{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-bead75b0f9233e05", "name": "No API endpoints detected", "shortDescription": {"text": "No API endpoints detected"}, "fullDescription": {"text": "The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e04acccd385be901", "name": "Stray `console.log` in TS/JS \u2014 apps/cli/src/index.ts:347", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/cli/src/index.ts:347"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0652e225ca1f449c", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/components/mermaid.tsx:70", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/components/mermaid.tsx:70"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-07e4a108316823a2", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/components/JsonLd.tsx:27", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/components/JsonLd.tsx:27"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a9288e5d8b3daf88", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/components/svg-items-gallery.tsx:7", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/components/svg-items-gallery.tsx:7"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c17cbca59fc90c78", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/landing/copy-command.tsx:42", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/landing/copy-command.tsx:42"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cd99259ac764caeb", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/mixer/mixer-studio.tsx:150", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/mixer/mixer-studio.tsx:150"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1e85cd964cf279df", "name": "TODO/FIXME marker in shipping code \u2014 apps/web/components/mixer/mixer-studio.tsx:6", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 apps/web/components/mixer/mixer-studio.tsx:6"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-88e69f9c136d22c4", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/components/mixer/mixer-studio.tsx:14", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/components/mixer/mixer-studio.tsx:14"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-624fbd982ed9cb39", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/chrome/chrome-gallery.tsx:197", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/chrome/chrome-gallery.tsx:197"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8f26d9c2ea2d3041", "name": "TODO/FIXME marker in shipping code \u2014 apps/web/components/chrome/chrome-gallery.tsx:15", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 apps/web/components/chrome/chrome-gallery.tsx:15"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-328e9cf8a91f47d9", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/app/(home)/page.tsx:57", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/app/(home)/page.tsx:57"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-20b5d5488f268d63", "name": "TODO/FIXME marker in shipping code \u2014 apps/web/app/mixer/page.tsx:12", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 apps/web/app/mixer/page.tsx:12"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-205eb3835efc8d43", "name": "TODO/FIXME marker in shipping code \u2014 test-template/tests/e2e/chat-checkout.spec.ts:23", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 test-template/tests/e2e/chat-checkout.spec.ts:23"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5dba483d2435284e", "name": "Stray `console.log` in TS/JS \u2014 test-template/prisma/seed.ts:44", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 test-template/prisma/seed.ts:44"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ca9e2325eac963e2", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 test-template/components/JsonLd.tsx:8", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 test-template/components/JsonLd.tsx:8"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e33b61311e0d612f", "name": "`truncate` class without `title=` for hover reveal \u2014 test-template/components/PDPStickyAtcBar.tsx:33", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 test-template/components/PDPStickyAtcBar.tsx:33"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c90c3b9516e4be06", "name": "`truncate` class without `title=` for hover reveal \u2014 test-template/components/voice/VoiceShopOverlay.tsx:485", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 test-template/components/voice/VoiceShopOverlay.tsx:485"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1c421d1c687a1329", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 test-template/app/layout.tsx:49", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 test-template/app/layout.tsx:49"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6d5451c039ba2c44", "name": "TODO/FIXME marker in shipping code \u2014 test-template/app/api/webhook/stripe/route.ts:347", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 test-template/app/api/webhook/stripe/route.ts:347"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4f0f854533706262", "name": "`truncate` class without `title=` for hover reveal \u2014 test-template/app/admin/setup/SetupWizard.tsx:782", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 