{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-e7ae95db84e346b5", "name": "Possibly dead Python function: require_auth", "shortDescription": {"text": "Possibly dead Python function: require_auth"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3230f1cbcf87e869", "name": "Possibly dead Python function: p_hf_daily_papers", "shortDescription": {"text": "Possibly dead Python function: p_hf_daily_papers"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e7b53898a7af95fb", "name": "Possibly dead Python function: p_hf_hub_list", "shortDescription": {"text": "Possibly dead Python function: p_hf_hub_list"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ace3cb1768ebf0e", "name": "Possibly dead Python function: p_hn_algolia", "shortDescription": {"text": "Possibly dead Python function: p_hn_algolia"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0df3877ad3d0be33", "name": "Possibly dead Python function: p_oss_insight", "shortDescription": {"text": "Possibly dead Python function: p_oss_insight"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49d204566260c8c1", "name": "Possibly dead Python function: p_github_org_repos", "shortDescription": {"text": "Possibly dead Python function: p_github_org_repos"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b4160a206bd36433", "name": "Possibly dead Python function: p_reddit_top", "shortDescription": {"text": "Possibly dead Python function: p_reddit_top"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f15a2911fbb29555", "name": "Possibly dead Python function: p_kaggle_datasets", "shortDescription": {"text": "Possibly dead Python function: p_kaggle_datasets"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dbb4f26b38e6c1f0", "name": "Possibly dead Python function: p_swebench", "shortDescription": {"text": "Possibly dead Python function: p_swebench"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-56a77ebf36ee0019", "name": "Possibly dead Python function: p_openrouter_models", "shortDescription": {"text": "Possibly dead Python function: p_openrouter_models"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b32d29fc14140dfb", "name": "Possibly dead Python function: p_mcp_registry", "shortDescription": {"text": "Possibly dead Python function: p_mcp_registry"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a43625a991e0bea5", "name": "Possibly dead Python function: p_github_releases_api", "shortDescription": {"text": "Possibly dead Python function: p_github_releases_api"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5fce5e70a163785a", "name": "Possibly dead Python function: p_evalplus", "shortDescription": {"text": "Possibly dead Python function: p_evalplus"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9e0a6c08a2aa4880", "name": "Possibly dead Python function: p_generic", "shortDescription": {"text": "Possibly dead Python function: p_generic"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d50b02d4a88c2e8", "name": "Privileged port 1 in use", "shortDescription": {"text": "Privileged port 1 in use"}, "fullDescription": {"text": "Port 1 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f90238fadab8ebdf", "name": "Privileged port 9 in use", "shortDescription": {"text": "Privileged port 9 in use"}, "fullDescription": {"text": "Port 9 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0e1e09e8ffd50c83", "name": "Insecure pattern 'direct_innerhtml_assignment' in site/app.js:20", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in site/app.js:20"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-032790048ae8ecb1", "name": "Insecure pattern 'local_storage_auth_token' in web/app/console/page.jsx:59", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in web/app/console/page.jsx:59"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-083fef819c8b1597", "name": "Insecure pattern 'cors_wildcard' in services/app.py:34", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in services/app.py:34"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a91a9c73589db7fd", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c1e62c8a8becdce0", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/deploy-pages@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11fe6710547243fb", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 33 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 80 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e39b407b83b0f4f8", "name": "Agent authority lacks a verifier contract: asta-news/skills/daily-digest/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: asta-news/skills/daily-digest/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-78360cdb178a96ee", "name": "Agent authority lacks a verifier contract: asta-news/skills/manage-sources/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: asta-news/skills/manage-sources/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f00fb6ed6a8d9d0d", "name": "Agent authority lacks a verifier contract: asta-news/skills/setup/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: asta-news/skills/setup/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-304f3a5d654e52b0", "name": "`fetch()` without try/.catch or AbortSignal \u2014 site/app.js:13", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 