{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "JRN002", "name": "Browser storage is used for session token material", "shortDescription": {"text": "Browser storage is used for session token material"}, "fullDescription": {"text": "localStorage and sessionStorage are readable by injected JavaScript. For sensitive sessions, this turns XSS into account compromise."}, "properties": {"scanner": "repobility-journey-contract", "category": "auth", "severity": "medium", "confidence": 0.82, "cwe": "", "owasp": ""}}, {"id": "GHSA-4w7w-66w2-5vf9", "name": "vite: GHSA-4w7w-66w2-5vf9", "shortDescription": {"text": "vite: GHSA-4w7w-66w2-5vf9"}, "fullDescription": {"text": "Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-67mh-4wv8-2f99", "name": "esbuild: GHSA-67mh-4wv8-2f99", "shortDescription": {"text": "esbuild: GHSA-67mh-4wv8-2f99"}, "fullDescription": {"text": "esbuild enables any website to send any requests to the development server and read the response"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-2c2j-9gv5-cj73", "name": "starlette: GHSA-2c2j-9gv5-cj73", "shortDescription": {"text": "starlette: GHSA-2c2j-9gv5-cj73"}, "fullDescription": {"text": "Starlette has possible denial-of-service vector when parsing large files in multipart forms"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-65pc-fj4g-8rjx", "name": "idna: GHSA-65pc-fj4g-8rjx", "shortDescription": {"text": "idna: GHSA-65pc-fj4g-8rjx"}, "fullDescription": {"text": "Internationalized Domain Names in Applications (IDNA): Specially crafted inputs to idna.encode() can bypass CVE-2024-3651 fix"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-9f5j-8jwj-x28g", "name": "ecdsa: GHSA-9f5j-8jwj-x28g", "shortDescription": {"text": "ecdsa: GHSA-9f5j-8jwj-x28g"}, "fullDescription": {"text": "python-ecdsa: Denial of Service via improper DER length validation in crafted private keys"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-mj87-hwqh-73pj", "name": "python-multipart: GHSA-mj87-hwqh-73pj", "shortDescription": {"text": "python-multipart: GHSA-mj87-hwqh-73pj"}, "fullDescription": {"text": "python-multipart affected by Denial of Service via large multipart preamble or epilogue data"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-cjwg-qfpm-7377", "name": "python-jose: GHSA-cjwg-qfpm-7377", "shortDescription": {"text": "python-jose: GHSA-cjwg-qfpm-7377"}, "fullDescription": {"text": "python-jose denial of service via compressed JWE content"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "medium", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "DKR003", "name": "Compose service `dozzle` image uses the latest tag", "shortDescription": {"text": "Compose service `dozzle` image uses the latest tag"}, "fullDescription": {"text": "The latest tag is mutable and can change without a code review, producing different images from the same source."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "medium", "confidence": 0.94, "cwe": "", "owasp": ""}}, {"id": "DKC013", "name": "Database service has no persistent data volume", "shortDescription": {"text": "Database service has no persistent data volume"}, "fullDescription": {"text": "Database containers store data in the writable container layer unless a volume or bind mount is attached to the image's data directory. Recreating the container can lose state."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "medium", "confidence": 0.74, "cwe": "", "owasp": ""}}, {"id": "DKR001", "name": "Docker final stage has no non-root USER", "shortDescription": {"text": "Docker final stage has no non-root USER"}, "fullDescription": {"text": "Docker images run as root unless the image or Dockerfile switches to a non-root user."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "medium", "confidence": 0.82, "cwe": "", "owasp": ""}}, {"id": "DKR007", "name": "Docker build context has no .dockerignore", "shortDescription": {"text": "Docker build context has no .dockerignore"}, "fullDescription": {"text": "Without .dockerignore, build context can include source history, local env files, dependencies, and generated artifacts."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "medium", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "SEC015", "name": "[SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is predictable.", "shortDescription": {"text": "[SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is predictable."}, "fullDescription": {"text": "Use secrets module (Python) or crypto.getRandomValues() (JS) for security-sensitive randomness."}, "properties": {"scanner": "repobility-threat-engine", "category": "crypto", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "COMP001", "name": "[COMP001] High cognitive complexity: Function `calendar_feed` has cognitive complexity 16 (SonarSource scale). Cognitive", "shortDescription": {"text": "[COMP001] High cognitive complexity: Function `calendar_feed` has cognitive complexity 16 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion"}, "fullDescription": {"text": "Extract nested branches into named helper functions; flatten early-return / guard clauses; replace long if/elif chains with dispatch dicts or polymorphism. SonarQube's threshold for 'should refactor' is 15 \u2014 yours is 16."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "medium", "confidence": 0.95, "cwe": "", "owasp": ""}}, {"id": "DEPCUR-PY", "name": "Python package `redis` is 3 major version(s) behind (5.2.1 -> 8.0.0)", "shortDescription": {"text": "Python package `redis` is 3 major version(s) behind (5.2.1 -> 8.0.0)"}, "fullDescription": {"text": "`redis==5.2.1` is 3 major version(s) behind the latest stable release on PyPI (8.0.0). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises."}, "properties": {"scanner": "repobility-dependency-currency", "category": "dependency", "severity": "medium", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "DEPCUR-NPM", "name": "npm package `@vitejs/plugin-react` is 2 major version(s) behind (4.7.0 -> 6.0.2)", "shortDescription": {"text": "npm package `@vitejs/plugin-react` is 2 major version(s) behind (4.7.0 -> 6.0.2)"}, "fullDescription": {"text": "`@vitejs/plugin-react` is pinned/resolved at 4.7.0 but the latest stable release on the npm registry is 6.0.2 (2 major version(s) behind). Outdated dependencies accumulate unpatched bugs and make future security upgrades harder. This is the version-currency signal Dependabot version-update PRs raise."}, "properties": {"scanner": "repobility-dependency-currency", "category": "dependency", "severity": "medium", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "MINED111", "name": "Bare except continues silently", "shortDescription": {"text": "Bare except continues silently"}, "fullDescription": {"text": "Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose."}, "properties": {"scanner": "repobility-ast-engine", "category": "quality", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "CORE_NO_CI", "name": "No CI/CD configuration found", "shortDescription": {"text": "No CI/CD configuration found"}, "fullDescription": {"text": "Add a CI/CD pipeline: create .github/workflows/ci.yml for GitHub Actions with steps to lint, test, and build on every push and pull request."}, "properties": {"scanner": "repobility-core", "category": "practices", "severity": "medium", "confidence": null, "cwe": "", "owasp": ""}}, {"id": "DKC010", "name": "Compose service lacks no-new-privileges hardening", "shortDescription": {"text": "Compose service lacks no-new-privileges hardening"}, "fullDescription": {"text": "no-new-privileges prevents processes from gaining additional privileges through setuid binaries or file capabilities."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "low", "confidence": 0.62, "cwe": "", "owasp": ""}}, {"id": "DKC006", "name": "Compose service does not declare a runtime user", "shortDescription": {"text": "Compose service does not declare a runtime user"}, "fullDescription": {"text": "If the image does not define USER internally, this service may run as root."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "low", "confidence": 0.56, "cwe": "", "owasp": ""}}, {"id": "DKC016", "name": "App service does not wait for database health", "shortDescription": {"text": "App service does not wait for database health"}, "fullDescription": {"text": "depends_on controls startup order, but without condition: service_healthy an app can start while the database is still initializing and fail intermittently."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "low", "confidence": 0.68, "cwe": "", "owasp": ""}}, {"id": "DKC015", "name": "Database service has no healthcheck", "shortDescription": {"text": "Database service has no healthcheck"}, "fullDescription": {"text": "Compose starts dependent containers in dependency order, but it does not wait for a database to be ready unless a healthcheck is defined and dependents use service_healthy."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "low", "confidence": 0.72, "cwe": "", "owasp": ""}}, {"id": "AIC003", "name": "Duplicated implementation block across source files", "shortDescription": {"text": "Duplicated implementation block across source files"}, "fullDescription": {"text": "Duplicated blocks are a common artifact when generated code is pasted or recreated instead of reused. They increase maintenance cost because every future bug fix must be found in multiple locations."}, "properties": {"scanner": "repobility-ai-code-hygiene", "category": "quality", "severity": "low", "confidence": 0.86, "cwe": "", "owasp": ""}}, {"id": "MINED056", "name": "[MINED056] React Key As Index: key={index} in map() \u2014 re-renders the wrong elements on re-order.", "shortDescription": {"text": "[MINED056] React Key As Index: key={index} in map() \u2014 re-renders the wrong elements on re-order."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-682 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED052", "name": "[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety.", "shortDescription": {"text": "[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-704 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED043", "name": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.", "shortDescription": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-319 / A02:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC135", "name": "[SEC135] Auth/permission check missing on AI-generated endpoint (and 5 more): Same pattern found in 5 additional files. ", "shortDescription": {"text": "[SEC135] Auth/permission check missing on AI-generated endpoint (and 5 more): Same pattern found in 5 additional files. Review if needed."}, "fullDescription": {"text": "Add the project's auth decorator/middleware: `@login_required` (Django/Flask), `@permission_classes([IsAuthenticated])` (DRF), `Depends(get_current_user)` (FastAPI), `requireAuth` middleware (Express). For genuinely public endpoints, add a `# public-endpoint` marker comment so future scans skip them."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED047", "name": "[MINED047] Emoji In Source: Emoji \u2705 \u274c \ud83d\ude80 in code/comments \u2014 common AI output unless explicitly requested.", "shortDescription": {"text": "[MINED047] Emoji In Source: Emoji \u2705 \u274c \ud83d\ude80 in code/comments \u2014 common AI output unless explicitly requested."