test-template/app/admin/setup/SetupWizard.tsx:782"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-db1b087ec26c1aad", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 test-template/lib/content.ts:33", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 test-template/lib/content.ts:33"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a10235e3468bbd6f", "name": "Stray `console.log` in TS/JS \u2014 test-template/lib/mailer.ts:178", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 test-template/lib/mailer.ts:178"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bff3e277a507735f", "name": "Privileged port 6 in use", "shortDescription": {"text": "Privileged port 6 in use"}, "fullDescription": {"text": "Port 6 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d10bb3cb226497e1", "name": "Privileged port 17 in use", "shortDescription": {"text": "Privileged port 17 in use"}, "fullDescription": {"text": "Port 17 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-18516f5f1a66fb77", "name": "Privileged port 7 in use", "shortDescription": {"text": "Privileged port 7 in use"}, "fullDescription": {"text": "Port 7 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-073d1817a9d823ae", "name": "Insecure pattern 'node_child_process' in apps/cli/src/index.ts:60", "shortDescription": {"text": "Insecure pattern 'node_child_process' in apps/cli/src/index.ts:60"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a15009dec82e37fb", "name": "Insecure pattern 'node_child_process' in apps/cli/src/skills.ts:18", "shortDescription": {"text": "Insecure pattern 'node_child_process' in apps/cli/src/skills.ts:18"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1401b69785b0371e", "name": "Insecure pattern 'node_child_process' in apps/cli/src/scaffold.ts:3", "shortDescription": {"text": "Insecure pattern 'node_child_process' in apps/cli/src/scaffold.ts:3"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c4da071ee543f46a", "name": "Insecure pattern 'dangerous_innerhtml' in apps/web/components/mermaid.tsx:70", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/components/mermaid.tsx:70"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-719dcbe1c6f4f55d", "name": "Insecure pattern 'dangerous_innerhtml' in apps/web/components/JsonLd.tsx:27", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/components/JsonLd.tsx:27"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fc4fdca11d081d86", "name": "Insecure pattern 'dangerous_innerhtml' in apps/web/app/(home)/page.tsx:57", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/app/(home)/page.tsx:57"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-02d3be54e90bf855", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "peter-evans/create-pull-request@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0ca052ae2a7aa0c5", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bda3b3b20e56cc51", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "peter-evans/create-pull-request@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-01d413109e5c514f", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "changesets/action@v1 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-878357cdc8b567d8", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-750ed3b51db73b55", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a0165ea166579aa4", "name": "Node manifest has dependencies but no lockfile: apps/cli/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/cli/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4a9eb7dc7c6e3880", "name": "Node manifest has dependencies but no lockfile: apps/web/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/web/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2699d5f16ae11282", "name": "Node manifest has dependencies but no lockfile: packages/shared/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/shared/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 14 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 144 placeholder/mock markers across 47 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b63edc873c27b456", "name": "Commented-code block (5 lines) in apps/cli/src/inject.ts:39", "shortDescription": {"text": "Commented-code block (5 lines) in apps/cli/src/inject.ts:39"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-74189177e9973ae3", "name": "Commented-code block (5 lines) in apps/cli/src/index.ts:739", "shortDescription": {"text": "Commented-code block (5 lines) in apps/cli/src/index.ts:739"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fd635cdf6be2a5be", "name": "Commented-code block (9 lines) in apps/cli/src/profile-light.ts:142", "shortDescription": {"text": "Commented-code block (9 lines) in apps/cli/src/profile-light.ts:142"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f54c18dafaf853d7", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/cli/src/llm.ts:29", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/cli/src/llm.ts:29"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dc065c82ddcbc41c", "name": "Commented-code block (6 lines) in apps/cli/src/scaffold.ts:104", "shortDescription": {"text": "Commented-code block (6 lines) in apps/cli/src/scaffold.ts:104"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6bf3aabda11968cf", "name": "Commented-code block (5 lines) in apps/web/scripts/sync-manifest.mjs:8", "shortDescription": {"text": "Commented-code