site/app.js:13"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b3fe2e8d0c8e3f25", "name": "Network/subprocess call without timeout or try/except \u2014 services/app.py:123", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 services/app.py:123"}, "fullDescription": {"text": "`subprocess.Popen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nservices/app.py:editions, services/app.py:edition\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4756b4c4da7d2088", "name": "Unused endpoint: GET /api/health", "shortDescription": {"text": "Unused endpoint: GET /api/health"}, "fullDescription": {"text": "`services/app.py` declares `GET /api/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f2dafe0b99c4f355", "name": "Unused endpoint: GET /api/editions", "shortDescription": {"text": "Unused endpoint: GET /api/editions"}, "fullDescription": {"text": "`services/app.py` declares `GET /api/editions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-770d0c4edb8f9fee", "name": "Unused endpoint: GET /api/editions/{date}", "shortDescription": {"text": "Unused endpoint: GET /api/editions/{date}"}, "fullDescription": {"text": "`services/app.py` declares `GET /api/editions/{date}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2205760646975fb8", "name": "Unused endpoint: GET /api/search", "shortDescription": {"text": "Unused endpoint: GET /api/search"}, "fullDescription": {"text": "`services/app.py` declares `GET /api/search` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7aa4b2518cbbbfa2", "name": "Unused endpoint: GET /api/config", "shortDescription": {"text": "Unused endpoint: GET /api/config"}, "fullDescription": {"text": "`services/app.py` declares `GET /api/config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c5dc856cfed9b283", "name": "Unused endpoint: PUT /api/config/{name}", "shortDescription": {"text": "Unused endpoint: PUT /api/config/{name}"}, "fullDescription": {"text": "`services/app.py` declares `PUT /api/config/{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-83b35a5a43f6f471", "name": "Unused endpoint: GET /api/sources", "shortDescription": {"text": "Unused endpoint: GET /api/sources"}, "fullDescription": {"text": "`services/app.py` declares `GET /api/sources` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e45b8f3479c967e7", "name": "Unused endpoint: POST /api/run/fetch", "shortDescription": {"text": "Unused endpoint: POST /api/run/fetch"}, "fullDescription": {"text": "`services/app.py` declares `POST /api/run/fetch` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-90e88e24f9c69554", "name": "Unused endpoint: GET /api/schedule", "shortDescription": {"text": "Unused endpoint: GET /api/schedule"}, "fullDescription": {"text": "`services/app.py` declares `GET /api/schedule` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0ab4bd308ef4876b", "name": "Unused endpoint: POST /api/publish/wechat", "shortDescription": {"text": "Unused endpoint: POST /api/publish/wechat"}, "fullDescription": {"text": "`services/app.py` declares `POST /api/publish/wechat` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23254"}, "properties": {"repository": "ylxmf2005/AstaNews", "repoUrl": "https://github.com/ylxmf2005/AstaNews", "branch": "main"}, "results": [{"ruleId": "scanner-e7ae95db84e346b5", "level": "note", "message": {"text": "Possibly dead Python function: require_auth"}, "properties": {"repobilityId": "d7855475dea79341", "scanner": "scanner-primary", "fingerprint": "e7ae95db84e346b5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/app.py:38"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3230f1cbcf87e869", "level": "note", "message": {"text": "Possibly dead Python function: p_hf_daily_papers"}, "properties": {"repobilityId": "2b8e2a563cc0a937", "scanner": "scanner-primary", "fingerprint": "3230f1cbcf87e869", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "asta-news/scripts/fetch_sources.py:216"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e7b53898a7af95fb", "level": "note", "message": {"text": "Possibly dead Python function: p_hf_hub_list"}, "properties": {"repobilityId": "c7e759e5f7df31a5", "scanner": "scanner-primary", "fingerprint": "e7b53898a7af95fb", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "asta-news/scripts/fetch_sources.py:229"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ace3cb1768ebf0e", "level": "note", "message": {"text": "Possibly dead Python function: p_hn_algolia"}, "properties": {"repobilityId": "5d727f20cdab7ebb", "scanner": "scanner-primary", "fingerprint": "3ace3cb1768ebf0e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "asta-news/scripts/fetch_sources.py:241"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0df3877ad3d0be33", "level": "note", "message": {"text": "Possibly dead Python function: p_oss_insight"}, "properties": {"repobilityId": "30defcaa544fe47f", "scanner": "scanner-primary", "fingerprint": "0df3877ad3d0be33", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "asta-news/scripts/fetch_sources.py:251"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-49d204566260c8c1", "level": "note", "message": {"text": "Possibly dead Python function: p_github_org_repos"}, "properties": {"repobilityId": "1d338069c208891f", "scanner": "scanner-primary", "fingerprint": "49d204566260c8c1", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "asta-news/scripts/fetch_sources.py:262"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b4160a206bd36433", "level": "note", "message": {"text": "Possibly dead Python function: p_reddit_top"}, "properties": {"repobilityId": "444cc3d0fd2a2ab3", "scanner": "scanner-primary", "fingerprint": "b4160a206bd36433", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "asta-news/scripts/fetch_sources.py:272"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f15a2911fbb29555", "level": "note", "message": {"text": "Possibly dead Python function: p_kaggle_datasets"}, "properties": {"repobilityId": "d7bbffc142a1eb89", "scanner": "scanner-primary", "fingerprint": "f15a2911fbb29555", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "asta-news/scripts/fetch_sources.py:282"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dbb4f26b38e6c1f0", "level": "note", "message": {"text": "Possibly dead Python function: p_swebench"}, "properties": {"repobilityId": "0af784ef30251334", "scanner": "scanner-primary", "fingerprint": "dbb4f26b38e6c1f0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "asta-news/scripts/fetch_sources.py:291"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-56a77ebf36ee0019", "level": "note", "message": {"text": "Possibly dead Python function: p_openrouter_models"}, "properties": {"repobilityId": "26f37075798458fb", "scanner": "scanner-primary", "fingerprint": "56a77ebf36ee0019", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "asta-news/scripts/fetch_sources.py:336"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b32d29fc14140dfb", "level": "note", "message": {"text": "Possibly dead Python function: p_mcp_registry"}, "properties": {"repobilityId": "93d0bf47cc5a6cdc", "scanner": "scanner-primary", "fingerprint": "b32d29fc14140dfb", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "asta-news/scripts/fetch_sources.py:344"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a43625a991e0bea5", "level": "note", "message": {"text": "Possibly dead Python function: p_github_releases_api"}, "properties": {"repobilityId": "8fb8b5ec50891c23", "scanner": "scanner-primary", "fingerprint": "a43625a991e0bea5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "asta-news/scripts/fetch_sources.py:359"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5fce5e70a163785a", "level": "note", "message": {"text": "Possibly dead Python function: p_evalplus"}, "properties": {"repobilityId": "422df5f7c0f1c832", "scanner": "scanner-primary", "fingerprint": "5fce5e70a163785a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "asta-news/scripts/fetch_sources.py:371"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9e0a6c08a2aa4880", "level": "note", "message": {"text": "Possibly dead Python function: p_generic"}, "properties": {"repobilityId": "92bdc4d6cd9c84aa", "scanner": "scanner-primary", "fingerprint": "9e0a6c08a2aa4880", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "asta-news/scripts/fetch_sources.py:388"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4d50b02d4a88c2e8", "level": "warning", "message": {"text": "Privileged port 1 in use"}, "properties": {"repobilityId": "ddf3fa6c29abb8d2", "scanner": "scanner-primary", "fingerprint": "4d50b02d4a88c2e8", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily-digest.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f90238fadab8ebdf", "level": "warning", "message": {"text": "Privileged port 9 in use"}, "properties": {"repobilityId": "31590a6ba3409390", "scanner": "scanner-primary", "fingerprint": "f90238fadab8ebdf", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily-digest.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0e1e09e8ffd50c83", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in site/app.js:20"}, "properties": {"repobilityId": "2dbada2e02ea99b7", "scanner": "scanner-primary", "fingerprint": "0e1e09e8ffd50c83", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "site/app.js"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-032790048ae8ecb1", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in web/app/console/page.jsx:59"}, "properties": {"repobilityId": "34910b044d3572af", "scanner": "scanner-primary", "fingerprint": "032790048ae8ecb1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/app/console/page.jsx"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-083fef819c8b1597", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in services/app.py:34"}, "properties": {"repobilityId": "1f38b324a17bb6b4", "scanner": "scanner-primary", "fingerprint": "083fef819c8b1597", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "services/app.py"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-a91a9c73589db7fd", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "1e7d0b05ca103079", "scanner": "scanner-primary", "fingerprint": "a91a9c73589db7fd", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/daily-digest.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c1e62c8a8becdce0", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4a5232ca5f9d3d6d", "scanner": "scanner-primary", "fingerprint": "c1e62c8a8becdce0", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-pages.