}, "fullDescription": {"text": "Review and fix per the pattern semantics."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED072", "name": "[MINED072] Python Pass Only Class: class Foo: pass \u2014 stub waiting to be filled in.", "shortDescription": {"text": "[MINED072] Python Pass Only Class: class Foo: pass \u2014 stub waiting to be filled in."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-1188 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED050", "name": "[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO ", "shortDescription": {"text": "[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-1188 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED065", "name": "[MINED065] Cors Wildcard: Access-Control-Allow-Origin: * exposes the API to any browser origin. Acceptable for public re", "shortDescription": {"text": "[MINED065] Cors Wildcard: Access-Control-Allow-Origin: * exposes the API to any browser origin. Acceptable for public read-only endpoints; dangerous when paired with credentials or write endpoints."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-942,CWE-346 / A05:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC128", "name": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake) (and 3 more): Same pattern found in 3 addit", "shortDescription": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake) (and 3 more): Same pattern found in 3 additional files. Review if needed."}, "fullDescription": {"text": "Add `await` before each async call, or chain with `.then`. If you intentionally want fire-and-forget, prefix with `void` (TS) or assign to `_` (Python with `asyncio.create_task`) to make the intent explicit and survive lint."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "JRN009", "name": "Secret-like setting is echoed into a password input value", "shortDescription": {"text": "Secret-like setting is echoed into a password input value"}, "fullDescription": {"text": "Settings screens sometimes render API keys, tokens, or passwords back into HTML/JSX password fields. That still exposes the secret to page source, browser extensions, screenshots, and DOM scraping."}, "properties": {"scanner": "repobility-journey-contract", "category": "auth", "severity": "high", "confidence": 0.83, "cwe": "", "owasp": ""}}, {"id": "GHSA-gv7w-rqvm-qjhr", "name": "esbuild: GHSA-gv7w-rqvm-qjhr", "shortDescription": {"text": "esbuild: GHSA-gv7w-rqvm-qjhr"}, "fullDescription": {"text": "esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-7f5h-v6xp-fcq8", "name": "starlette: GHSA-7f5h-v6xp-fcq8", "shortDescription": {"text": "starlette: GHSA-7f5h-v6xp-fcq8"}, "fullDescription": {"text": "Starlette vulnerable to O(n^2) DoS via Range header merging in ``starlette.responses.FileResponse``"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "PYSEC-2026-161", "name": "starlette: PYSEC-2026-161", "shortDescription": {"text": "starlette: PYSEC-2026-161"}, "fullDescription": {"text": "BadHost: Missing Host header validation poisons request.url.path, bypassing path-based security checks"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-wj6h-64fc-37mp", "name": "ecdsa: GHSA-wj6h-64fc-37mp", "shortDescription": {"text": "ecdsa: GHSA-wj6h-64fc-37mp"}, "fullDescription": {"text": "Minerva timing attack on P-256 in python-ecdsa"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "PYSEC-2019-177", "name": "ecdsa: PYSEC-2019-177", "shortDescription": {"text": "ecdsa: PYSEC-2019-177"}, "fullDescription": {"text": "An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions (or no exceptions at all), which could lead to a denial of service."}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-wp53-j4wj-2cfg", "name": "python-multipart: GHSA-wp53-j4wj-2cfg", "shortDescription": {"text": "python-multipart: GHSA-wp53-j4wj-2cfg"}, "fullDescription": {"text": "Python-Multipart has Arbitrary File Write via Non-Default Configuration"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-pp6c-gr5w-3c5g", "name": "python-multipart: GHSA-pp6c-gr5w-3c5g", "shortDescription": {"text": "python-multipart: GHSA-pp6c-gr5w-3c5g"}, "fullDescription": {"text": "python-multipart has Denial of Service via unbounded multipart part headers"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "PYSEC-2025-185", "name": "python-jose: PYSEC-2025-185", "shortDescription": {"text": "python-jose: PYSEC-2025-185"}, "fullDescription": {"text": "In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an exceptionally high compression ratio. When this token is processed by the server, it results in significant memory allocation and processing time during decompression."}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "PYSEC-2024-233", "name": "python-jose: PYSEC-2024-233", "shortDescription": {"text": "python-jose: PYSEC-2024-233"}, "fullDescription": {"text": "python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web Encryption (JWE) token with a high compression ratio, aka a \"JWT bomb.\" This is similar to CVE-2024-21319."}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "PYSEC-2024-232", "name": "python-jose: PYSEC-2024-232", "shortDescription": {"text": "python-jose: PYSEC-2024-232"}, "fullDescription": {"text": "python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217."}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "high", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "DKR014", "name": "Dockerfile copies the entire context without .dockerignore", "shortDescription": {"text": "Dockerfile copies the entire context without .dockerignore"}, "fullDescription": {"text": "COPY . or ADD . sends the full build context to Docker. Without .dockerignore this can include secrets, git history, and local artifacts."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "high", "confidence": 0.92, "cwe": "", "owasp": ""}}, {"id": "MINED118", "name": "Dockerfile FROM `python:3.12-slim` not pinned by digest", "shortDescription": {"text": "Dockerfile FROM `python:3.12-slim` not pinned by digest"}, "fullDescription": {"text": "`FROM python:3.12-slim` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "high", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "CORE_NO_TESTS", "name": "No test files found", "shortDescription": {"text": "No test files found"}, "fullDescription": {"text": "Add a test directory (tests/ or __tests__/) with unit tests for core functionality. Use pytest (Python), Jest (JS/TS), or go test (Go). Start with tests for critical business logic and security-sensitive functions."}, "properties": {"scanner": "repobility-core", "category": "testing", "severity": "high", "confidence": null, "cwe": "", "owasp": ""}}, {"id": "GHSA-vqfr-h8mv-ghfj", "name": "h11: GHSA-vqfr-h8mv-ghfj", "shortDescription": {"text": "h11: GHSA-vqfr-h8mv-ghfj"}, "fullDescription": {"text": "h11 accepts some malformed Chunked-Encoding bodies"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "critical", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-8qxj-f9rh-9fg2", "name": "ecdsa: GHSA-8qxj-f9rh-9fg2", "shortDescription": {"text": "ecdsa: GHSA-8qxj-f9rh-9fg2"}, "fullDescription": {"text": "Improper Verification of Cryptographic Signature in Pure-Python ECDSA"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "critical", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "GHSA-6c5p-j8vq-pqhj", "name": "python-jose: GHSA-6c5p-j8vq-pqhj", "shortDescription": {"text": "python-jose: GHSA-6c5p-j8vq-pqhj"}, "fullDescription": {"text": "python-jose algorithm confusion with OpenSSH ECDSA keys"}, "properties": {"scanner": "osv-scanner", "category": "dependency", "severity": "critical", "confidence": 0.88, "cwe": "", "owasp": ""}}, {"id": "DKC007", "name": "Compose service contains a literal secret environment value", "shortDescription": {"text": "Compose service contains a literal secret environment value"}, "fullDescription": {"text": "Literal secrets in Compose files are committed to source and exposed through container inspection."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "critical", "confidence": 0.96, "cwe": "", "owasp": ""}}, {"id": "MINED107", "name": "Missing import: `email` used but not imported", "shortDescription": {"text": "Missing import: `email` used but not imported"}, "fullDescription": {"text": "The file uses `email.something(...)` but never imports `email`. This raises NameError at runtime the first time the line executes."}, "properties": {"scanner": "repobility-ast-engine", "category": "quality", "severity": "critical", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "scanner-506be2b95088f5d3", "name": "git log failed \u2014 history analysis incomplete", "shortDescription": {"text": "git log failed \u2014 history analysis incomplete"}, "fullDescription": {"text": "fatal: not a git repository (or any parent up to mount point /data)\nStopping at filesystem boundary (GIT_DISCOVERY_ACROSS_FILESYSTEM not set)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/2584"}, "properties": {"repository": "alexlana0/RemindMe", "repoUrl": "https://github.com/alexlana0/RemindMe", "branch": "main"}, "results": [{"ruleId": "JRN002", "level": "warning", "message": {"text": "Browser storage is used for session token material"}, "properties": {"repobilityId": 215112, "scanner": "repobility-journey-contract", "fingerprint": "61c8a5e5a29083be6bdc6cce1b541bff1fe3480e38a167e6219f1048ad83df3f", "category": "auth", "severity": "medium", "confidence": 0.82, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Storage API call references token-like key or value names.", "evidence": {"rule_id": "JRN002", "scanner": "repobility-journey-contract", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"], "correlation_key": "code|auth|front/src/auth.tsx|49|jrn002"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "front/src/auth.tsx"}, "region": {"startLine": 49}}}]}, {"ruleId": "JRN002", "level": "warning", "message": {"text": "Browser storage is used for session token material"}, "properties": {"repobilityId": 215111, "scanner": "repobility-journey-contract", "fingerprint": "17497898bcea16f754213bc550fd9a8809c449b2555614351ce3f8354cb52d0e", "category": "auth", "severity": "medium", "confidence": 0.82, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Storage API call references token-like key or value names.", "evidence": {"rule_id": "JRN002", "scanner": "repobility-journey-contract", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"], "correlation_key": "code|auth|front/src/auth.tsx|44|jrn002"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "front/src/auth.tsx"}, "region": {"startLine": 44}}}]}, {"ruleId": "JRN002", "level": "warning", "message": {"text": "Browser storage is used for session token material"}, "properties": {"repobilityId": 215110, "scanner": "repobility-journey-contract", "fingerprint": "412b5777a9ba0585e07d59b08669c1e082c06114c246bc133c2c8e543eb01b04", "category": "auth", "severity": "medium", "confidence": 0.82, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Storage API call references token-like key or value