{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-184b7f8e172a8db0", "name": "potential dos via decompression bomb \u2014 src/compress/compress.go:49", "shortDescription": {"text": "potential dos via decompression bomb \u2014 src/compress/compress.go:49"}, "fullDescription": {"text": "Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size.\n\nRule: go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-400: Uncontrolled Resource Consumption\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bf5e0673625bbeb1", "name": "use of unsafe block \u2014 src/diskusage/diskusage_windows.go:24", "shortDescription": {"text": "use of unsafe block \u2014 src/diskusage/diskusage_windows.go:24"}, "fullDescription": {"text": "Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing.\n\nRule: go.lang.security.audit.unsafe.use-of-unsafe-block\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-242: Use of Inherently Dangerous Function\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b7c9eea3c809e285", "name": "use of unsafe block \u2014 src/diskusage/diskusage_windows.go:25", "shortDescription": {"text": "use of unsafe block \u2014 src/diskusage/diskusage_windows.go:25"}, "fullDescription": {"text": "Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing.\n\nRule: go.lang.security.audit.unsafe.use-of-unsafe-block\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-242: Use of Inherently Dangerous Function\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ddf3f647503eb8df", "name": "use of unsafe block \u2014 src/diskusage/diskusage_windows.go:26", "shortDescription": {"text": "use of unsafe block \u2014 src/diskusage/diskusage_windows.go:26"}, "fullDescription": {"text": "Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing.\n\nRule: go.lang.security.audit.unsafe.use-of-unsafe-block\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-242: Use of Inherently Dangerous Function\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-987146ac69d0f181", "name": "use of unsafe block \u2014 src/diskusage/diskusage_windows.go:27", "shortDescription": {"text": "use of unsafe block \u2014 src/diskusage/diskusage_windows.go:27"}, "fullDescription": {"text": "Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing.\n\nRule: go.lang.security.audit.unsafe.use-of-unsafe-block\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-242: Use of Inherently Dangerous Function\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b588f4eb71079fd6", "name": "use of md5 \u2014 src/utils/ctx.go:213", "shortDescription": {"text": "use of md5 \u2014 src/utils/ctx.go:213"}, "fullDescription": {"text": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\nRule: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5\nSeverity: WARNING\nOWASP: A03:2017 - Sensitive Data Exposure, A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-328: Use of Weak Hash\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ebfaec4e065391d1", "name": "use of md5 \u2014 src/utils/utils.go:183", "shortDescription": {"text": "use of md5 \u2014 src/utils/utils.go:183"}, "fullDescription": {"text": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\nRule: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5\nSeverity: WARNING\nOWASP: A03:2017 - Sensitive Data Exposure, A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-328: Use of Weak Hash\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-45bd5dea9cd51ffa", "name": "potential dos via decompression bomb \u2014 src/utils/utils.go:820", "shortDescription": {"text": "potential dos via decompression bomb \u2014 src/utils/utils.go:820"}, "fullDescription": {"text": "Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size.\n\nRule: go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-400: Uncontrolled Resource Consumption\nCategory: security"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a8705a54c1c99b0a", "name": "GO-2026-5932: golang.org/x/crypto v0.54.0 \u2014 go.mod", "shortDescription": {"text": "GO-2026-5932: golang.org/x/crypto v0.54.0 \u2014 go.mod"}, "fullDescription": {"text": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues\n\nThe golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.