block (5 lines) in apps/web/scripts/sync-manifest.mjs:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e2831a14e722b400", "name": "Commented-code block (5 lines) in apps/web/components/svg-items-gallery.tsx:1", "shortDescription": {"text": "Commented-code block (5 lines) in apps/web/components/svg-items-gallery.tsx:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-50d9042690b1f71d", "name": "Commented-code block (7 lines) in apps/web/components/mixer/mixer-studio.tsx:6", "shortDescription": {"text": "Commented-code block (7 lines) in apps/web/components/mixer/mixer-studio.tsx:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fe4122bc3bd60d48", "name": "Commented-code block (8 lines) in apps/web/components/chrome/chrome-gallery.tsx:6", "shortDescription": {"text": "Commented-code block (8 lines) in apps/web/components/chrome/chrome-gallery.tsx:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c087ce56d9c45970", "name": "Commented-code block (5 lines) in apps/web/app/api/waitlist/route.ts:91", "shortDescription": {"text": "Commented-code block (5 lines) in apps/web/app/api/waitlist/route.ts:91"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8c9dcaab8b068d2b", "name": "Legacy-named symbol `update_copy` in apps/web/app/changelog/page.tsx:316", "shortDescription": {"text": "Legacy-named symbol `update_copy` in apps/web/app/changelog/page.tsx:316"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-73d11de4715a84c1", "name": "Commented-code block (7 lines) in apps/web/app/mixer/page.tsx:12", "shortDescription": {"text": "Commented-code block (7 lines) in apps/web/app/mixer/page.tsx:12"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-50a00e88ae1b74c2", "name": "Commented-code block (5 lines) in apps/web/lib/looks-data.ts:5", "shortDescription": {"text": "Commented-code block (5 lines) in apps/web/lib/looks-data.ts:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-734b86ead10e27d8", "name": "Commented-code block (5 lines) in apps/web/lib/parts-data.ts:1", "shortDescription": {"text": "Commented-code block (5 lines) in apps/web/lib/parts-data.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1c0780de40656a5d", "name": "Commented-code block (5 lines) in apps/web/lib/marketplace.ts:3", "shortDescription": {"text": "Commented-code block (5 lines) in apps/web/lib/marketplace.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9198afb8e96b2f04", "name": "Commented-code block (5 lines) in apps/web/lib/design-prompts.ts:1", "shortDescription": {"text": "Commented-code block (5 lines) in apps/web/lib/design-prompts.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-27f53a6122491a29", "name": "Commented-code block (5 lines) in apps/web/lib/elements-data.ts:1", "shortDescription": {"text": "Commented-code block (5 lines) in apps/web/lib/elements-data.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0570b3b1b8ff525b", "name": "Commented-code block (5 lines) in apps/web/lib/scenes-data.ts:1", "shortDescription": {"text": "Commented-code block (5 lines) in apps/web/lib/scenes-data.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-606a8bbb77dd0990", "name": "Commented-code block (5 lines) in apps/web/lib/verticals-data.ts:1", "shortDescription": {"text": "Commented-code block (5 lines) in apps/web/lib/verticals-data.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2b56fa3b6945786a", "name": "Commented-code block (5 lines) in test-template/next.config.ts:12", "shortDescription": {"text": "Commented-code block (5 lines) in test-template/next.config.ts:12"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ac62a30b5e25cc26", "name": "`fetch()` without try/.catch or AbortSignal \u2014 test-template/components/voice/VoiceShopOverlay.tsx:134", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 test-template/components/voice/VoiceShopOverlay.tsx:134"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6dc686bd89bc4c8d", "name": "Commented-code block (5 lines) in test-template/app/api/webhook/stripe/route.ts:149", "shortDescription": {"text": "Commented-code block (5 lines) in test-template/app/api/webhook/stripe/route.ts:149"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0c9e5af849c13d49", "name": "Commented-code block (5 lines) in test-template/app/api/mcp/route.ts:108", "shortDescription": {"text": "Commented-code block (5 lines) in test-template/app/api/mcp/route.ts:108"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-df4b79fee48f2f9a", "name": "Commented-code block (5 lines) in test-template/app/api/admin/chat/route.ts:149", "shortDescription": {"text": "Commented-code block (5 lines) in test-template/app/api/admin/chat/route.ts:149"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b3bd2ad223c18e07", "name": "Commented-code block (6 lines) in test-template/lib/validation.ts:151", "shortDescription": {"text": "Commented-code block (6 lines) in test-template/lib/validation.ts:151"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4e4142a2651edfcd", "name": "Commented-code block (8 lines) in test-template/lib/mailer.ts:33", "shortDescription": {"text": "Commented-code block (8 lines) in test-template/lib/mailer.ts:33"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7cf634b85c43a44b", "name": "`fetch()` without try/.catch or AbortSignal \u2014 