names.", "evidence": {"rule_id": "JRN002", "scanner": "repobility-journey-contract", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"], "correlation_key": "code|auth|front/src/api.ts|6|jrn002"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "front/src/api.ts"}, "region": {"startLine": 6}}}]}, {"ruleId": "GHSA-4w7w-66w2-5vf9", "level": "warning", "message": {"text": "vite: GHSA-4w7w-66w2-5vf9"}, "properties": {"repobilityId": 215109, "scanner": "osv-scanner", "fingerprint": "36e7f5baca6bf93e6c87bd831a3afe39ff33d2801c58e821f0c6a4fd0abbc437", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-39365"], "package": "vite", "rule_id": "GHSA-4w7w-66w2-5vf9", "scanner": "osv-scanner", "correlation_key": "vuln|vite|CVE-2026-39365|front/package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "front/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-67mh-4wv8-2f99", "level": "warning", "message": {"text": "esbuild: GHSA-67mh-4wv8-2f99"}, "properties": {"repobilityId": 215107, "scanner": "osv-scanner", "fingerprint": "77bc722bad68ea6e273843e5e02905da9de0c01b6154a38815895e7d084f2a52", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "package": "esbuild", "rule_id": "GHSA-67mh-4wv8-2f99", "scanner": "osv-scanner", "correlation_key": "vuln|esbuild|GHSA-67MH-4WV8-2F99|front/package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "front/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-2c2j-9gv5-cj73", "level": "warning", "message": {"text": "starlette: GHSA-2c2j-9gv5-cj73"}, "properties": {"repobilityId": 215105, "scanner": "osv-scanner", "fingerprint": "0095ad0446d9df4111a07d7aabdaa368970d51ca3205f3e466b0c36a95821889", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2025-54121"], "package": "starlette", "rule_id": "GHSA-2c2j-9gv5-cj73", "scanner": "osv-scanner", "correlation_key": "vuln|starlette|CVE-2025-54121|api/requirements.txt"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-65pc-fj4g-8rjx", "level": "warning", "message": {"text": "idna: GHSA-65pc-fj4g-8rjx"}, "properties": {"repobilityId": 215103, "scanner": "osv-scanner", "fingerprint": "1a12d20a3be101723e59bd776233da9f0592f4986161f1839450d1e9fb99295d", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-45409"], "package": "idna", "rule_id": "GHSA-65pc-fj4g-8rjx", "scanner": "osv-scanner", "correlation_key": "vuln|idna|CVE-2024-3651|api/requirements.txt"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-9f5j-8jwj-x28g", "level": "warning", "message": {"text": "ecdsa: GHSA-9f5j-8jwj-x28g"}, "properties": {"repobilityId": 215100, "scanner": "osv-scanner", "fingerprint": "842ecf7d685c74d7b52d6507bf274e23475f9875060e1ff6693875b44c9f308b", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-33936"], "package": "ecdsa", "rule_id": "GHSA-9f5j-8jwj-x28g", "scanner": "osv-scanner", "correlation_key": "vuln|ecdsa|CVE-2026-33936|api/requirements.txt"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-mj87-hwqh-73pj", "level": "warning", "message": {"text": "python-multipart: GHSA-mj87-hwqh-73pj"}, "properties": {"repobilityId": 215095, "scanner": "osv-scanner", "fingerprint": "d3ff33f310e314c52d54959a182f3fa4a116038b4881d1d93f2d91d1a163e79e", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-40347"], "package": "python-multipart", "rule_id": "GHSA-mj87-hwqh-73pj", "scanner": "osv-scanner", "correlation_key": "vuln|python-multipart|CVE-2026-40347|api/requirements.txt"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-cjwg-qfpm-7377", "level": "warning", "message": {"text": "python-jose: GHSA-cjwg-qfpm-7377"}, "properties": {"repobilityId": 215094, "scanner": "osv-scanner", "fingerprint": "05e429b1e737771584aa163f99a6c96db80fde4b6f7a7fb4ee76a114bcfcffc5", "category": "dependency", "severity": "medium", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2024-33664", "PYSEC-2024-233"], "package": "python-jose", "rule_id": "GHSA-cjwg-qfpm-7377", "scanner": "osv-scanner", "correlation_key": "vuln|python-jose|CVE-2024-33664|api/requirements.txt"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "DKR003", "level": "warning", "message": {"text": "Compose service `dozzle` image uses the latest tag"}, "properties": {"repobilityId": 215087, "scanner": "repobility-docker", "fingerprint": "ac9febce371b260d671d5f831cad309fefbe85c01f38120e68a5cbc213d57c43", "category": "docker", "severity": "medium", "confidence": 0.94, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Image tag is latest.", "evidence": {"image": "amir20/dozzle:latest", "rule_id": "DKR003", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/scout/policy/", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|ac9febce371b260d671d5f831cad309fefbe85c01f38120e68a5cbc213d57c43"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 82}}}]}, {"ruleId": "DKR003", "level": "warning", "message": {"text": "Compose service `mailpit` image uses the latest tag"}, "properties": {"repobilityId": 215073, "scanner": "repobility-docker", "fingerprint": "177b7fb78a7f779c6c99bdc8a769ae678c17ac0c49cab1c91889dbb65a1b048f", "category": "docker", "severity": "medium", "confidence": 0.94, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Image tag is latest.", "evidence": {"image": "axllent/mailpit:latest", "rule_id": "DKR003", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/scout/policy/", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|177b7fb78a7f779c6c99bdc8a769ae678c17ac0c49cab1c91889dbb65a1b048f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "DKC013", "level": "warning", "message": {"text": "Database service has no persistent data volume"}, "properties": {"repobilityId": 215071, "scanner": "repobility-docker", "fingerprint": "97d6c4f9fd8913f7b1343d90d1453e5aa3342752681a5a6816fd7bca38cb3311", "category": "docker", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Database-like service does not mount a known data directory.", "evidence": {"rule_id": "DKC013", "scanner": "repobility-docker", "service": "redis", "references": ["https://docs.docker.com/engine/storage/volumes/"], "correlation_key": "fp|97d6c4f9fd8913f7b1343d90d1453e5aa3342752681a5a6816fd7bca38cb3311", "expected_targets": ["/data"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 18}}}]}, {"ruleId": "DKR001", "level": "warning", "message": {"text": "Docker final stage has no non-root USER"}, "properties": {"repobilityId": 215069, "scanner": "repobility-docker", "fingerprint": "ecf1f83bdb4d4d8b9a0356e36bdf9ce9a9167a30713d14753ac70548f6785398", "category": "docker", "severity": "medium", "confidence": 0.82, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "No USER directive was found in the final runtime stage.", "evidence": {"rule_id": "DKR001", "scanner": "repobility-docker", "final_base": "nginx:1.27-alpine", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|ecf1f83bdb4d4d8b9a0356e36bdf9ce9a9167a30713d14753ac70548f6785398"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "front/Dockerfile"}, "region": {"startLine": 8}}}]}, {"ruleId": "DKR007", "level": "warning", "message": {"text": "Docker build context has no .dockerignore"}, "properties": {"repobilityId": 215067, "scanner": "repobility-docker", "fingerprint": "c98378cf8c37e4866e89d6ca06a24b7e8c44654aa34e6e4bf1367c4a4c0c5b44", "category": "docker", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Dockerfile exists but repository root has no .dockerignore.", "evidence": {"rule_id": "DKR007", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/"], "correlation_key": "fp|c98378cf8c37e4866e89d6ca06a24b7e8c44654aa34e6e4bf1367c4a4c0c5b44"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".dockerignore"}, "region": {"startLine": 1}}}]}, {"ruleId": "DKR001", "level": "warning", "message": {"text": "Docker final stage has no non-root USER"}, "properties": {"repobilityId": 215066, "scanner": "repobility-docker", "fingerprint": "c8bae2b033de69f2da02d8a527fc68294236cfa2fcc082e0e7fe17ed07fa77de", "category": "docker", "severity": "medium", "confidence": 0.82, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "No USER directive was found in the final runtime stage.", "evidence": {"rule_id": "DKR001", "scanner": "repobility-docker", "final_base": "python:3.12-slim", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|c8bae2b033de69f2da02d8a527fc68294236cfa2fcc082e0e7fe17ed07fa77de"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "SEC015", "level": "warning", "message": {"text": "[SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is predictable."}, "properties": {"repobilityId": 215059, "scanner": "repobility-threat-engine", "fingerprint": "f38a05b83da09866398af6c873936f86ea3b38a467c4b211fc6322b925dc732c", "category": "crypto", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Security-sensitive keyword found nearby \u2014 weak PRNG is risky here", "evidence": {"match": "def create_access_token", "reason": "Security-sensitive keyword found nearby \u2014 weak PRNG is risky here", "rule_id": "SEC015", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|crypto|api/app/security.py|19|sec015"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/security.py"}, "region": {"startLine": 19}}}]}, {"ruleId": "SEC015", "level": "warning", "message": {"text": "[SEC015] Insecure Randomness for Security: Weak PRNG used in security-sensitive context. Output is predictable."}, "properties": {"repobilityId": 215058, "scanner": "repobility-threat-engine", "fingerprint": "bf6088b9856f692f07cb5b5e0b53f2657bbca38d7189a609da9e04b1965f0b6e", "category": "crypto", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Security-sensitive keyword found nearby \u2014 weak PRNG is risky here", "evidence": {"match": "def create_token", "reason": "Security-sensitive keyword found nearby \u2014 weak PRNG is risky here", "rule_id": "SEC015", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|crypto|api/app/routers/calendar.py|40|sec015"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/routers/calendar.py"}, "region": {"startLine": 40}}}]}, {"ruleId": "COMP001", "level": "warning", "message": {"text": "[COMP001] High cognitive complexity: Function `calendar_feed` has cognitive complexity 16 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion all weigh in. Breakdown: continue=1, for=3, if=4, nested_bonus=7, ternary=1."