanner": "scanner-primary", "fingerprint": "bbe172e7f3fdcfc1", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "crazyflie-blockly/bridge/drone.py:201"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-293192278e648bc4", "level": "note", "message": {"text": "Possibly dead Python function: handle"}, "properties": {"repobilityId": "fc5b886fd2624c94", "scanner": "scanner-primary", "fingerprint": "293192278e648bc4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "crazyflie-blockly/bridge/server.py:87"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-7005368faefc423c", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in crazyflie-blockly/frontend/app.js:1144"}, "properties": {"repobilityId": "87404a558df45dba", "scanner": "scanner-primary", "fingerprint": "7005368faefc423c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "crazyflie-blockly/frontend/app.js"}, "region": {"startLine": 1144}}}]}, {"ruleId": "scanner-6e69c7dd79918989", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in crazyflie-blockly/frontend/app.js:76"}, "properties": {"repobilityId": "467873d6e86e8ba3", "scanner": "scanner-primary", "fingerprint": "6e69c7dd79918989", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "crazyflie-blockly/frontend/app.js"}, "region": {"startLine": 76}}}]}, {"ruleId": "scanner-f6a94db7f7ab9582", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in crazyflie-blockly/bridge/server.py:83"}, "properties": {"repobilityId": "82e8420af611307a", "scanner": "scanner-primary", "fingerprint": "f6a94db7f7ab9582", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "crazyflie-blockly/bridge/server.py"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0fb8c24a130cdd0a", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "38cf1c8b667d348e", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7b2f6f2d816930a2", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-e4f658c0c00de0d4", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "25e1fa3783e7cb32", "scanner": "scanner-primary", "fingerprint": "e4f658c0c00de0d4", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-448d8837178ae57a", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "13af6451e15656fc", "scanner": "scanner-primary", "fingerprint": "448d8837178ae57a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-26684501c3799d53", "level": "note", "message": {"text": "Very large file: crazyflie-blockly/frontend/simulator.js (1882 lines)"}, "properties": {"repobilityId": "1f17618a5da7607e", "scanner": "scanner-primary", "fingerprint": "26684501c3799d53", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f3935b72c8375e77", "level": "note", "message": {"text": "Very large file: crazyflie-blockly/frontend/app.js (1368 lines)"}, "properties": {"repobilityId": "bd1ec31bb1d3a416", "scanner": "scanner-primary", "fingerprint": "f3935b72c8375e77", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "ccfbeea380ebc949", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "5bedd9b0354ea60b", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "d21cb3d9017cda19", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "45034ffeda26bad0", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "038afb741823791a", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-b541049b8cb1125b", "level": "none", "message": {"text": "Commented-code block (7 lines) in crazyflie-blockly/frontend/simulator.js:111"}, "properties": {"repobilityId": "9ca73cec3523bd2d", "scanner": "scanner-primary", "fingerprint": "b541049b8cb1125b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-98ecccc31bb9901f", "level": "none", "message": {"text": "Commented-code block (9 lines) in crazyflie-blockly/frontend/blocks.js:86"}, "properties": {"repobilityId": "d1197d263274fc91", "scanner": "scanner-primary", "fingerprint": "98ecccc31bb9901f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b8969e30150e55f7", "level": "none", "message": {"text": "Commented-code block (5 lines) in crazyflie-blockly/frontend/levels.js:85"}, "properties": {"repobilityId": "03a76c9ae0dc6161", "scanner": "scanner-primary", "fingerprint": "b8969e30150e55f7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c7d9c0e838e52434", "level": "none", "message": {"text": "Commented-code block (6 lines) in crazyflie-blockly/frontend/app.js:85"}, "properties": {"repobilityId": "a9ff699acceb7315", "scanner": "scanner-primary", "fingerprint": "c7d9c0e838e52434", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ee24f30e8e63b541", "level": "none", "message": {"text": "Commented-code block (7 lines) in crazyflie-blockly/frontend/generator.js:79"}, "properties": {"repobilityId": "409f40ccdd77e1c7", "scanner": "scanner-primary", "fingerprint": "ee24f30e8e63b541", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-db689c9cbda22a2c", "level": "none", "message": {"text": "Commented-code block (7 lines) in crazyflie-blockly/frontend/viewfit.js:17"}, "properties": {"repobilityId": "e35e6538fb047d86", "scanner": "scanner-primary", "fingerprint": "db689c9cbda22a2c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c5c81a2d92d6750b", "level": "none", "message": {"text": "Commented-code