{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-bead75b0f9233e05", "name": "No API endpoints detected", "shortDescription": {"text": "No API endpoints detected"}, "fullDescription": {"text": "The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ed228fb43c503b35", "name": "Stray `console.log` in TS/JS \u2014 server.js:35", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server.js:35"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b377e5ac6ae37fe7", "name": "Stray `console.log` in TS/JS \u2014 scripts/import-old-html.ts:243", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/import-old-html.ts:243"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f5032be53b77254d", "name": "Stray `console.log` in TS/JS \u2014 scripts/build-data.ts:204", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/build-data.ts:204"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aaa43896bcdb9c78", "name": "Stray `console.log` in TS/JS \u2014 scripts/build-icons.js:32", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/build-icons.js:32"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-07c5858c5a0a2334", "name": "Stray `console.log` in TS/JS \u2014 scripts/import-google-csv.ts:239", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/import-google-csv.ts:239"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-606b267543062df3", "name": "Stray `console.log` in TS/JS \u2014 scripts/run-build.js:23", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/run-build.js:23"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-88159901705f9de5", "name": "Stray `console.log` in TS/JS \u2014 scripts/build-search-index.ts:77", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/build-search-index.ts:77"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f3b40af2f9bdb991", "name": "Stray `console.log` in TS/JS \u2014 scripts/clean-chain-restaurants.ts:27", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/clean-chain-restaurants.ts:27"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b6753e382d1a4166", "name": "`truncate` class without `title=` for hover reveal \u2014 components/CityCard.tsx:67", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 components/CityCard.tsx:67"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4bb59f02f8f9e668", "name": "`truncate` class without `title=` for hover reveal \u2014 components/TruckCard.tsx:97", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 components/TruckCard.tsx:97"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-823760a09f462d0d", "name": "`truncate` class without `title=` for hover reveal \u2014 components/auth/UserMenu.tsx:63", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 components/auth/UserMenu.tsx:63"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bec4c3dd031836af", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 app/blog/[slug]/page.tsx:71", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 app/blog/[slug]/page.tsx:71"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6927cf4818187d4a", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 app/for-trucks/faq/page.tsx:123", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 app/for-trucks/faq/page.tsx:123"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8fdfbdb41a0833a2", "name": "`truncate` class without `title=` for hover reveal \u2014 app/search/SearchClient.tsx:201", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 app/search/SearchClient.tsx:201"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-525e4232b00335f6", "name": "`truncate` class without `title=` for hover reveal \u2014 app/search/page.tsx:79", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 app/search/page.tsx:79"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e789a82a8342abcf", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 app/search/page.tsx:42", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 app/search/page.tsx:42"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2260dc00489f710b", "name": "`truncate` class without `title=` for hover reveal \u2014 app/states/[state]/page.tsx:160", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 app/states/[state]/page.tsx:160"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-054ef27753629a31", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 app/states/[state]/page.tsx:58", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 app/states/[state]/page.tsx:58"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6ee13d52ff5eba0b", "name": "`truncate` class without `title=` for hover reveal \u2014 app/states/[state]/[city]/page.tsx:116", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 app/states/[state]/[city]/page.tsx:116"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-17caf9af4cc2ffba", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 app/states/[state]/[city]/page.tsx:63", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 app/states/[state]/[city]/page.tsx:63"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7d48d1ef83655c91", "name": "`truncate` class without `title=` for hover reveal \u2014 app/catering/page.tsx:103", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 app/catering/page.tsx:103"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-13536d0e117eb14c", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 app/catering/page.tsx:35", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 app/catering/page.tsx:35"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c067276c77654ae7", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 