}, "properties": {"repobilityId": 215051, "scanner": "repobility-threat-engine", "fingerprint": "14ccc35cd307a7143eb027c6de21d86f206549adaac718998469517322c47875", "category": "quality", "severity": "medium", "confidence": 0.95, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "AST-derived cognitive complexity score = 16 (severity threshold for medium: 15+).", "evidence": {"scanner": "repobility-threat-engine", "function": "calendar_feed", "breakdown": {"if": 4, "for": 3, "ternary": 1, "continue": 1, "nested_bonus": 7}, "complexity": 16, "correlation_key": "fp|14ccc35cd307a7143eb027c6de21d86f206549adaac718998469517322c47875"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/routers/calendar.py"}, "region": {"startLine": 62}}}]}, {"ruleId": "DEPCUR-PY", "level": "warning", "message": {"text": "Python package `redis` is 3 major version(s) behind (5.2.1 -> 8.0.0)"}, "properties": {"repobilityId": 215037, "scanner": "repobility-dependency-currency", "fingerprint": "81b6a3509f98cbad5647a4ddf51ded17741a2a59cfeb51df6332fafe32374607", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "3 major version(s) behind", "signal": "currency", "cwe_ids": [], "package": "redis", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "8.0.0", "correlation_key": "fp|81b6a3509f98cbad5647a4ddf51ded17741a2a59cfeb51df6332fafe32374607", "current_version": "5.2.1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 12}}}]}, {"ruleId": "DEPCUR-PY", "level": "warning", "message": {"text": "Python package `bcrypt` is 1 major version(s) behind (4.0.1 -> 5.0.0)"}, "properties": {"repobilityId": 215034, "scanner": "repobility-dependency-currency", "fingerprint": "3901bac4e35cb1fb4af2c789ecb16178365c23eb133a784b82223c15dc25b63c", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "1 major version(s) behind", "signal": "currency", "cwe_ids": [], "package": "bcrypt", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "5.0.0", "correlation_key": "fp|3901bac4e35cb1fb4af2c789ecb16178365c23eb133a784b82223c15dc25b63c", "current_version": "4.0.1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 9}}}]}, {"ruleId": "DEPCUR-NPM", "level": "warning", "message": {"text": "npm package `@vitejs/plugin-react` is 2 major version(s) behind (4.7.0 -> 6.0.2)"}, "properties": {"repobilityId": 215027, "scanner": "repobility-dependency-currency", "fingerprint": "94dba68f627ccaa66ce4b94ea255fa37f8488fc3ed920ce0f2546140116a8ec3", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "2 major version(s) behind", "signal": "currency", "cwe_ids": [], "package": "@vitejs/plugin-react", "scanner": "repobility-dependency-currency", "ecosystem": "npm", "languages": ["javascript"], "latest_version": "6.0.2", "correlation_key": "fp|94dba68f627ccaa66ce4b94ea255fa37f8488fc3ed920ce0f2546140116a8ec3", "current_version": "4.7.0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "front/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-NPM", "level": "warning", "message": {"text": "npm package `@types/react-dom` is 1 major version(s) behind (18.3.7 -> 19.2.3)"}, "properties": {"repobilityId": 215026, "scanner": "repobility-dependency-currency", "fingerprint": "5a0fac9300ac593289dc4db0fb357c62ccaab5fd60cd92e0b069d7975e85ac1a", "category": "dependency", "severity": "medium", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "1 major version(s) behind", "signal": "currency", "cwe_ids": [], "package": "@types/react-dom", "scanner": "repobility-dependency-currency", "ecosystem": "npm", "languages": ["javascript"], "latest_version": "19.2.3", "correlation_key": "fp|5a0fac9300ac593289dc4db0fb357c62ccaab5fd60cd92e0b069d7975e85ac1a", "current_version": "18.3.7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "front/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "MINED111", "level": "warning", "message": {"text": "Bare except continues silently"}, "properties": {"repobilityId": 215020, "scanner": "repobility-ast-engine", "fingerprint": "784e5f38bf3166628d7856f1765d342e6f3ec6a4ba46e2db86e7bdcdcf262301", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|784e5f38bf3166628d7856f1765d342e6f3ec6a4ba46e2db86e7bdcdcf262301"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/tasks.py"}, "region": {"startLine": 130}}}]}, {"ruleId": "CORE_NO_CI", "level": "warning", "message": {"text": "No CI/CD configuration found"}, "properties": {"repobilityId": 215018, "scanner": "repobility-core", "fingerprint": "ca5da3551af97272c4f099fc472740148135a15816b81b90bd862e8f91ec66ce", "category": "practices", "severity": "medium", "confidence": null, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"rule_id": "CORE_NO_CI", "scanner": "repobility-core", "correlation_key": "repo|practices|core_no_ci"}}}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 215089, "scanner": "repobility-docker", "fingerprint": "010e1cf660c832873270b919d34be80dfa0b896ddfdc818631d47713f3c0ebb7", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "dozzle", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|010e1cf660c832873270b919d34be80dfa0b896ddfdc818631d47713f3c0ebb7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 82}}}]}, {"ruleId": "DKC006", "level": "note", "message": {"text": "Compose service does not declare a runtime user"}, "properties": {"repobilityId": 215088, "scanner": "repobility-docker", "fingerprint": "594089f9c418d3944326310ffb616ab4df0b277026976b4f770f2002484a1170", "category": "docker", "severity": "low", "confidence": 0.56, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Service has no user setting and Repobility could not prove the image runs non-root.", "evidence": {"rule_id": "DKC006", "scanner": "repobility-docker", "service": "dozzle", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|594089f9c418d3944326310ffb616ab4df0b277026976b4f770f2002484a1170"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 82}}}]}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 215086, "scanner": "repobility-docker", "fingerprint": "0f4b28dca42716da991e4ed1184836ff013df3ffe1becdeee5805202371585bf", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "front", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|0f4b28dca42716da991e4ed1184836ff013df3ffe1becdeee5805202371585bf"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 72}}}]}, {"ruleId": "DKC006", "level": "note", "message": {"text": "Compose service does not declare a runtime user"}, "properties": {"repobilityId": 215085, "scanner": "repobility-docker", "fingerprint": "6c3036d6544eb3086b84e702a8d7a9368441b2dbc53318005eb2d068833fd4e4", "category": "docker", "severity": "low", "confidence": 0.56, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Service has no user setting and Repobility could not prove the image runs non-root.", "evidence": {"rule_id": "DKC006", "scanner": "repobility-docker", "service": "front", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|6c3036d6544eb3086b84e702a8d7a9368441b2dbc53318005eb2d068833fd4e4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 72}}}]}, {"ruleId": "DKC016", "level": "note", "message": {"text": "App service does not wait for database health"}, "properties": {"repobilityId": 215084, "scanner": "repobility-docker", "fingerprint": "05975191cb13fdc7c4c32e2fe669a13b96c61a8709e50cec9dc57d0cb0d0c6ae", "category": "docker", "severity": "low", "confidence": 0.68, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "App depends on a database-like service without a health-gated dependency.", "evidence": {"rule_id": "DKC016", "scanner": "repobility-docker", "service": "beat", "dependency": "redis", "references": ["https://docs.docker.com/compose/how-tos/startup-order/"], "correlation_key": "fp|05975191cb13fdc7c4c32e2fe669a13b96c61a8709e50cec9dc57d0cb0d0c6ae", "dependency_has_healthcheck": false}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 60}}}]}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 215083, "scanner": "repobility-docker", "fingerprint": "f3e0169f72e598eccabbc3fe625a9f197e957ac9d8916da5a5cc5202c7bf29b5", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "beat", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|f3e0169f72e598eccabbc3fe625a9f197e957ac9d8916da5a5cc5202c7bf29b5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 60}}}]}, {"ruleId": "DKC006", "level": "note", "message": {"text": "Compose service does not declare a runtime user"}, "properties": {"repobilityId": 215082, "scanner": "repobility-docker", "fingerprint": "931258b8c6c1df5feaa5a7ce606d2be07ba2d003cd0fdec00f01f7ec2ad45c01", "category": "docker", "severity": "low", "confidence": 0.56, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Service has no user setting and Repobility could not prove the image runs non-root.", "evidence": {"rule_id": "DKC006", "scanner": "repobility-docker", "service": "beat", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|931258b8c6c1df5feaa5a7ce606d2be07ba2d003cd0fdec00f01f7ec2ad45c01"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 60}}}]}, {"ruleId": "DKC016", "level": "note", "message": {"text": "App service does not wait for database health"}, "properties": {"repobilityId": 215081, "scanner": "repobility-docker", "fingerprint": "b3d74fdc50b1080ffc3e392b28c0d1e4e29bbfe508f1dca84782439c4c1d62b1", "category": "docker", "severity": "low", "confidence": 0.68, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "App depends on a database-like service without a health-gated dependency.", "evidence": {"rule_id": "DKC016", "scanner": "repobility-docker", "service": "worker", "dependency": "redis", "references": ["https://docs.docker.com/compose/how-tos/startup-order/"], "correlation_key": "fp|b3d74fdc50b1080ffc3e392b28c0d1e4e29bbfe508f1dca84782439c4c1d62b1", "dependency_has_healthcheck": false}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 45}}}]}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 215080, "scanner": "repobility-docker", "fingerprint": "a1102e55640129051b1ab76cd2b66c671360b43d95caabe230864f03f49d7f6d", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "worker", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|a1102e55640129051b1ab76cd2b66c671360b43d95caabe230864f03f49d7f6d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 45}}}]}, {"ruleId": "DKC006", "level": "note", "message": {"text": "Compose service does not declare a runtime user"}, "properties": {"repobilityId": 215079, "scanner": "repobility-docker", "fingerprint": "123a3fcf5ef6bd682de4d35ba219d520e8f79c5672263a75c1756b60238ac897", "category": "docker", "severity": "low", "confidence": 0.56, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Service has no user setting and Repobility could not prove the image runs non-root.", "evidence": {"rule_id": "DKC006", "scanner": "repobility-docker", "service": "worker", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|123a3fcf5ef6bd682de4d35ba219d520e8f79c5672263a75c1756b60238ac897"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 45}}}]}, {"ruleId": "DKC016", "level": "note", "message": {"text": "App service does not wait for database health"}, "properties": {"repobilityId": 215078, "scanner": "repobility-docker", "fingerprint": "a6dd24991eab438b4eb37145a104475375f851201e42f2e3c5df5e4f4fdb331d", "category": "docker", "severity": "low", "confidence": 0.68, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "App depends on a database-like service without a health-gated dependency.", "evidence": {"rule_id": "DKC016", "scanner": "repobility-docker", "service": "api", "dependency": "redis", "references": ["https://docs.docker.com/compose/how-tos/startup-order/"], "correlation_key": "fp|a6dd24991eab438b4eb37145a104475375f851201e42f2e3c5df5e4f4fdb331d", "dependency_has_healthcheck": false}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 215077, "scanner": "repobility-docker", "fingerprint": "a9802bf3cddadad48ff0bc4ae970a9287371defb43ff460f2fbf2dd31207c115", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "api", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|a9802bf3cddadad48ff0bc4ae970a9287371defb43ff460f2fbf2dd31207c115"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "DKC006", "level": "note", "message": {"text": "Compose service does not declare a runtime user"}, "properties": {"repobilityId": 