{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-4f67d5bcfc2e814a", "name": "Stray `console.log` in TS/JS \u2014 github-sync.js:430", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 github-sync.js:430"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-389474abc14cc96c", "name": "Insecure pattern 'direct_innerhtml_assignment' in ui.js:286", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui.js:286"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a064d95d14faa828", "name": "Insecure pattern 'direct_innerhtml_assignment' in navigator.js:97", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in navigator.js:97"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-856872d698aa40cb", "name": "Insecure pattern 'local_storage_auth_token' in github-sync.js:289", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in github-sync.js:289"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-74dc8be1f833a4eb", "name": "Insecure pattern 'direct_innerhtml_assignment' in notebook.js:208", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in notebook.js:208"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4acf8053b348a3b8", "name": "Insecure pattern 'direct_innerhtml_assignment' in nav-ship.js:241", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in nav-ship.js:241"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6dc56c998d925c74", "name": "Insecure pattern 'direct_innerhtml_assignment' in diagnostics.js:135", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in diagnostics.js:135"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2ee7cfada25da2a2", "name": "Insecure pattern 'direct_innerhtml_assignment' in navigator-classic.js:44", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in navigator-classic.js:44"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4151e0f1f0107aa4", "name": "Insecure pattern 'direct_innerhtml_assignment' in profiles.js:218", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in profiles.js:218"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2ce5bf0c10d7cb6a", "name": "Insecure pattern 'direct_innerhtml_assignment' in attempt-log.js:117", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in attempt-log.js:117"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-28dd60530c4d7bd9", "name": "Very large file: entities.js (1718 lines)", "shortDescription": {"text": "Very large file: entities.js (1718 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f10b05f4e8f38da7", "name": "Very large file: ui.js (1620 lines)", "shortDescription": {"text": "Very large file: ui.js (1620 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e4337b46d0907881", "name": "Very large file: test-runner.js (1290 lines)", "shortDescription": {"text": "Very large file: test-runner.js (1290 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-81016f748fbf59b0", "name": "Very large file: game.js (2026 lines)", "shortDescription": {"text": "Very large file: game.js (2026 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "1 test file(s) for 27 source file(s) (ratio 0.04). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a11c480373b0b023", "name": "Commented-code block (7 lines) in entities.js:763", "shortDescription": {"text": "Commented-code block (7 lines) in entities.js:763"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9eb743b23b41af05", "name": "Commented-code block (6 lines) in sw.js:1", "shortDescription": {"text": "Commented-code block (6 lines) in sw.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-474730e559e3f6a1", "name": "Commented-code block (6 lines) in diagnostics.js:3", "shortDescription": {"text": "Commented-code block (6 lines) in diagnostics.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ef2447f15e887d8d", "name": "Commented-code block (9 lines) in render-cache.js:9", "shortDescription": {"text": "Commented-code block (9 lines) in render-cache.js:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b99334ed33c8a0f7", "name": "Commented-code block (7 lines) in retry-variants.js:8", "shortDescription": {"text": "Commented-code block (7 lines) in retry-variants.js:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-64cf5f0e039e912d", "name": "Commented-code block (6 lines) in nav-core.js:7", "shortDescription": {"text": "Commented-code block (6 lines) in nav-core.js:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-53bf2e95174a4d2f", "name": "Commented-code block (7 lines) in game.js:645", "shortDescription": {"text": "Commented-code block (7 lines) in game.js:645"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cea2d83824b5b7d3", "name": "Commented-code block (6 lines) in attempt-log.js:11", "shortDescription": {"text": "Commented-code block (6 lines) in attempt-log.js:11"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/26422"}, "properties": {"repository": "hshakeri/star-hopper", "repoUrl": "https://github.com/hshakeri/star-hopper", "branch": "main"}, "results": [{"ruleId": "scanner-4f67d5bcfc2e814a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 github-sync.js:430"}, "properties": {"repobilityId": "85eaa1385e99b0fc", "scanner": "scanner-primary", "fingerprint": "4f67d5bcfc2e814a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-389474abc14cc96c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in ui.js:286"}, "properties": {"repobilityId": "38ebcc6b58a78e0b", "scanner": "scanner-primary", "fingerprint": "389474abc14cc96c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ui.js"}, "region": {"startLine": 286}}}]}, {"ruleId": "scanner-a064d95d14faa828", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in navigator.js:97"}, "properties": {"repobilityId": "ddf5d368888a3b4c", "scanner": "scanner-primary", "fingerprint": "a064d95d14faa828", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "navigator.js"}, "region": {"startLine": 