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-11fe6710547243fb", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "c88f07fd35b9711f", "scanner": "scanner-primary", "fingerprint": "11fe6710547243fb", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-pages.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "6cc6ce78dbbf11d9", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "c6bb4befb4bba6ad", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "6be27d65e580f66a", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "cd47cd6cf1eb3c8c", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "c9fde278a139170e", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "5586a2f1726cef22", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "939277bad924ca75", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-e39b407b83b0f4f8", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: asta-news/skills/daily-digest/SKILL.md"}, "properties": {"repobilityId": "15d7b56c87410007", "scanner": "scanner-primary", "fingerprint": "e39b407b83b0f4f8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "asta-news/skills/daily-digest/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-78360cdb178a96ee", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: asta-news/skills/manage-sources/SKILL.md"}, "properties": {"repobilityId": "4c2753448941a35e", "scanner": "scanner-primary", "fingerprint": "78360cdb178a96ee", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "asta-news/skills/manage-sources/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f00fb6ed6a8d9d0d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: asta-news/skills/setup/SKILL.md"}, "properties": {"repobilityId": "8f6dc2f7f9467260", "scanner": "scanner-primary", "fingerprint": "f00fb6ed6a8d9d0d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "asta-news/skills/setup/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-304f3a5d654e52b0", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 site/app.js:13"}, "properties": {"repobilityId": "68f0b2afdcb65767", "scanner": "scanner-primary", "fingerprint": "304f3a5d654e52b0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b3fe2e8d0c8e3f25", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 services/app.py:123"}, "properties": {"repobilityId": "26dec51c5574f050", "scanner": "scanner-primary", "fingerprint": "b3fe2e8d0c8e3f25", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "6855f207de5f5cfd", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "521ad445c513914d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "af531af1c37c5f6c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-4756b4c4da7d2088", "level": "note", "message": {"text": "Unused endpoint: GET /api/health"}, "properties": {"repobilityId": "9c277e675b898279", "scanner": "scanner-primary", "fingerprint": "4756b4c4da7d2088", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f2dafe0b99c4f355", "level": "note", "message": {"text": "Unused endpoint: GET /api/editions"}, "properties": {"repobilityId": "35b8b7ada216b722", "scanner": "scanner-primary", "fingerprint": "f2dafe0b99c4f355", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-770d0c4edb8f9fee", "level": "note", "message": {"text": "Unused endpoint: GET /api/editions/{date}"}, "properties": {"repobilityId": "c4c88787514e8bbd", "scanner": "scanner-primary", "fingerprint": "770d0c4edb8f9fee", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2205760646975fb8", "level": "note", "message": {"text": "Unused endpoint: GET /api/search"}, "properties": {"repobilityId": "86a3af738c6eb898", "scanner": "scanner-primary", "fingerprint": "2205760646975fb8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7aa4b2518cbbbfa2", "level": "note", "message": {"text": "Unused endpoint: GET /api/config"}, "properties": {"repobilityId": "5f7b025edd1395ab", "scanner": "scanner-primary", "fingerprint": "7aa4b2518cbbbfa2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c5dc856cfed9b283", "level": "note", "message": {"text": "Unused endpoint: PUT /api/config/{name}"}, "properties": {"repobilityId": "a43f7e00d2d7dafc", "scanner": "scanner-primary", "fingerprint": "c5dc856cfed9b283", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-83b35a5a43f6f471", "level": "note", "message": {"text": "Unused endpoint: GET /api/sources"}, "properties": {"repobilityId": "6881939f3752bd59", "scanner": "scanner-primary", "fingerprint": "83b35a5a43f6f471", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e45b8f3479c967e7", "level": "note", "message": {"text": "Unused endpoint: POST /api/run/fetch"}, "properties": {"repobilityId": "19bf63e64bd936ed", "scanner": "scanner-primary", "fingerprint": "e45b8f3479c967e7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-90e88e24f9c69554", "level": "note", "message": {"text": "Unused endpoint: GET /api/schedule"}, "properties": {"repobilityId": "210b79e2d27b319b", "scanner": "scanner-primary", "fingerprint": "90e88e24f9c69554", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0ab4bd308ef4876b", "level": "note", "message": {"text": "Unused endpoint: POST /api/publish/wechat"}, "properties": {"repobilityId": "b023fd5b069932b0", "scanner": "scanner-primary", "fingerprint": "0ab4bd308ef4876b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}