215076, "scanner": "repobility-docker", "fingerprint": "f34f9d0e67b38513ceb678b214c4eafb7d729620eb38f727fb19fd3e0df1bfbc", "category": "docker", "severity": "low", "confidence": 0.56, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Service has no user setting and Repobility could not prove the image runs non-root.", "evidence": {"rule_id": "DKC006", "scanner": "repobility-docker", "service": "api", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|f34f9d0e67b38513ceb678b214c4eafb7d729620eb38f727fb19fd3e0df1bfbc"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 28}}}]}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 215075, "scanner": "repobility-docker", "fingerprint": "e915f6012968b98d15df7a137caa11b55c1431b9bde797009da94fb300052590", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "mailpit", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|e915f6012968b98d15df7a137caa11b55c1431b9bde797009da94fb300052590"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "DKC006", "level": "note", "message": {"text": "Compose service does not declare a runtime user"}, "properties": {"repobilityId": 215074, "scanner": "repobility-docker", "fingerprint": "53bed6fa83e0b20dca01338bdc0eff1bbbd7c85980ddf8e92e8b78dee9e3f33b", "category": "docker", "severity": "low", "confidence": 0.56, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Service has no user setting and Repobility could not prove the image runs non-root.", "evidence": {"rule_id": "DKC006", "scanner": "repobility-docker", "service": "mailpit", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|53bed6fa83e0b20dca01338bdc0eff1bbbd7c85980ddf8e92e8b78dee9e3f33b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "DKC015", "level": "note", "message": {"text": "Database service has no healthcheck"}, "properties": {"repobilityId": 215072, "scanner": "repobility-docker", "fingerprint": "25ff8996e16e2ad7c070f2cd989ed77cb6f23c22c5af953f6803c81fe87633d1", "category": "docker", "severity": "low", "confidence": 0.72, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Database-like service has no Compose healthcheck.", "evidence": {"rule_id": "DKC015", "scanner": "repobility-docker", "service": "redis", "references": ["https://docs.docker.com/compose/how-tos/startup-order/"], "correlation_key": "fp|25ff8996e16e2ad7c070f2cd989ed77cb6f23c22c5af953f6803c81fe87633d1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 18}}}]}, {"ruleId": "COMP001", "level": "note", "message": {"text": "[COMP001] High cognitive complexity: Function `request_connection` has cognitive complexity 8 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion all weigh in. Breakdown: except=1, if=5, nested_bonus=2."}, "properties": {"repobilityId": 215052, "scanner": "repobility-threat-engine", "fingerprint": "3e8b15ef122ee8a1b0f99b452b54f021f20c2d2f68ad169113c2e92326d46629", "category": "quality", "severity": "low", "confidence": 0.95, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "AST-derived cognitive complexity score = 8 (severity threshold for low: 8+).", "evidence": {"scanner": "repobility-threat-engine", "function": "request_connection", "breakdown": {"if": 5, "except": 1, "nested_bonus": 2}, "complexity": 8, "correlation_key": "fp|3e8b15ef122ee8a1b0f99b452b54f021f20c2d2f68ad169113c2e92326d46629"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/routers/connections.py"}, "region": {"startLine": 97}}}]}, {"ruleId": "COMP001", "level": "note", "message": {"text": "[COMP001] High cognitive complexity: Function `visible_items` has cognitive complexity 10 (SonarSource scale). Cognitive complexity measures how hard the function is for a human to understand \u2014 nested branches, boolean chains, and recursion all weigh in. Breakdown: and=1, else=2, for=1, if=4, nested_bonus=2."}, "properties": {"repobilityId": 215050, "scanner": "repobility-threat-engine", "fingerprint": "63e86a565c439378486fdc444cdec023fccc12da92ec2a45939df51d71d92d46", "category": "quality", "severity": "low", "confidence": 0.95, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "AST-derived cognitive complexity score = 10 (severity threshold for low: 8+).", "evidence": {"scanner": "repobility-threat-engine", "function": "visible_items", "breakdown": {"if": 4, "and": 1, "for": 1, "else": 2, "nested_bonus": 2}, "complexity": 10, "correlation_key": "fp|63e86a565c439378486fdc444cdec023fccc12da92ec2a45939df51d71d92d46"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/privacy.py"}, "region": {"startLine": 93}}}]}, {"ruleId": "DEPCUR-PY", "level": "note", "message": {"text": "Python package `email-validator` is minor version(s) behind (2.2.0 -> 2.3.0)"}, "properties": {"repobilityId": 215038, "scanner": "repobility-dependency-currency", "fingerprint": "ee44463240b7195f46394cb895a94ba1e7b0b211c727fcbc0b374211f066e2c9", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "email-validator", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "2.3.0", "correlation_key": "fp|ee44463240b7195f46394cb895a94ba1e7b0b211c727fcbc0b374211f066e2c9", "current_version": "2.2.0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 13}}}]}, {"ruleId": "DEPCUR-PY", "level": "note", "message": {"text": "Python package `celery` is minor version(s) behind (5.4.0 -> 5.6.3)"}, "properties": {"repobilityId": 215036, "scanner": "repobility-dependency-currency", "fingerprint": "332068a13ee1584d6e0c0a428e8c4e737d4661a36d9c6d84b0cb2ea12d8b7141", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "celery", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "5.6.3", "correlation_key": "fp|332068a13ee1584d6e0c0a428e8c4e737d4661a36d9c6d84b0cb2ea12d8b7141", "current_version": "5.4.0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 11}}}]}, {"ruleId": "DEPCUR-PY", "level": "note", "message": {"text": "Python package `python-jose` is minor version(s) behind (3.3.0 -> 3.5.0)"}, "properties": {"repobilityId": 215033, "scanner": "repobility-dependency-currency", "fingerprint": "2a64f7875f527a5408d65b55153c5546eb92e9b6e8b15f4fab00fbb1a281d4a6", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "python-jose", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "3.5.0", "correlation_key": "fp|2a64f7875f527a5408d65b55153c5546eb92e9b6e8b15f4fab00fbb1a281d4a6", "current_version": "3.3.0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 7}}}]}, {"ruleId": "DEPCUR-PY", "level": "note", "message": {"text": "Python package `pydantic-settings` is minor version(s) behind (2.6.1 -> 2.14.1)"}, "properties": {"repobilityId": 215032, "scanner": "repobility-dependency-currency", "fingerprint": "13d17abe05b3dc4be197e3065c8a2776f07d49a7e03f8eb317446784c68983cd", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "pydantic-settings", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "2.14.1", "correlation_key": "fp|13d17abe05b3dc4be197e3065c8a2776f07d49a7e03f8eb317446784c68983cd", "current_version": "2.6.1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 6}}}]}, {"ruleId": "DEPCUR-PY", "level": "note", "message": {"text": "Python package `pydantic` is minor version(s) behind (2.10.3 -> 2.13.4)"}, "properties": {"repobilityId": 215031, "scanner": "repobility-dependency-currency", "fingerprint": "20fc2c10e03fadf056c8a2dc0abbfb33ca240ed54a5d73485142cd0805a669de", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "pydantic", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "2.13.4", "correlation_key": "fp|20fc2c10e03fadf056c8a2dc0abbfb33ca240ed54a5d73485142cd0805a669de", "current_version": "2.10.3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 5}}}]}, {"ruleId": "DEPCUR-PY", "level": "note", "message": {"text": "Python package `uvicorn` is minor version(s) behind (0.32.1 -> 0.49.0)"}, "properties": {"repobilityId": 215029, "scanner": "repobility-dependency-currency", "fingerprint": "ee2f6e7d2bf6f2d9bf550a227b4dd39e9431073d2caeb571b7e66c5607fe268c", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "uvicorn", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "0.49.0", "correlation_key": "fp|ee2f6e7d2bf6f2d9bf550a227b4dd39e9431073d2caeb571b7e66c5607fe268c", "current_version": "0.32.1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 2}}}]}, {"ruleId": "DEPCUR-PY", "level": "note", "message": {"text": "Python package `fastapi` is minor version(s) behind (0.115.5 -> 0.137.0)"}, "properties": {"repobilityId": 215028, "scanner": "repobility-dependency-currency", "fingerprint": "f4f2254485bcca0e8b9ab47ecfe822cad81d30df08949e66dabf5ee042e3b463", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "fastapi", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "0.137.0", "correlation_key": "fp|f4f2254485bcca0e8b9ab47ecfe822cad81d30df08949e66dabf5ee042e3b463", "current_version": "0.115.5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "DEPCUR-NPM", "level": "note", "message": {"text": "npm package `axios` is minor version(s) behind (1.17.0 -> 1.18.0)"}, "properties": {"repobilityId": 215025, "scanner": "repobility-dependency-currency", "fingerprint": "6ebecc9105e5dc5efa240fa7d1282f618276d8336454fd758f83a7621cf24850", "category": "dependency", "severity": "low", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "minor version(s) behind", "signal": "currency", "cwe_ids": [], "package": "axios", "scanner": "repobility-dependency-currency", "ecosystem": "npm", "languages": ["javascript"], "latest_version": "1.18.0", "correlation_key": "fp|6ebecc9105e5dc5efa240fa7d1282f618276d8336454fd758f83a7621cf24850", "current_version": "1.17.0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "front/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 215019, "scanner": "repobility-ai-code-hygiene", "fingerprint": "c79d05bdf5c94bfc55bfdbcdf3117f8a73d2cf06bb4e957087d6e2a439c3b4b7", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "front/src/pages/ForgotPassword.tsx", "duplicate_line": 44, "correlation_key": "fp|c79d05bdf5c94bfc55bfdbcdf3117f8a73d2cf06bb4e957087d6e2a439c3b4b7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "front/src/pages/Login.tsx"}, "region": {"startLine": 128}}}]}, {"ruleId": "MINED056", "level": "none", "message": {"text": "[MINED056] React Key As Index: key={index} in map() \u2014 re-renders the wrong elements on re-order."}, "properties": {"repobilityId": 215065, "scanner": "repobility-threat-engine", "fingerprint": "ad44a96281da1a21c23418163e8161243f0d4fd52d3d97005159a1ccfce0dcc3", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "react-key-as-index", "owasp": null, "cwe_ids": ["CWE-682"], "languages": ["typescript", "tsx", "javascript", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348032+00:00", "triaged_in_corpus": 12, "observations_count": 299917, "ai_coder_pattern_id": 135}, "scanner": "repobility-threat-engine", "correlation_key": "fp|ad44a96281da1a21c23418163e8161243f0d4fd52d3d97005159a1ccfce0dcc3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "front/src/theme.tsx"}, "region": {"startLine": 51}}}]}, {"ruleId": "MINED056", "level": "none", "message": {"text": "[MINED056] React Key As Index: key={index} in map() \u2014 re-renders the wrong elements on re-order."