test-template/lib/unsplash.ts:77", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 test-template/lib/unsplash.ts:77"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c1f7187ee8301fb8", "name": "Commented-code block (5 lines) in test-template/lib/cart.ts:202", "shortDescription": {"text": "Commented-code block (5 lines) in test-template/lib/cart.ts:202"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-64bc033a45ab26f1", "name": "34 env vars used in code but missing from .env.example", "shortDescription": {"text": "34 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `CI`, `CONTACT_FROM_EMAIL`, `CONTACT_NOTIFY_EMAIL`, `CRON_SECRET`, `GEMINI_API_KEY`, `GOOGLE_GEMINI_API_KEY`, `GOOGLE_GENAI_API_KEY`, `KV_REST_API_TOKEN` + 26 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20977"}, "properties": {"repository": "Teloz1870/cartwright-app", "repoUrl": "https://github.com/Teloz1870/cartwright-app", "branch": "main"}, "results": [{"ruleId": "scanner-bead75b0f9233e05", "level": "none", "message": {"text": "No API endpoints detected"}, "properties": {"repobilityId": "0f8bb852027c38f8", "scanner": "scanner-primary", "fingerprint": "bead75b0f9233e05", "layer": "api", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-e04acccd385be901", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/cli/src/index.ts:347"}, "properties": {"repobilityId": "a088766160455c10", "scanner": "scanner-primary", "fingerprint": "e04acccd385be901", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0652e225ca1f449c", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/components/mermaid.tsx:70"}, "properties": {"repobilityId": "21b58b9bfefffde5", "scanner": "scanner-primary", "fingerprint": "0652e225ca1f449c", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-07e4a108316823a2", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/components/JsonLd.tsx:27"}, "properties": {"repobilityId": "7c5f5b3930650769", "scanner": "scanner-primary", "fingerprint": "07e4a108316823a2", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-a9288e5d8b3daf88", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/components/svg-items-gallery.tsx:7"}, "properties": {"repobilityId": "94966c7ff2a16fc8", "scanner": "scanner-primary", "fingerprint": "a9288e5d8b3daf88", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-c17cbca59fc90c78", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/landing/copy-command.tsx:42"}, "properties": {"repobilityId": "73c7de385a70a3da", "scanner": "scanner-primary", "fingerprint": "c17cbca59fc90c78", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-cd99259ac764caeb", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/mixer/mixer-studio.tsx:150"}, "properties": {"repobilityId": "1f96f7f6e651e646", "scanner": "scanner-primary", "fingerprint": "cd99259ac764caeb", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-1e85cd964cf279df", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 apps/web/components/mixer/mixer-studio.tsx:6"}, "properties": {"repobilityId": "17ed4ecf2716649e", "scanner": "scanner-primary", "fingerprint": "1e85cd964cf279df", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-88e69f9c136d22c4", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/components/mixer/mixer-studio.tsx:14"}, "properties": {"repobilityId": "7356f6c6e919ee74", "scanner": "scanner-primary", "fingerprint": "88e69f9c136d22c4", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-624fbd982ed9cb39", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/components/chrome/chrome-gallery.tsx:197"}, "properties": {"repobilityId": "fbe23ee0184ae8a6", "scanner": "scanner-primary", "fingerprint": "624fbd982ed9cb39", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-8f26d9c2ea2d3041", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 apps/web/components/chrome/chrome-gallery.tsx:15"}, "properties": {"repobilityId": "a61f3adf21c052d0", "scanner": "scanner-primary", "fingerprint": "8f26d9c2ea2d3041", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-328e9cf8a91f47d9", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/app/(home)/page.tsx:57"}, "properties": {"repobilityId": "0942aacb78422be6", "scanner": "scanner-primary", "fingerprint": "328e9cf8a91f47d9", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-20b5d5488f268d63", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 apps/web/app/mixer/page.tsx:12"}, "properties": {"repobilityId": "f790e96a3edb6bde", "scanner": "scanner-primary", "fingerprint": "20b5d5488f268d63", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-205eb3835efc8d43", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 test-template/tests/e2e/chat-checkout.spec.ts:23"}, "properties": {"repobilityId": "629f165dfbb1a90e", "scanner": "scanner-primary", "fingerprint": "205eb3835efc8d43", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-5dba483d2435284e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 test-template/prisma/seed.ts:44"}, "properties": {"repobilityId": "4999efd1d300b08a", "scanner": "scanner-primary", "fingerprint": "5dba483d2435284e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ca9e2325eac963e2", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 