\n\nPackage: golang.org/x/crypto\nInstalled: v0.54.0\nFixed in: \u2014\nSeverity: UNKNOWN\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-06b2c99d6a4a1501", "name": "DS-0001: ':latest' tag used \u2014 Dockerfile", "shortDescription": {"text": "DS-0001: ':latest' tag used \u2014 Dockerfile"}, "fullDescription": {"text": "':latest' tag used\n\nSpecify a tag in the 'FROM' statement for image 'alpine'\n\nRule: DS-0001\nSeverity: MEDIUM\nTarget: Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a54b48b57be9fe84", "name": "Privileged port 64 in use", "shortDescription": {"text": "Privileged port 64 in use"}, "fullDescription": {"text": "Port 64 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f7077e072ad38944", "name": "Privileged port 386 in use", "shortDescription": {"text": "Privileged port 386 in use"}, "fullDescription": {"text": "Port 386 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0888c558af6445d0", "name": "Privileged port 32 in use", "shortDescription": {"text": "Privileged port 32 in use"}, "fullDescription": {"text": "Port 32 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-86f709d148d54907", "name": "Docker base image is tag-pinned but not digest-pinned: golang:1.25-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: golang:1.25-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e39ae4bfd993828d", "name": "Docker base image uses a mutable or implicit tag: alpine:latest", "shortDescription": {"text": "Docker base image uses a mutable or implicit tag: alpine:latest"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-64ede90b9fc7d48b", "name": "Insecure pattern 'weak_hash' in src/utils/utils_test.go:847", "shortDescription": {"text": "Insecure pattern 'weak_hash' in src/utils/utils_test.go:847"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-28c4a04bd807da0c", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-77c35aa7cb98a5e2", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "vedantmgoyal9/winget-releaser@v2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4cb21838d560719d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/stale@v10 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ccc6437634cbae85", "name": "Very large file: src/croc/croc.go (3031 lines)", "shortDescription": {"text": "Very large file: src/croc/croc.go (3031 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27898758ba926f7e", "name": "Very large file: src/croc/croc_test.go (2336 lines)", "shortDescription": {"text": "Very large file: src/croc/croc_test.go (2336 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/30742"}, "properties": {"repository": "schollz/croc", "repoUrl": "https://github.com/schollz/croc", "branch": "main"}, "results": [{"ruleId": "scanner-184b7f8e172a8db0", "level": "warning", "message": {"text": "potential dos via decompression bomb \u2014 src/compress/compress.go:49"}, "properties": {"repobilityId": "b2f5c9ddf09f7094", "scanner": "scanner-primary", "fingerprint": "184b7f8e172a8db0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["semgrep", "security", "go"]}}, {"ruleId": "scanner-bf5e0673625bbeb1", "level": "warning", "message": {"text": "use of unsafe block \u2014 src/diskusage/diskusage_windows.go:24"}, "properties": {"repobilityId": "88bad2b57fdc939f", "scanner": "scanner-primary", "fingerprint": "bf5e0673625bbeb1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["semgrep", "security", "go"]}}, {"ruleId": "scanner-b7c9eea3c809e285", "level": "warning", "message": {"text": "use of unsafe block \u2014 src/diskusage/diskusage_windows.go:25"}, "properties": {"repobilityId": "07e075551b5f6482", "scanner": "scanner-primary", "fingerprint": "b7c9eea3c809e285", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["semgrep", "security", "go"]}}, {"ruleId": "scanner-ddf3f647503eb8df", "level": "warning", "message": {"text": "use of unsafe block \u2014 src/diskusage/diskusage_windows.go:26"}, "properties": {"repobilityId": "148ece96c7a8605f", "scanner": "scanner-primary", "fingerprint": "ddf3f647503eb8df", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["semgrep", "security", "go"]}}, {"ruleId": "scanner-987146ac69d0f181", "level": "warning", "message": {"text": "use of unsafe block \u2014 src/diskusage/diskusage_windows.go:27"}, "properties": {"repobilityId": "fc814f0585095810", "scanner": "scanner-primary", "fingerprint": "987146ac69d0f181", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["semgrep", "security", "go"]}}, {"ruleId": "scanner-b588f4eb71079fd6", "level": "warning", "message": {"text": "use of md5 \u2014 src/utils/ctx.go:213"}, "properties": {"repobilityId": "ee21fa315096105e", "scanner": "scanner-primary", "fingerprint": "b588f4eb71079fd6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["semgrep", "security", "go"]}}, {"ruleId": "scanner-ebfaec4e065391d1", "level": "warning", "message": {"text": "use of md5 \u2014 