}, "properties": {"repobilityId": 215064, "scanner": "repobility-threat-engine", "fingerprint": "dd6f193e74dadac4518ad8d70fd6d1542a1adfd82f7f4ef07b0c06a8fa4506f7", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "react-key-as-index", "owasp": null, "cwe_ids": ["CWE-682"], "languages": ["typescript", "tsx", "javascript", "jsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348032+00:00", "triaged_in_corpus": 12, "observations_count": 299917, "ai_coder_pattern_id": 135}, "scanner": "repobility-threat-engine", "correlation_key": "fp|dd6f193e74dadac4518ad8d70fd6d1542a1adfd82f7f4ef07b0c06a8fa4506f7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "front/src/pages/Welcome.tsx"}, "region": {"startLine": 14}}}]}, {"ruleId": "MINED052", "level": "none", "message": {"text": "[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety."}, "properties": {"repobilityId": 215063, "scanner": "repobility-threat-engine", "fingerprint": "26710c695cc8889ac7b9361f1299e054ec1cc73e5e689e29dc8072546ff34abe", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ts-any-typed", "owasp": null, "cwe_ids": ["CWE-704"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348022+00:00", "triaged_in_corpus": 12, "observations_count": 496002, "ai_coder_pattern_id": 97}, "scanner": "repobility-threat-engine", "correlation_key": "fp|26710c695cc8889ac7b9361f1299e054ec1cc73e5e689e29dc8072546ff34abe"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "front/src/pages/Login.tsx"}, "region": {"startLine": 115}}}]}, {"ruleId": "MINED052", "level": "none", "message": {"text": "[MINED052] Ts Any Typed: : any used as type annotation. Defeats TypeScript type safety."}, "properties": {"repobilityId": 215062, "scanner": "repobility-threat-engine", "fingerprint": "277d5800feefcbf36bfdcc3baa0ca5e3a28d701c7f0f6d3e1a96c399c221c1c1", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "ts-any-typed", "owasp": null, "cwe_ids": ["CWE-704"], "languages": ["typescript", "tsx"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348022+00:00", "triaged_in_corpus": 12, "observations_count": 496002, "ai_coder_pattern_id": 97}, "scanner": "repobility-threat-engine", "correlation_key": "fp|277d5800feefcbf36bfdcc3baa0ca5e3a28d701c7f0f6d3e1a96c399c221c1c1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "front/src/pages/ForgotPassword.tsx"}, "region": {"startLine": 19}}}]}, {"ruleId": "MINED043", "level": "none", "message": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "properties": {"repobilityId": 215061, "scanner": "repobility-threat-engine", "fingerprint": "c6fb7ebc0ae904de633632f409c2650927e33f37a9791cb3a25963e227508d88", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "http-not-https", "owasp": "A02:2021", "cwe_ids": ["CWE-319"], "precision": 0.917, "promoted_at": "2026-05-18T14:01:32.347999+00:00", "triaged_in_corpus": 12, "observations_count": 4113831, "ai_coder_pattern_id": 15}, "scanner": "repobility-threat-engine", "correlation_key": "fp|c6fb7ebc0ae904de633632f409c2650927e33f37a9791cb3a25963e227508d88"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "front/vite.config.ts"}, "region": {"startLine": 11}}}]}, {"ruleId": "MINED043", "level": "none", "message": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "properties": {"repobilityId": 215060, "scanner": "repobility-threat-engine", "fingerprint": "33d77ce5ed9f2ff9f97501cdc6e40f17537d1f9e94339227ae3caddea3c865cf", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "http-not-https", "owasp": "A02:2021", "cwe_ids": ["CWE-319"], "precision": 0.917, "promoted_at": "2026-05-18T14:01:32.347999+00:00", "triaged_in_corpus": 12, "observations_count": 4113831, "ai_coder_pattern_id": 15}, "scanner": "repobility-threat-engine", "correlation_key": "fp|33d77ce5ed9f2ff9f97501cdc6e40f17537d1f9e94339227ae3caddea3c865cf"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "front/nginx.conf"}, "region": {"startLine": 8}}}]}, {"ruleId": "SEC135", "level": "none", "message": {"text": "[SEC135] Auth/permission check missing on AI-generated endpoint (and 5 more): Same pattern found in 5 additional files. Review if needed."}, "properties": {"repobilityId": 215057, "scanner": "repobility-threat-engine", "fingerprint": "180603e72eaea65a816ddfcc7002e3fc1e393c00d6870777c7b51c8226ddf31c", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 5 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 5 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC135", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|180603e72eaea65a816ddfcc7002e3fc1e393c00d6870777c7b51c8226ddf31c"}}}, {"ruleId": "COMP001", "level": "none", "message": {"text": "[COMP001] High cognitive complexity (and 2 more): Same pattern found in 2 additional files. Review if needed."}, "properties": {"repobilityId": 215053, "scanner": "repobility-threat-engine", "fingerprint": "374b2f9ca97c941ea8799534a3f6a7246c4a413e5ec69c34d7f4988e5034f739", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 2 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"scanner": "repobility-threat-engine", "function": "visible_items", "breakdown": {"if": 4, "and": 1, "for": 1, "else": 2, "nested_bonus": 2}, "aggregated": true, "complexity": 10, "correlation_key": "fp|374b2f9ca97c941ea8799534a3f6a7246c4a413e5ec69c34d7f4988e5034f739", "aggregated_count": 2}}}, {"ruleId": "MINED047", "level": "none", "message": {"text": "[MINED047] Emoji In Source: Emoji \u2705 \u274c \ud83d\ude80 in code/comments \u2014 common AI output unless explicitly requested."}, "properties": {"repobilityId": 215049, "scanner": "repobility-threat-engine", "fingerprint": "86cef339696fa96fab9a218355563d3862e34dd444e7df1290fc2038a9770c16", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "emoji-in-source", "owasp": null, "cwe_ids": [], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348010+00:00", "triaged_in_corpus": 9, "observations_count": 1468364, "ai_coder_pattern_id": 29}, "scanner": "repobility-threat-engine", "correlation_key": "fp|86cef339696fa96fab9a218355563d3862e34dd444e7df1290fc2038a9770c16"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/holidays.py"}, "region": {"startLine": 75}}}]}, {"ruleId": "MINED072", "level": "none", "message": {"text": "[MINED072] Python Pass Only Class: class Foo: pass \u2014 stub waiting to be filled in."}, "properties": {"repobilityId": 215048, "scanner": "repobility-threat-engine", "fingerprint": "02caefe11a8ea95cec0f96cc4de2a457a56838c88a2da298d410ecf74addaf9f", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "python-pass-only-class", "owasp": null, "cwe_ids": ["CWE-1188"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348069+00:00", "triaged_in_corpus": 10, "observations_count": 14245, "ai_coder_pattern_id": 143}, "scanner": "repobility-threat-engine", "correlation_key": "fp|02caefe11a8ea95cec0f96cc4de2a457a56838c88a2da298d410ecf74addaf9f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/database.py"}, "region": {"startLine": 10}}}]}, {"ruleId": "MINED050", "level": "none", "message": {"text": "[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment."}, "properties": {"repobilityId": 215047, "scanner": "repobility-threat-engine", "fingerprint": "f6d16065f06b2e5197cfff44d6febe6061a3f963444d111fa34639c492b08289", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "stub-only-function", "owasp": null, "cwe_ids": ["CWE-1188"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348017+00:00", "triaged_in_corpus": 12, "observations_count": 633513, "ai_coder_pattern_id": 2}, "scanner": "repobility-threat-engine", "correlation_key": "fp|f6d16065f06b2e5197cfff44d6febe6061a3f963444d111fa34639c492b08289"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/routers/auth.py"}, "region": {"startLine": 134}}}]}, {"ruleId": "MINED050", "level": "none", "message": {"text": "[MINED050] Stub Only Function: Function declared but body is just pass, return None, raise NotImplementedError, or TODO comment."}, "properties": {"repobilityId": 215046, "scanner": "repobility-threat-engine", "fingerprint": "68470f965fcf488e95389a3acfd510206f07b0582da3c9653ecfa36f67b28275", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "stub-only-function", "owasp": null, "cwe_ids": ["CWE-1188"], "languages": ["python"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348017+00:00", "triaged_in_corpus": 12, "observations_count": 633513, "ai_coder_pattern_id": 2}, "scanner": "repobility-threat-engine", "correlation_key": "fp|68470f965fcf488e95389a3acfd510206f07b0582da3c9653ecfa36f67b28275"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/database.py"}, "region": {"startLine": 11}}}]}, {"ruleId": "MINED065", "level": "none", "message": {"text": "[MINED065] Cors Wildcard: Access-Control-Allow-Origin: * exposes the API to any browser origin. Acceptable for public read-only endpoints; dangerous when paired with credentials or write endpoints."}, "properties": {"repobilityId": 215045, "scanner": "repobility-threat-engine", "fingerprint": "d2f7e170944da1b137d995b7d82cf0f58cda1047ebcb8a8052346032b8238b2f", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "cors-wildcard", "owasp": "A05:2021", "cwe_ids": ["CWE-942", "CWE-346"], "languages": ["python", "javascript", "typescript", "yaml", "json"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348052+00:00", "triaged_in_corpus": 12, "observations_count": 63910, "ai_coder_pattern_id": 46}, "scanner": "repobility-threat-engine", "correlation_key": "fp|d2f7e170944da1b137d995b7d82cf0f58cda1047ebcb8a8052346032b8238b2f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/main.py"}, "region": {"startLine": 32}}}]}, {"ruleId": "MINED065", "level": "none", "message": {"text": "[MINED065] Cors Wildcard: Access-Control-Allow-Origin: * exposes the API to any browser origin. Acceptable for public read-only endpoints; dangerous when paired with credentials or write endpoints."}, "properties": {"repobilityId": 215044, "scanner": "repobility-threat-engine", "fingerprint": "786a00eb7f833d23f405eed64ddc6f8a1e141814b95762d1f298dff5607756d8", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "cors-wildcard", "owasp": "A05:2021", "cwe_ids": ["CWE-942", "CWE-346"], "languages": ["python", "javascript", "typescript", "yaml", "json"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348052+00:00", "triaged_in_corpus": 12, "observations_count": 63910, "ai_coder_pattern_id": 46}, "scanner": "repobility-threat-engine", "correlation_key": "fp|786a00eb7f833d23f405eed64ddc6f8a1e141814b95762d1f298dff5607756d8"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/config.py"}, "region": {"startLine": 27}}}]}, {"ruleId": "SEC128", "level": "none", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake) (and 3 more): Same pattern found in 3 additional files. Review if needed."