app/catering/[city]/page.tsx:51", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 app/catering/[city]/page.tsx:51"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c72f511096ef876f", "name": "`truncate` class without `title=` for hover reveal \u2014 app/truck/[slug]/page.tsx:138", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 app/truck/[slug]/page.tsx:138"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-91a2fa45ba7bf560", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 app/truck/[slug]/page.tsx:125", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 app/truck/[slug]/page.tsx:125"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d6d59bbba3323542", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 app/cuisines/[type]/page.tsx:50", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 app/cuisines/[type]/page.tsx:50"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e7cf78ceb29c97b3", "name": "`truncate` class without `title=` for hover reveal \u2014 app/owner/OwnerDashboard.tsx:145", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 app/owner/OwnerDashboard.tsx:145"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4d4a5267ed17c571", "name": "`truncate` class without `title=` for hover reveal \u2014 lib/blog/state-of-american-food-trucks-2026.tsx:10", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 lib/blog/state-of-american-food-trucks-2026.tsx:10"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-71b21d3238467133", "name": "Privileged port 13 in use", "shortDescription": {"text": "Privileged port 13 in use"}, "fullDescription": {"text": "Port 13 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f5ae98d8757e5f80", "name": "Insecure pattern 'node_child_process' in scripts/status.mjs:7", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/status.mjs:7"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-745f7a23ce4e47a6", "name": "Insecure pattern 'dangerous_innerhtml' in app/blog/[slug]/page.tsx:71", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in app/blog/[slug]/page.tsx:71"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d1930d9465a3f59d", "name": "Insecure pattern 'dangerous_innerhtml' in app/for-trucks/faq/page.tsx:123", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in app/for-trucks/faq/page.tsx:123"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8fadea2d6f37cfb8", "name": "Insecure pattern 'dangerous_innerhtml' in app/search/page.tsx:42", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in app/search/page.tsx:42"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bec6e722adf4cca8", "name": "Insecure pattern 'dangerous_innerhtml' in app/states/[state]/page.tsx:58", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in app/states/[state]/page.tsx:58"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e5eaeb664e6a72a6", "name": "Insecure pattern 'dangerous_innerhtml' in app/states/[state]/[city]/page.tsx:63", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in app/states/[state]/[city]/page.tsx:63"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-acc014c8156d36c3", "name": "Insecure pattern 'dangerous_innerhtml' in app/catering/page.tsx:35", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in app/catering/page.tsx:35"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9a653117606eb16", "name": "Insecure pattern 'dangerous_innerhtml' in app/catering/[city]/page.tsx:51", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in app/catering/[city]/page.tsx:51"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-79f2d9418d4dd561", "name": "Insecure pattern 'dangerous_innerhtml' in app/truck/[slug]/page.tsx:125", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in app/truck/[slug]/page.tsx:125"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e1de9a166471c35f", "name": "Insecure pattern 'dangerous_innerhtml' in app/cuisines/[type]/page.tsx:50", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in app/cuisines/[type]/page.tsx:50"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 116 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 119 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 54 placeholder/mock markers across 13 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, tests. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c5f98b152cddb6d", "name": "Agent authority lacks a verifier contract: .claude/launch.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/launch.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e777090d1a519c37", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/migrate-photos-to-r2.mjs:100", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/migrate-photos-to-r2.mjs:100"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1cf71db38fecdcf2", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/optimize-hero.mjs:37", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/optimize-hero.mjs:37"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0e34ba6c26922b93", "name": "Commented-code block (5 lines) in components/Hero.tsx:1", "shortDescription": {"text": "Commented-code block (5 lines) in components/Hero.tsx:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-41628db1748c6bed", "name": "`fetch()` without try/.catch or AbortSignal \u2014 app/search/SearchClient.tsx:63", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/search/SearchClient.tsx:63"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0d05a05d9c10fbfb", "name": "Commented-code block (5 lines) in