block (5 lines) in crazyflie-blockly/frontend/sound.js:153"}, "properties": {"repobilityId": "e5321281e752dcc3", "scanner": "scanner-primary", "fingerprint": "c5c81a2d92d6750b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0b3aed7faa616757", "level": "none", "message": {"text": "Commented-code block (8 lines) in crazyflie-blockly/frontend/blockflow.js:27"}, "properties": {"repobilityId": "d3ddf0c119012c18", "scanner": "scanner-primary", "fingerprint": "0b3aed7faa616757", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f5e6c5814cfb997b", "level": "none", "message": {"text": "Commented-code block (10 lines) in crazyflie-blockly/frontend/test/viewfit.test.mjs:1"}, "properties": {"repobilityId": "cd807ed213d67f31", "scanner": "scanner-primary", "fingerprint": "f5e6c5814cfb997b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9f0e0cca42aabf15", "level": "none", "message": {"text": "Commented-code block (5 lines) in crazyflie-blockly/frontend/test/linking-repeat-body.test.mjs:98"}, "properties": {"repobilityId": "0c663a9d8de62b7a", "scanner": "scanner-primary", "fingerprint": "9f0e0cca42aabf15", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4b9f6b8ef94ae7df", "level": "none", "message": {"text": "Commented-code block (6 lines) in crazyflie-blockly/frontend/test/linking-fresh-tower.test.mjs:3"}, "properties": {"repobilityId": "1e99000fefec7f84", "scanner": "scanner-primary", "fingerprint": "4b9f6b8ef94ae7df", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b6cc9d7cb047704b", "level": "none", "message": {"text": "Commented-code block (5 lines) in crazyflie-blockly/frontend/test/linking-mixed-sequences.test.mjs:3"}, "properties": {"repobilityId": "a279d5e600a298b2", "scanner": "scanner-primary", "fingerprint": "b6cc9d7cb047704b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ce15e561d56d29ea", "level": "none", "message": {"text": "Commented-code block (7 lines) in crazyflie-blockly/frontend/test/linking-startover-then-insert.test.mjs:1"}, "properties": {"repobilityId": "3bb1eebfc30132c8", "scanner": "scanner-primary", "fingerprint": "ce15e561d56d29ea", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7295b3ca12bc820d", "level": "none", "message": {"text": "Commented-code block (8 lines) in crazyflie-blockly/frontend/test/linking-value-input.test.mjs:4"}, "properties": {"repobilityId": "7e383cf4c4adcc48", "scanner": "scanner-primary", "fingerprint": "7295b3ca12bc820d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-72a8681215680e3e", "level": "none", "message": {"text": "Commented-code block (7 lines) in crazyflie-blockly/frontend/test/linking-terminator-and-starter.test.mjs:1"}, "properties": {"repobilityId": "6ad33feef0417a61", "scanner": "scanner-primary", "fingerprint": "72a8681215680e3e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0c69e9e7de04bb61", "level": "none", "message": {"text": "Commented-code block (6 lines) in crazyflie-blockly/frontend/test/harness.mjs:3"}, "properties": {"repobilityId": "f42608b009af68b2", "scanner": "scanner-primary", "fingerprint": "0c69e9e7de04bb61", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a15fe37b52658087", "level": "none", "message": {"text": "Commented-code block (5 lines) in crazyflie-blockly/frontend/test/smoke.test.mjs:1"}, "properties": {"repobilityId": "6f7a0c1298bf945f", "scanner": "scanner-primary", "fingerprint": "a15fe37b52658087", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-56faaaf902a9f422", "level": "none", "message": {"text": "Commented-code block (7 lines) in crazyflie-blockly/frontend/test/linking-delete-then-insert.test.mjs:4"}, "properties": {"repobilityId": "3c6b289d6bceb750", "scanner": "scanner-primary", "fingerprint": "56faaaf902a9f422", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-112171241bb21f4b", "level": "none", "message": {"text": "Commented-code block (5 lines) in crazyflie-blockly/frontend/test/linking-toolbar-moves.test.mjs:3"}, "properties": {"repobilityId": "56c182cfa47a450d", "scanner": "scanner-primary", "fingerprint": "112171241bb21f4b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "6d8f568d12133705", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "5163ad4b2e81d35e", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "2cd14ce46f0a6701", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "23d0ce70a2c3ae3e", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "452762a6f3d0808f", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "e317a2e4a4952b13", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "27c48d4616a4500c", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-02525d39071dd2c7", "level": "note", "message": {"text": "Near-duplicate function bodies in 5 places"}, "properties": {"repobilityId": "9ea99ef4e9784675", "scanner": "scanner-primary", "fingerprint": "02525d39071dd2c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}