}, "properties": {"repobilityId": 215043, "scanner": "repobility-threat-engine", "fingerprint": "7a4b0f5540cad034a1707c0e9f6ef94d621d463e55602684599877ea4071a670", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 3 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 3 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|7a4b0f5540cad034a1707c0e9f6ef94d621d463e55602684599877ea4071a670"}}}, {"ruleId": "DEPCUR-PY", "level": "none", "message": {"text": "Python package `slowapi` is patch version(s) behind (0.1.9 -> 0.1.10)"}, "properties": {"repobilityId": 215039, "scanner": "repobility-dependency-currency", "fingerprint": "1ca989ac2eb5fb494b0b00829ec6b7ee46b4f50098984697c039ce7d3961fe7a", "category": "dependency", "severity": "info", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "patch version(s) behind", "signal": "currency", "cwe_ids": [], "package": "slowapi", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "0.1.10", "correlation_key": "fp|1ca989ac2eb5fb494b0b00829ec6b7ee46b4f50098984697c039ce7d3961fe7a", "current_version": "0.1.9"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 14}}}]}, {"ruleId": "DEPCUR-PY", "level": "none", "message": {"text": "Python package `python-multipart` is patch version(s) behind (0.0.18 -> 0.0.32)"}, "properties": {"repobilityId": 215035, "scanner": "repobility-dependency-currency", "fingerprint": "9c45b17c0882c59a940296e82952d326ae0ccc934d76eea2b71e434356027639", "category": "dependency", "severity": "info", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "patch version(s) behind", "signal": "currency", "cwe_ids": [], "package": "python-multipart", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "0.0.32", "correlation_key": "fp|9c45b17c0882c59a940296e82952d326ae0ccc934d76eea2b71e434356027639", "current_version": "0.0.18"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 10}}}]}, {"ruleId": "DEPCUR-PY", "level": "none", "message": {"text": "Python package `psycopg2-binary` is patch version(s) behind (2.9.10 -> 2.9.12)"}, "properties": {"repobilityId": 215030, "scanner": "repobility-dependency-currency", "fingerprint": "7336e6dee019f807696083a47ec740fd219658261a1fab007a4bee247a1cb7be", "category": "dependency", "severity": "info", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"gap": "patch version(s) behind", "signal": "currency", "cwe_ids": [], "package": "psycopg2-binary", "scanner": "repobility-dependency-currency", "ecosystem": "pypi", "languages": ["python"], "latest_version": "2.9.12", "correlation_key": "fp|7336e6dee019f807696083a47ec740fd219658261a1fab007a4bee247a1cb7be", "current_version": "2.9.10"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 4}}}]}, {"ruleId": "JRN009", "level": "error", "message": {"text": "Secret-like setting is echoed into a password input value"}, "properties": {"repobilityId": 215114, "scanner": "repobility-journey-contract", "fingerprint": "8eee704196639ddd9b6529fbca54271ee1f498cce8aceadeec301396ebf9a6ba", "category": "auth", "severity": "high", "confidence": 0.83, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "A password or secret-named input is populated from a secret-like variable instead of a masked placeholder.", "evidence": {"rule_id": "JRN009", "scanner": "repobility-journey-contract", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"], "correlation_key": "code|auth|token|54|jrn009"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "front/src/pages/ResetPassword.tsx"}, "region": {"startLine": 54}}}]}, {"ruleId": "JRN009", "level": "error", "message": {"text": "Secret-like setting is echoed into a password input value"}, "properties": {"repobilityId": 215113, "scanner": "repobility-journey-contract", "fingerprint": "9d8b16a189ef54862ed3bfbf6d3762c928547ab2487316c46c56c54476973a17", "category": "auth", "severity": "high", "confidence": 0.83, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "A password or secret-named input is populated from a secret-like variable instead of a masked placeholder.", "evidence": {"rule_id": "JRN009", "scanner": "repobility-journey-contract", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.html"], "correlation_key": "code|auth|front/src/pages/login.tsx|160|jrn009"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "front/src/pages/Login.tsx"}, "region": {"startLine": 160}}}]}, {"ruleId": "GHSA-gv7w-rqvm-qjhr", "level": "error", "message": {"text": "esbuild: GHSA-gv7w-rqvm-qjhr"}, "properties": {"repobilityId": 215108, "scanner": "osv-scanner", "fingerprint": "d5b0708efff904a9057e5df13f7bfa01ad580ba8c4178e6c42c4af9accad805e", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "package": "esbuild", "rule_id": "GHSA-gv7w-rqvm-qjhr", "scanner": "osv-scanner", "correlation_key": "vuln|esbuild|GHSA-GV7W-RQVM-QJHR|front/package-lock.json"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "front/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-7f5h-v6xp-fcq8", "level": "error", "message": {"text": "starlette: GHSA-7f5h-v6xp-fcq8"}, "properties": {"repobilityId": 215106, "scanner": "osv-scanner", "fingerprint": "2ec427b5f476bcb143f6baa35c58857fb09ec97086b1b26a03c1a592c4631c0d", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2025-62727"], "package": "starlette", "rule_id": "GHSA-7f5h-v6xp-fcq8", "scanner": "osv-scanner", "correlation_key": "vuln|starlette|CVE-2025-62727|api/requirements.txt"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "PYSEC-2026-161", "level": "error", "message": {"text": "starlette: PYSEC-2026-161"}, "properties": {"repobilityId": 215104, "scanner": "osv-scanner", "fingerprint": "85f992ae6531799e790d2f87ccee3be2cb77cd36c8ceceeb46742928520f3ebb", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 1 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2026-48710", "GHSA-86qp-5c8j-p5mr", "X41-2026-002"], "package": "starlette", "rule_id": "PYSEC-2026-161", "scanner": "osv-scanner", "correlation_key": "vuln|starlette|CVE-2026-48710|api/requirements.txt", "duplicate_count": 1, "duplicate_rule_ids": ["GHSA-86qp-5c8j-p5mr", "PYSEC-2026-161"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["85f992ae6531799e790d2f87ccee3be2cb77cd36c8ceceeb46742928520f3ebb", "dec8e811e3b05dae1394d876438d8177ca9b0f5a13efccdaf5262cbd2367f09c"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-wj6h-64fc-37mp", "level": "error", "message": {"text": "ecdsa: GHSA-wj6h-64fc-37mp"}, "properties": {"repobilityId": 215101, "scanner": "osv-scanner", "fingerprint": "adef1c602e605af06bd29e43b442f4363144c05ad068a117ec1edb8f4448f513", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2024-23342"], "package": "ecdsa", "rule_id": "GHSA-wj6h-64fc-37mp", "scanner": "osv-scanner", "correlation_key": "vuln|ecdsa|CVE-2024-23342|api/requirements.txt"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "PYSEC-2019-177", "level": "error", "message": {"text": "ecdsa: PYSEC-2019-177"}, "properties": {"repobilityId": 215098, "scanner": "osv-scanner", "fingerprint": "9cc4bd602808a7b0a1b826c7186da5a03eab92c1ce894de320870716459ba6d9", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 1 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2019-14853", "GHSA-2mrj-435v-c2cr", "GHSA-pwfw-mgfj-7g3g"], "package": "ecdsa", "rule_id": "PYSEC-2019-177", "scanner": "osv-scanner", "correlation_key": "vuln|ecdsa|CVE-2019-14853|api/requirements.txt", "duplicate_count": 1, "duplicate_rule_ids": ["GHSA-pwfw-mgfj-7g3g", "PYSEC-2019-177"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["002c73454e8ef44c8c4bc91dc6718763495b0b895ba3f02e6a313c54e61955f8", "9cc4bd602808a7b0a1b826c7186da5a03eab92c1ce894de320870716459ba6d9"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-wp53-j4wj-2cfg", "level": "error", "message": {"text": "python-multipart: GHSA-wp53-j4wj-2cfg"}, "properties": {"repobilityId": 215097, "scanner": "osv-scanner", "fingerprint": "2e43960f125be69036392d34878a502626ff6588075504cad1b09ccaffb59ee1", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-24486"], "package": "python-multipart", "rule_id": "GHSA-wp53-j4wj-2cfg", "scanner": "osv-scanner", "correlation_key": "vuln|python-multipart|CVE-2026-24486|api/requirements.txt"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-pp6c-gr5w-3c5g", "level": "error", "message": {"text": "python-multipart: GHSA-pp6c-gr5w-3c5g"}, "properties": {"repobilityId": 215096, "scanner": "osv-scanner", "fingerprint": "e85a4e011224a834abca688aab75bc0d3bfb766e9a946d12d449a925994fc2a2", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2026-42561"], "package": "python-multipart", "rule_id": "GHSA-pp6c-gr5w-3c5g", "scanner": "osv-scanner", "correlation_key": "vuln|python-multipart|CVE-2026-42561|api/requirements.txt"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "PYSEC-2025-185", "level": "error", "message": {"text": "python-jose: PYSEC-2025-185"}, "properties": {"repobilityId": 215092, "scanner": "osv-scanner", "fingerprint": "0a05e122a15d366c20f29fd4e5ee578b96194e93b60bfb179f09f3991e3818aa", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2024-29370", "GHSA-h4pw-wxh7-4vjj"], "package": "python-jose", "rule_id": "PYSEC-2025-185", "scanner": "osv-scanner", "correlation_key": "vuln|python-jose|CVE-2024-29370|api/requirements.txt"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "PYSEC-2024-233", "level": "error", "message": {"text": "python-jose: PYSEC-2024-233"}, "properties": {"repobilityId": 215091, "scanner": "osv-scanner", "fingerprint": "63ad82a45a13343a42d307c131c651d347049b7f596227400a332a420d872a41", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2024-33664", "GHSA-cjwg-qfpm-7377"], "package": "python-jose", "rule_id": "PYSEC-2024-233", "scanner": "osv-scanner", "correlation_key": "vuln|python-jose|CVE-2024-21319|api/requirements.txt"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "PYSEC-2024-232", "level": "error", "message": {"text": "python-jose: PYSEC-2024-232"}, "properties": {"repobilityId": 215090, "scanner": "osv-scanner", "fingerprint": "ba7ff481e3b6e8a9c0812bdec73f0541a75dd7d1e9aa48b9fecd679e515c98c9", "category": "dependency", "severity": "high", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2024-33663", "GHSA-6c5p-j8vq-pqhj"], "package": "python-jose", "rule_id": "PYSEC-2024-232", "scanner": "osv-scanner", "correlation_key": "vuln|python-jose|CVE-2022-29217|api/requirements.txt"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "DKR014", "level": "error", "message": {"text": "Dockerfile copies the entire context without .dockerignore"}, "properties": {"repobilityId": 215068, "scanner": "repobility-docker", "fingerprint": "daf850d5409c30efdff0dbfecbf1f035840fc034f9f63a618827e4cbe7f66f43", "category": "docker", "severity": "high", "confidence": 0.92, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Broad context copy and missing .dockerignore were found together.", "evidence": {"rule_id": "DKR014", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/"], "correlation_key": "fp|daf850d5409c30efdff0dbfecbf1f035840fc034f9f63a618827e4cbe7f66f43"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "front/Dockerfile"}, "region": {"startLine": 5}}}]}, {"ruleId": "SEC135", "level": "error", "message": {"text": "[SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint generated by an AI agent without an auth decorator or middleware. The number-one production-incident pattern we see in AI-generated SaaS code: the AI builds the route, builds the handler, and forgets to wire the auth check that the rest of the codebase uses. CWE-862 (missing authorization). High-severity because the route is fully functional, just unprotected \u2014 attackers can call it directly."