app/states/[state]/[city]/page.tsx:40", "shortDescription": {"text": "Commented-code block (5 lines) in app/states/[state]/[city]/page.tsx:40"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d5b3463c449a327f", "name": "Commented-code block (5 lines) in app/truck/[slug]/page.tsx:65", "shortDescription": {"text": "Commented-code block (5 lines) in app/truck/[slug]/page.tsx:65"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-88fdd169b806dcdb", "name": "Commented-code block (5 lines) in supabase/functions/notify-submission/index.ts:6", "shortDescription": {"text": "Commented-code block (5 lines) in supabase/functions/notify-submission/index.ts:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c1f9ad4080bb580c", "name": "`fetch()` without try/.catch or AbortSignal \u2014 supabase/functions/notify-submission/index.ts:108", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 supabase/functions/notify-submission/index.ts:108"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3482f7e5dd70cd1a", "name": "6 env vars used in code but missing from .env.example", "shortDescription": {"text": "6 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `BIND_HOST`, `BUILD_NODE`, `NEXT_PUBLIC_ADSENSE_CLIENT`, `NEXT_PUBLIC_GA_ID`, `NODE_ENV`, `PORT`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20430"}, "properties": {"repository": "subhocreative111-bit/Food-Truck", "repoUrl": "https://github.com/subhocreative111-bit/Food-Truck", "branch": "main"}, "results": [{"ruleId": "scanner-bead75b0f9233e05", "level": "none", "message": {"text": "No API endpoints detected"}, "properties": {"repobilityId": "0f8bb852027c38f8", "scanner": "scanner-primary", "fingerprint": "bead75b0f9233e05", "layer": "api", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-ed228fb43c503b35", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server.js:35"}, "properties": {"repobilityId": "a9deebb5fdc93edc", "scanner": "scanner-primary", "fingerprint": "ed228fb43c503b35", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b377e5ac6ae37fe7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/import-old-html.ts:243"}, "properties": {"repobilityId": "7ecc1e71ff32ae4b", "scanner": "scanner-primary", "fingerprint": "b377e5ac6ae37fe7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f5032be53b77254d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/build-data.ts:204"}, "properties": {"repobilityId": "6e09882d4e1ad73f", "scanner": "scanner-primary", "fingerprint": "f5032be53b77254d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-aaa43896bcdb9c78", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/build-icons.js:32"}, "properties": {"repobilityId": "f9118e1692391a32", "scanner": "scanner-primary", "fingerprint": "aaa43896bcdb9c78", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-07c5858c5a0a2334", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/import-google-csv.ts:239"}, "properties": {"repobilityId": "4ceac5693ce62c6d", "scanner": "scanner-primary", "fingerprint": "07c5858c5a0a2334", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-606b267543062df3", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/run-build.js:23"}, "properties": {"repobilityId": "e777eb0e17d71982", "scanner": "scanner-primary", "fingerprint": "606b267543062df3", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-88159901705f9de5", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/build-search-index.ts:77"}, "properties": {"repobilityId": "263cf97e4f292e26", "scanner": "scanner-primary", "fingerprint": "88159901705f9de5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f3b40af2f9bdb991", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/clean-chain-restaurants.ts:27"}, "properties": {"repobilityId": "f105ddf109b9aa2c", "scanner": "scanner-primary", "fingerprint": "f3b40af2f9bdb991", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b6753e382d1a4166", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 components/CityCard.tsx:67"}, "properties": {"repobilityId": "e55ac976358ab67d", "scanner": "scanner-primary", "fingerprint": "b6753e382d1a4166", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-4bb59f02f8f9e668", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 components/TruckCard.tsx:97"}, "properties": {"repobilityId": "b9eb70bca23055ac", "scanner": "scanner-primary", "fingerprint": "4bb59f02f8f9e668", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-823760a09f462d0d", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 components/auth/UserMenu.tsx:63"}, "properties": {"repobilityId": "b5a928e704ceb177", "scanner": "scanner-primary", "fingerprint": "823760a09f462d0d", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-bec4c3dd031836af", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 app/blog/[slug]/page.tsx:71"}, "properties": {"repobilityId": "c21e1247bf006285", "scanner": "scanner-primary", "fingerprint": "bec4c3dd031836af", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-6927cf4818187d4a", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 app/for-trucks/faq/page.tsx:123"}, "properties": {"repobilityId": "d85d4b569e3821f1", "scanner": "scanner-primary", "fingerprint": "6927cf4818187d4a", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-8fdfbdb41a0833a2", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 app/search/SearchClient.tsx:201"}, "properties": {"repobilityId": "1b1082dd0ee0fd3e", "scanner": "scanner-primary", "fingerprint": "8fdfbdb41a0833a2", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-525e4232b00335f6", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 