src/utils/utils.go:183"}, "properties": {"repobilityId": "44d79ce5e17e2d61", "scanner": "scanner-primary", "fingerprint": "ebfaec4e065391d1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["semgrep", "security", "go"]}}, {"ruleId": "scanner-45bd5dea9cd51ffa", "level": "warning", "message": {"text": "potential dos via decompression bomb \u2014 src/utils/utils.go:820"}, "properties": {"repobilityId": "5bc3ec320d9ef2f0", "scanner": "scanner-primary", "fingerprint": "45bd5dea9cd51ffa", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["semgrep", "security", "go"]}}, {"ruleId": "scanner-a8705a54c1c99b0a", "level": "none", "message": {"text": "GO-2026-5932: golang.org/x/crypto v0.54.0 \u2014 go.mod"}, "properties": {"repobilityId": "9ab423b7433b5541", "scanner": "scanner-primary", "fingerprint": "a8705a54c1c99b0a", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["trivy", "vuln", "GO-2026-5932"]}}, {"ruleId": "scanner-06b2c99d6a4a1501", "level": "warning", "message": {"text": "DS-0001: ':latest' tag used \u2014 Dockerfile"}, "properties": {"repobilityId": "b1709ca12858d701", "scanner": "scanner-primary", "fingerprint": "06b2c99d6a4a1501", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-a54b48b57be9fe84", "level": "warning", "message": {"text": "Privileged port 64 in use"}, "properties": {"repobilityId": "be19cd18e8b66910", "scanner": "scanner-primary", "fingerprint": "a54b48b57be9fe84", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".goreleaser.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f7077e072ad38944", "level": "warning", "message": {"text": "Privileged port 386 in use"}, "properties": {"repobilityId": "13325d1090e861dd", "scanner": "scanner-primary", "fingerprint": "f7077e072ad38944", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".goreleaser.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0888c558af6445d0", "level": "warning", "message": {"text": "Privileged port 32 in use"}, "properties": {"repobilityId": "20c0fabc691cdde4", "scanner": "scanner-primary", "fingerprint": "0888c558af6445d0", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".goreleaser.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-86f709d148d54907", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: golang:1.25-alpine"}, "properties": {"repobilityId": "d7d95669377ce14c", "scanner": "scanner-primary", "fingerprint": "86f709d148d54907", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e39ae4bfd993828d", "level": "warning", "message": {"text": "Docker base image uses a mutable or implicit tag: alpine:latest"}, "properties": {"repobilityId": "0bf12f0b0c266049", "scanner": "scanner-primary", "fingerprint": "e39ae4bfd993828d", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-64ede90b9fc7d48b", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in src/utils/utils_test.go:847"}, "properties": {"repobilityId": "6f08fc898edb0eff", "scanner": "scanner-primary", "fingerprint": "64ede90b9fc7d48b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/utils/utils_test.go"}, "region": {"startLine": 847}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-28c4a04bd807da0c", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "722ab4643920a278", "scanner": "scanner-primary", "fingerprint": "28c4a04bd807da0c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy.yml"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "97a9a5de61d82fcd", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-77c35aa7cb98a5e2", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "550b7f90895c9b61", "scanner": "scanner-primary", "fingerprint": "77c35aa7cb98a5e2", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/winget.yml"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "04f6c832d67a7838", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4cb21838d560719d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7146f0ee7830fdc5", "scanner": "scanner-primary", "fingerprint": "4cb21838d560719d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/stale.yml"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-ccc6437634cbae85", "level": "note", "message": {"text": "Very large file: src/croc/croc.go (3031 lines)"}, "properties": {"repobilityId": "4ef33f8800be35ae", "scanner": "scanner-primary", "fingerprint": "ccc6437634cbae85", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-27898758ba926f7e", "level": "note", "message": {"text": "Very large file: src/croc/croc_test.go (2336 lines)"}, "properties": {"repobilityId": "f63bc296e541f6d9", "scanner": "scanner-primary", "fingerprint": "27898758ba926f7e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "929067013aaa0a09", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}]}]}