}, "properties": {"repobilityId": 215056, "scanner": "repobility-threat-engine", "fingerprint": "90bec330b0e0d626bd897a412bc561396ca5930bc473fb21cfb755e8bf7f6380", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "@router.post(\"/invite-link\")\ndef create_invite_link(\n    current: User = Depends(get_current_user)", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC135", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|90bec330b0e0d626bd897a412bc561396ca5930bc473fb21cfb755e8bf7f6380"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/routers/connections.py"}, "region": {"startLine": 85}}}]}, {"ruleId": "SEC135", "level": "error", "message": {"text": "[SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint generated by an AI agent without an auth decorator or middleware. The number-one production-incident pattern we see in AI-generated SaaS code: the AI builds the route, builds the handler, and forgets to wire the auth check that the rest of the codebase uses. CWE-862 (missing authorization). High-severity because the route is fully functional, just unprotected \u2014 attackers can call it directly."}, "properties": {"repobilityId": 215055, "scanner": "repobility-threat-engine", "fingerprint": "1e14611cf0e3a3a65d23d0ef5fa3da377d2fd53fab565c46bfe9856627f991c2", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "@router.post(\"/token\")\ndef create_token(\n    current: User = Depends(get_current_user)", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC135", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|1e14611cf0e3a3a65d23d0ef5fa3da377d2fd53fab565c46bfe9856627f991c2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/routers/calendar.py"}, "region": {"startLine": 39}}}]}, {"ruleId": "SEC135", "level": "error", "message": {"text": "[SEC135] Auth/permission check missing on AI-generated endpoint: Mutating HTTP endpoint generated by an AI agent without an auth decorator or middleware. The number-one production-incident pattern we see in AI-generated SaaS code: the AI builds the route, builds the handler, and forgets to wire the auth check that the rest of the codebase uses. CWE-862 (missing authorization). High-severity because the route is fully functional, just unprotected \u2014 attackers can call it directly."}, "properties": {"repobilityId": 215054, "scanner": "repobility-threat-engine", "fingerprint": "50fd4f24e9b33f03d29f5404a6a3f6b2b1a5761c42350002ca24f471eee0473f", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "@router.post(\"/reset-password\")\ndef reset_password(payload: ResetPasswordIn, db: Session = Depends(g", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC135", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|50fd4f24e9b33f03d29f5404a6a3f6b2b1a5761c42350002ca24f471eee0473f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/routers/auth.py"}, "region": {"startLine": 138}}}]}, {"ruleId": "SEC128", "level": "error", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes \u2014 DB writes lost, emails not sent, race conditions. This is one of the top-3 errors AI coders make: they understand async-shape but drop the await keyword when chaining multiple ops. Surfaces as flaky tests or silently dropped data in production."}, "properties": {"repobilityId": 215042, "scanner": "repobility-threat-engine", "fingerprint": "d9595540e0bbf0f55c23108f41c96470226c62afc18ece4630d379e1ad38f908", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "db.delete(note)", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|d9595540e0bbf0f55c23108f41c96470226c62afc18ece4630d379e1ad38f908"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/routers/notes.py"}, "region": {"startLine": 78}}}]}, {"ruleId": "SEC128", "level": "error", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes \u2014 DB writes lost, emails not sent, race conditions. This is one of the top-3 errors AI coders make: they understand async-shape but drop the await keyword when chaining multiple ops. Surfaces as flaky tests or silently dropped data in production."}, "properties": {"repobilityId": 215041, "scanner": "repobility-threat-engine", "fingerprint": "67cf5dd51bafc561d02609eae055e7eba686962cecae90d34303e110a3d8065f", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "db.delete(conn)", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|67cf5dd51bafc561d02609eae055e7eba686962cecae90d34303e110a3d8065f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/routers/connections.py"}, "region": {"startLine": 230}}}]}, {"ruleId": "SEC128", "level": "error", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes \u2014 DB writes lost, emails not sent, race conditions. This is one of the top-3 errors AI coders make: they understand async-shape but drop the await keyword when chaining multiple ops. Surfaces as flaky tests or silently dropped data in production."}, "properties": {"repobilityId": 215040, "scanner": "repobility-threat-engine", "fingerprint": "f4a5ae94509366c651fb3b6fb3539bd47e334f5b23a18570f1320cb61354a36e", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "celery_app.conf.update(\n    task_serializer=\"json\",\n    accept_content=[\"json\"],\n    result_seriali", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|f4a5ae94509366c651fb3b6fb3539bd47e334f5b23a18570f1320cb61354a36e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/celery_app.py"}, "region": {"startLine": 11}}}]}, {"ruleId": "MINED118", "level": "error", "message": {"text": "Dockerfile FROM `python:3.12-slim` not pinned by digest"}, "properties": {"repobilityId": 215024, "scanner": "repobility-supply-chain", "fingerprint": "d92b1e0919a50657de21b9a1c5c9228bc6dbdfc3e6cc05595a7682d9ccb52537", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|d92b1e0919a50657de21b9a1c5c9228bc6dbdfc3e6cc05595a7682d9ccb52537"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "MINED118", "level": "error", "message": {"text": "Dockerfile FROM `nginx:1.27-alpine` not pinned by digest"}, "properties": {"repobilityId": 215023, "scanner": "repobility-supply-chain", "fingerprint": "95a47e4089087c773ea314a238d6afc853637e62a6c2b5a188674441dde642bf", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|95a47e4089087c773ea314a238d6afc853637e62a6c2b5a188674441dde642bf"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "front/Dockerfile"}, "region": {"startLine": 7}}}]}, {"ruleId": "MINED118", "level": "error", "message": {"text": "Dockerfile FROM `node:20-alpine` not pinned by digest"}, "properties": {"repobilityId": 215022, "scanner": "repobility-supply-chain", "fingerprint": "c02263e9ef0bf47069b619ee4a8ff58536f680b316cd8ad395cca32b3f65540c", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|c02263e9ef0bf47069b619ee4a8ff58536f680b316cd8ad395cca32b3f65540c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "front/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "CORE_NO_TESTS", "level": "error", "message": {"text": "No test files found"}, "properties": {"repobilityId": 215017, "scanner": "repobility-core", "fingerprint": "0200e9918bc2a7bf9c116d0907e50ac3df640c758b93852cf1890ec6e14d870d", "category": "testing", "severity": "high", "confidence": null, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"rule_id": "CORE_NO_TESTS", "scanner": "repobility-core", "correlation_key": "repo|testing|core_no_tests"}}}, {"ruleId": "GHSA-vqfr-h8mv-ghfj", "level": "error", "message": {"text": "h11: GHSA-vqfr-h8mv-ghfj"}, "properties": {"repobilityId": 215102, "scanner": "osv-scanner", "fingerprint": "4b2c1562abb014a1efe6cbcbbaeb0343f0d31a685e1fde050b4ec0e4436dafe9", "category": "dependency", "severity": "critical", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2025-43859"], "package": "h11", "rule_id": "GHSA-vqfr-h8mv-ghfj", "scanner": "osv-scanner", "correlation_key": "vuln|h11|CVE-2025-43859|api/requirements.txt"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-8qxj-f9rh-9fg2", "level": "error", "message": {"text": "ecdsa: GHSA-8qxj-f9rh-9fg2"}, "properties": {"repobilityId": 215099, "scanner": "osv-scanner", "fingerprint": "f1899923b0d86b50727e6f3c80f7fd6850e0dce47374c0d87efa175cb24e2ba3", "category": "dependency", "severity": "critical", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "Collapsed 1 duplicate scanner signal(s) for the same underlying issue.", "evidence": {"match": "", "aliases": ["CVE-2019-14859", "PYSEC-2020-163"], "package": "ecdsa", "rule_id": "GHSA-8qxj-f9rh-9fg2", "scanner": "osv-scanner", "correlation_key": "vuln|ecdsa|CVE-2019-14859|api/requirements.txt", "duplicate_count": 1, "duplicate_rule_ids": ["GHSA-8qxj-f9rh-9fg2", "PYSEC-2020-163"], "duplicate_scanners": ["osv-scanner"], "duplicate_fingerprints": ["88c2eb1641c87f992c61fa8b5bad0682ecad91a14c087d03192a02221b553b4f", "f1899923b0d86b50727e6f3c80f7fd6850e0dce47374c0d87efa175cb24e2ba3"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "GHSA-6c5p-j8vq-pqhj", "level": "error", "message": {"text": "python-jose: GHSA-6c5p-j8vq-pqhj"}, "properties": {"repobilityId": 215093, "scanner": "osv-scanner", "fingerprint": "47b4a7b820cc8e2ed9d497c1c49f35ad013ba0b95041a5d5fe53884191e50135", "category": "dependency", "severity": "critical", "confidence": 0.88, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"match": "", "aliases": ["CVE-2024-33663", "PYSEC-2024-232"], "package": "python-jose", "rule_id": "GHSA-6c5p-j8vq-pqhj", "scanner": "osv-scanner", "correlation_key": "vuln|python-jose|CVE-2024-33663|api/requirements.txt"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "DKC007", "level": "error", "message": {"text": "Compose service contains a literal secret environment value"}, "properties": {"repobilityId": 215070, "scanner": "repobility-docker", "fingerprint": "2a6608f39d04c4c39bf66fc97ccb5980b067c76ef8f8667ae5bc945202db0e89", "category": "docker", "severity": "critical", "confidence": 0.96, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Environment variable name is secret-like and value is a committed literal.", "evidence": {"rule_id": "DKC007", "scanner": "repobility-docker", "service": "postgres", "variable": "POSTGRES_PASSWORD", "references": ["https://docs.docker.com/compose/how-tos/environment-variables/best-practices/", "https://docs.docker.com/reference/compose-file/secrets/"], "path_context": "runtime", "correlation_key": "fp|2a6608f39d04c4c39bf66fc97ccb5980b067c76ef8f8667ae5bc945202db0e89", "compose_secrets_declared": false}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 3}}}]}, {"ruleId": "MINED107", "level": "error", "message": {"text": "Missing import: `email` used but not imported"}, "properties": {"repobilityId": 215021, "scanner": "repobility-ast-engine", "fingerprint": "9ed53d906e9e213a119ad90edaa523089d449e75d6b2d61fbaa1ebc6e50439d0", "category": "quality", "severity": "critical", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "missing-import-python", "owasp": "A06:2021", "cwe_ids": ["CWE-1075"], "languages": ["python"], "observations_count": 2192}, "scanner": "repobility-ast-engine", "correlation_key": "fp|9ed53d906e9e213a119ad90edaa523089d449e75d6b2d61fbaa1ebc6e50439d0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/app/routers/users.py"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-506be2b95088f5d3", "level": "none", "message": {"text": "git log failed \u2014 history analysis incomplete"}, "properties": {"repobilityId": "b424308a11bb9b22", "scanner": "scanner-primary", "fingerprint": "506be2b95088f5d3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["git", "tooling"]}}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}]}]}