test-template/components/JsonLd.tsx:8"}, "properties": {"repobilityId": "5abfe2cef85cd367", "scanner": "scanner-primary", "fingerprint": "ca9e2325eac963e2", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-e33b61311e0d612f", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 test-template/components/PDPStickyAtcBar.tsx:33"}, "properties": {"repobilityId": "d6274ddbebb01d76", "scanner": "scanner-primary", "fingerprint": "e33b61311e0d612f", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-c90c3b9516e4be06", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 test-template/components/voice/VoiceShopOverlay.tsx:485"}, "properties": {"repobilityId": "67dd314fa0acc68a", "scanner": "scanner-primary", "fingerprint": "c90c3b9516e4be06", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-1c421d1c687a1329", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 test-template/app/layout.tsx:49"}, "properties": {"repobilityId": "e76111b0fbf016fb", "scanner": "scanner-primary", "fingerprint": "1c421d1c687a1329", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-6d5451c039ba2c44", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 test-template/app/api/webhook/stripe/route.ts:347"}, "properties": {"repobilityId": "273c7e4691d08067", "scanner": "scanner-primary", "fingerprint": "6d5451c039ba2c44", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-4f0f854533706262", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 test-template/app/admin/setup/SetupWizard.tsx:782"}, "properties": {"repobilityId": "4f6397c02b5fe85d", "scanner": "scanner-primary", "fingerprint": "4f0f854533706262", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-db1b087ec26c1aad", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 test-template/lib/content.ts:33"}, "properties": {"repobilityId": "bc5172b1d32befef", "scanner": "scanner-primary", "fingerprint": "db1b087ec26c1aad", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-a10235e3468bbd6f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 test-template/lib/mailer.ts:178"}, "properties": {"repobilityId": "f0a99870f47c369c", "scanner": "scanner-primary", "fingerprint": "a10235e3468bbd6f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-bff3e277a507735f", "level": "warning", "message": {"text": "Privileged port 6 in use"}, "properties": {"repobilityId": "888a3c205ea7334c", "scanner": "scanner-primary", "fingerprint": "bff3e277a507735f", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/bump-template-ref.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d10bb3cb226497e1", "level": "warning", "message": {"text": "Privileged port 17 in use"}, "properties": {"repobilityId": "0bf38fb8f89ec589", "scanner": "scanner-primary", "fingerprint": "d10bb3cb226497e1", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/bump-template-ref.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-18516f5f1a66fb77", "level": "warning", "message": {"text": "Privileged port 7 in use"}, "properties": {"repobilityId": "428a6faecc63b5d6", "scanner": "scanner-primary", "fingerprint": "18516f5f1a66fb77", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/bump-template-ref.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-073d1817a9d823ae", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in apps/cli/src/index.ts:60"}, "properties": {"repobilityId": "14c2fb1c4c67da6b", "scanner": "scanner-primary", "fingerprint": "073d1817a9d823ae", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/index.ts"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-a15009dec82e37fb", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in apps/cli/src/skills.ts:18"}, "properties": {"repobilityId": "8d26f2060f9c002e", "scanner": "scanner-primary", "fingerprint": "a15009dec82e37fb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/skills.ts"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-1401b69785b0371e", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in apps/cli/src/scaffold.ts:3"}, "properties": {"repobilityId": "d759bc5e035448b5", "scanner": "scanner-primary", "fingerprint": "1401b69785b0371e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/src/scaffold.ts"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-c4da071ee543f46a", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/components/mermaid.tsx:70"}, "properties": {"repobilityId": "0559f9cc0d8790d8", "scanner": "scanner-primary", "fingerprint": "c4da071ee543f46a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/components/mermaid.tsx"}, "region": {"startLine": 70}}}]}, {"ruleId": "scanner-719dcbe1c6f4f55d", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/components/JsonLd.tsx:27"}, "properties": {"repobilityId": "6725ceefee75d356", "scanner": "scanner-primary", "fingerprint": "719dcbe1c6f4f55d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/components/JsonLd.tsx"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-fc4fdca11d081d86", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/app/(home)/page.tsx:57"}, "properties": {"repobilityId": "0fdc34bf26a8e188", "scanner": "scanner-primary", "fingerprint": "fc4fdca11d081d86", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/app/(home)/page.tsx"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-02d3be54e90bf855", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8e77222383fb5559", "scanner": "scanner-primary", "fingerprint": "02d3be54e90bf855", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/bump-modern-web-guidance.yml"}, "region": {"startLine": 103}}}]}, {"ruleId": "scanner-0ca052ae2a7aa0c5", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "d320d43ccacc90ae", "scanner": "scanner-primary", "fingerprint": "0ca052ae2a7aa0c5", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/bump-modern-web-guidance.