97}}}]}, {"ruleId": "scanner-856872d698aa40cb", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in github-sync.js:289"}, "properties": {"repobilityId": "e39137bfbe305f1b", "scanner": "scanner-primary", "fingerprint": "856872d698aa40cb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "github-sync.js"}, "region": {"startLine": 289}}}]}, {"ruleId": "scanner-74dc8be1f833a4eb", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in notebook.js:208"}, "properties": {"repobilityId": "d79bd1121cc1a8db", "scanner": "scanner-primary", "fingerprint": "74dc8be1f833a4eb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "notebook.js"}, "region": {"startLine": 208}}}]}, {"ruleId": "scanner-4acf8053b348a3b8", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in nav-ship.js:241"}, "properties": {"repobilityId": "2fbfed22af04673e", "scanner": "scanner-primary", "fingerprint": "4acf8053b348a3b8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "nav-ship.js"}, "region": {"startLine": 241}}}]}, {"ruleId": "scanner-6dc56c998d925c74", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in diagnostics.js:135"}, "properties": {"repobilityId": "5c72b44ed0428042", "scanner": "scanner-primary", "fingerprint": "6dc56c998d925c74", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "diagnostics.js"}, "region": {"startLine": 135}}}]}, {"ruleId": "scanner-2ee7cfada25da2a2", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in navigator-classic.js:44"}, "properties": {"repobilityId": "818145954937c7b0", "scanner": "scanner-primary", "fingerprint": "2ee7cfada25da2a2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "navigator-classic.js"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-4151e0f1f0107aa4", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in profiles.js:218"}, "properties": {"repobilityId": "39a38c7cdba997ae", "scanner": "scanner-primary", "fingerprint": "4151e0f1f0107aa4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "profiles.js"}, "region": {"startLine": 218}}}]}, {"ruleId": "scanner-2ce5bf0c10d7cb6a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in attempt-log.js:117"}, "properties": {"repobilityId": "b3c3ac8aff7a17d8", "scanner": "scanner-primary", "fingerprint": "2ce5bf0c10d7cb6a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "attempt-log.js"}, "region": {"startLine": 117}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-28dd60530c4d7bd9", "level": "note", "message": {"text": "Very large file: entities.js (1718 lines)"}, "properties": {"repobilityId": "293cbbcd0a3dd11e", "scanner": "scanner-primary", "fingerprint": "28dd60530c4d7bd9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f10b05f4e8f38da7", "level": "note", "message": {"text": "Very large file: ui.js (1620 lines)"}, "properties": {"repobilityId": "f831f07feffcb9d1", "scanner": "scanner-primary", "fingerprint": "f10b05f4e8f38da7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e4337b46d0907881", "level": "note", "message": {"text": "Very large file: test-runner.js (1290 lines)"}, "properties": {"repobilityId": "a7ba6350dd8db150", "scanner": "scanner-primary", "fingerprint": "e4337b46d0907881", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-81016f748fbf59b0", "level": "note", "message": {"text": "Very large file: game.js (2026 lines)"}, "properties": {"repobilityId": "4de7f720f4e7ebfe", "scanner": "scanner-primary", "fingerprint": "81016f748fbf59b0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "1fe1c0e92b68e0d0", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "a8b02d9cecb4dc66", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-a11c480373b0b023", "level": "none", "message": {"text": "Commented-code block (7 lines) in entities.js:763"}, "properties": {"repobilityId": "d0ea8f5a526ed859", "scanner": "scanner-primary", "fingerprint": "a11c480373b0b023", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9eb743b23b41af05", "level": "none", "message": {"text": "Commented-code block (6 lines) in sw.js:1"}, "properties": {"repobilityId": "d051e88f2cdf12ce", "scanner": "scanner-primary", "fingerprint": "9eb743b23b41af05", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-474730e559e3f6a1", "level": "none", "message": {"text": "Commented-code block (6 lines) in diagnostics.js:3"}, "properties": {"repobilityId": "8b8596efb63f5fa0", "scanner": "scanner-primary", "fingerprint": "474730e559e3f6a1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ef2447f15e887d8d", "level": "none", "message": {"text": "Commented-code block (9 lines) in render-cache.js:9"}, "properties": {"repobilityId": "04575d2d35b41fdd", "scanner": "scanner-primary", "fingerprint": "ef2447f15e887d8d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b99334ed33c8a0f7", "level": "none", "message": {"text": "Commented-code block (7 lines) in retry-variants.js:8"}, "properties": {"repobilityId": "61a75897ef419b83", "scanner": "scanner-primary", "fingerprint": "b99334ed33c8a0f7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-64cf5f0e039e912d", "level": "none", "message": {"text": "Commented-code block (6 lines) in nav-core.js:7"}, "properties": {"repobilityId": "dd67ee7384b205fd", "scanner": "scanner-primary", "fingerprint": "64cf5f0e039e912d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-53bf2e95174a4d2f", "level": "none", "message": {"text": "Commented-code block (7 lines) in game.js:645"}, "properties": {"repobilityId": "83d1c7421c33b745", "scanner": "scanner-primary", "fingerprint": "53bf2e95174a4d2f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cea2d83824b5b7d3", "level": "none", "message": {"text": "Commented-code block (6 lines) in attempt-log.js:11"}, "properties": {"repobilityId": "04a4317516047497", "scanner": "scanner-primary", "fingerprint": "cea2d83824b5b7d3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}