app/search/page.tsx:79"}, "properties": {"repobilityId": "0834611bd62ef655", "scanner": "scanner-primary", "fingerprint": "525e4232b00335f6", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-e789a82a8342abcf", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 app/search/page.tsx:42"}, "properties": {"repobilityId": "7c37bc0c65c4edf3", "scanner": "scanner-primary", "fingerprint": "e789a82a8342abcf", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-2260dc00489f710b", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 app/states/[state]/page.tsx:160"}, "properties": {"repobilityId": "3ffac6311bdb6d66", "scanner": "scanner-primary", "fingerprint": "2260dc00489f710b", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-054ef27753629a31", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 app/states/[state]/page.tsx:58"}, "properties": {"repobilityId": "d588a2c6682fd698", "scanner": "scanner-primary", "fingerprint": "054ef27753629a31", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-6ee13d52ff5eba0b", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 app/states/[state]/[city]/page.tsx:116"}, "properties": {"repobilityId": "50feb3d2eec65db5", "scanner": "scanner-primary", "fingerprint": "6ee13d52ff5eba0b", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-17caf9af4cc2ffba", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 app/states/[state]/[city]/page.tsx:63"}, "properties": {"repobilityId": "ef10dc3dbfd98986", "scanner": "scanner-primary", "fingerprint": "17caf9af4cc2ffba", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-7d48d1ef83655c91", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 app/catering/page.tsx:103"}, "properties": {"repobilityId": "47a54f8998896581", "scanner": "scanner-primary", "fingerprint": "7d48d1ef83655c91", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-13536d0e117eb14c", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 app/catering/page.tsx:35"}, "properties": {"repobilityId": "0cd56ec1fcceaf84", "scanner": "scanner-primary", "fingerprint": "13536d0e117eb14c", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-c067276c77654ae7", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 app/catering/[city]/page.tsx:51"}, "properties": {"repobilityId": "90d1e0d6e9d58367", "scanner": "scanner-primary", "fingerprint": "c067276c77654ae7", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-c72f511096ef876f", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 app/truck/[slug]/page.tsx:138"}, "properties": {"repobilityId": "615dda4d8f70d0ed", "scanner": "scanner-primary", "fingerprint": "c72f511096ef876f", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-91a2fa45ba7bf560", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 app/truck/[slug]/page.tsx:125"}, "properties": {"repobilityId": "8120c47b0ea7dc3a", "scanner": "scanner-primary", "fingerprint": "91a2fa45ba7bf560", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-d6d59bbba3323542", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 app/cuisines/[type]/page.tsx:50"}, "properties": {"repobilityId": "b8cbcbd09288b39b", "scanner": "scanner-primary", "fingerprint": "d6d59bbba3323542", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-e7cf78ceb29c97b3", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 app/owner/OwnerDashboard.tsx:145"}, "properties": {"repobilityId": "6bab5b3def5818ad", "scanner": "scanner-primary", "fingerprint": "e7cf78ceb29c97b3", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-4d4a5267ed17c571", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 lib/blog/state-of-american-food-trucks-2026.tsx:10"}, "properties": {"repobilityId": "319d77a0b02af2cc", "scanner": "scanner-primary", "fingerprint": "4d4a5267ed17c571", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-71b21d3238467133", "level": "warning", "message": {"text": "Privileged port 13 in use"}, "properties": {"repobilityId": "79d721e4d6f64798", "scanner": "scanner-primary", "fingerprint": "71b21d3238467133", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/supabase-keepalive.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f5ae98d8757e5f80", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/status.mjs:7"}, "properties": {"repobilityId": "45589690924646be", "scanner": "scanner-primary", "fingerprint": "f5ae98d8757e5f80", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/status.mjs"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-745f7a23ce4e47a6", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in app/blog/[slug]/page.tsx:71"}, "properties": {"repobilityId": "9c6991e1f0c5c6d8", "scanner": "scanner-primary", "fingerprint": "745f7a23ce4e47a6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/blog/[slug]/page.tsx"}, "region": {"startLine": 71}}}]}, {"ruleId": "scanner-d1930d9465a3f59d", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in app/for-trucks/faq/page.tsx:123"}, "properties": {"repobilityId": "a75d1a1e85098503", "scanner": "scanner-primary", "fingerprint": "d1930d9465a3f59d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/for-trucks/faq/page.tsx"}, "region": {"startLine": 123}}}]}, {"ruleId": "scanner-8fadea2d6f37cfb8", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in app/search/page.tsx:42"}, "properties": {"repobilityId": "0818292a27654b0d", "scanner": "scanner-primary", "fingerprint": "8fadea2d6f37cfb8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/search/page.tsx"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-bec6e722adf4cca8", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in app/states/[state]/page.tsx:58"}, "properties": {"repobilityId": "65028883460cbf36", "scanner": "scanner-primary", "fingerprint": "bec6e722adf4cca8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/states/[state]/page.tsx"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-e5eaeb664e6a72a6", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in app/states/[state]/[city]/page.tsx:63"}, "properties": {"repobilityId": "a6fb05db7c56b22c", "scanner": "scanner-primary", "fingerprint": "e5eaeb664e6a72a6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/states/[state]/[city]/page.tsx"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-acc014c8156d36c3", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in app/catering/page.tsx:35"}, "properties": {"repobilityId": "81238e9693be24ca", "scanner": "scanner-primary", "fingerprint": "acc014c8156d36c3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/catering/page.tsx"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-b9a653117606eb16", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in app/catering/[city]/page.tsx:51"}, "properties": {"repobilityId": "afff99da55124448", "scanner": "scanner-primary", "fingerprint": "b9a653117606eb16", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/catering/[city]/page.tsx"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-79f2d9418d4dd561", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in app/truck/[slug]/page.tsx:125"}, "properties": {"repobilityId": "8b8dcfa5b34592f1", "scanner": "scanner-primary", "fingerprint": "79f2d9418d4dd561", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/truck/[slug]/page.tsx"}, "region": {"startLine": 125}}}]}, {"ruleId": "scanner-e1de9a166471c35f", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in app/cuisines/[type]/page.tsx:50"}, "properties": {"repobilityId": "c6e14bcea9c99f2e", "scanner": "scanner-primary", "fingerprint": "e1de9a166471c35f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/cuisines/[type]/page.tsx"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "ad73d1217672a3e7", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "83cf0226bbe19217", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "ce20f20fd459796a", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "c712bb74f21a1845", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "4f8d688876fece16", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "6fba67d692610af6", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "519162b2f89d867d", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "527a5f7518af550e", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "f70a444969976b13", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-2c5f98b152cddb6d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/launch.json"}, "properties": {"repobilityId": "0de48c0f4ab303d8", "scanner": "scanner-primary", "fingerprint": "2c5f98b152cddb6d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/launch.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e777090d1a519c37", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/migrate-photos-to-r2.mjs:100"}, "properties": {"repobilityId": "70a33bc12a739ba2", "scanner": "scanner-primary", "fingerprint": "e777090d1a519c37", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1cf71db38fecdcf2", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/optimize-hero.mjs:37"}, "properties": {"repobilityId": "6f26492731e9d7ed", "scanner": "scanner-primary", "fingerprint": "1cf71db38fecdcf2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0e34ba6c26922b93", "level": "none", "message": {"text": "Commented-code block (5 lines) in components/Hero.tsx:1"}, "properties": {"repobilityId": "fb10867d95fbe9b8", "scanner": "scanner-primary", "fingerprint": "0e34ba6c26922b93", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-41628db1748c6bed", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/search/SearchClient.tsx:63"}, "properties": {"repobilityId": "12156940917c3efc", "scanner": "scanner-primary", "fingerprint": "41628db1748c6bed", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0d05a05d9c10fbfb", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/states/[state]/[city]/page.tsx:40"}, "properties": {"repobilityId": "cd01cdf8b77fe136", "scanner": "scanner-primary", "fingerprint": "0d05a05d9c10fbfb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d5b3463c449a327f", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/truck/[slug]/page.tsx:65"}, "properties": {"repobilityId": "e76be08c52f6dbad", "scanner": "scanner-primary", "fingerprint": "d5b3463c449a327f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-88fdd169b806dcdb", "level": "none", "message": {"text": "Commented-code block (5 lines) in supabase/functions/notify-submission/index.ts:6"}, "properties": {"repobilityId": "22dff972f60e9aa6", "scanner": "scanner-primary", "fingerprint": "88fdd169b806dcdb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c1f9ad4080bb580c", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 supabase/functions/notify-submission/index.ts:108"}, "properties": {"repobilityId": "c0fef14f00707e3f", "scanner": "scanner-primary", "fingerprint": "c1f9ad4080bb580c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3482f7e5dd70cd1a", "level": "note", "message": {"text": "6 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "1da70f25aa46f6e9", "scanner": "scanner-primary", "fingerprint": "3482f7e5dd70cd1a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}]}]}