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bda3b3b20e56cc51", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ab3f1b6469718167", "scanner": "scanner-primary", "fingerprint": "bda3b3b20e56cc51", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/bump-template-ref.yml"}, "region": {"startLine": 112}}}]}, {"ruleId": "scanner-01d413109e5c514f", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "371d35fff9992424", "scanner": "scanner-primary", "fingerprint": "01d413109e5c514f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/bump-template-ref.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "795422ca0cf75519", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-878357cdc8b567d8", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "6c86d46fe43be8ea", "scanner": "scanner-primary", "fingerprint": "878357cdc8b567d8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-750ed3b51db73b55", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "ea706245fb92a788", "scanner": "scanner-primary", "fingerprint": "750ed3b51db73b55", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "test-template/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a0165ea166579aa4", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/cli/package.json"}, "properties": {"repobilityId": "027862884b842339", "scanner": "scanner-primary", "fingerprint": "a0165ea166579aa4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/cli/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4a9eb7dc7c6e3880", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/web/package.json"}, "properties": {"repobilityId": "6c1704bf24cf19ac", "scanner": "scanner-primary", "fingerprint": "4a9eb7dc7c6e3880", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2699d5f16ae11282", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/shared/package.json"}, "properties": {"repobilityId": "37ac218a4ef9b430", "scanner": "scanner-primary", "fingerprint": "2699d5f16ae11282", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/shared/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "5bd4875a9147dce2", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "7b64c787574276d5", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "f77d98c245325c32", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "5110e55a5c0ec6e6", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "31ed9e9c69cb1b2c", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "7e1fa8370a44bbdc", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-b63edc873c27b456", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/cli/src/inject.ts:39"}, "properties": {"repobilityId": "9c64185326a0c621", "scanner": "scanner-primary", "fingerprint": "b63edc873c27b456", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-74189177e9973ae3", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/cli/src/index.ts:739"}, "properties": {"repobilityId": "845f74489c34b115", "scanner": "scanner-primary", "fingerprint": "74189177e9973ae3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fd635cdf6be2a5be", "level": "none", "message": {"text": "Commented-code block (9 lines) in apps/cli/src/profile-light.ts:142"}, "properties": {"repobilityId": "368d14ac3c12a3b6", "scanner": "scanner-primary", "fingerprint": "fd635cdf6be2a5be", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f54c18dafaf853d7", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/cli/src/llm.ts:29"}, "properties": {"repobilityId": "e25898397a6a12ad", "scanner": "scanner-primary", "fingerprint": "f54c18dafaf853d7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-dc065c82ddcbc41c", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/cli/src/scaffold.ts:104"}, "properties": {"repobilityId": "a325b4008bc81290", "scanner": "scanner-primary", "fingerprint": "dc065c82ddcbc41c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6bf3aabda11968cf", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/web/scripts/sync-manifest.mjs:8"}, "properties": {"repobilityId": "63e4025336d6ccd6", "scanner": "scanner-primary", "fingerprint": "6bf3aabda11968cf", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e2831a14e722b400", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/web/components/svg-items-gallery.tsx:1"}, "properties": {"repobilityId": "fd9f0ea65ed4a146", "scanner": "scanner-primary", "fingerprint": "e2831a14e722b400", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-50d9042690b1f71d", "level": "none", "message": {"text": "Commented-code block (7 lines) in apps/web/components/mixer/mixer-studio.tsx:6"}, "properties": {"repobilityId": "03397443c00f579b", "scanner": "scanner-primary", "fingerprint": "50d9042690b1f71d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fe4122bc3bd60d48", "level": "none", "message": {"text": "Commented-code block (8 lines) in apps/web/components/chrome/chrome-gallery.tsx:6"}, "properties": {"repobilityId": "95fe1da463390199", "scanner": "scanner-primary", "fingerprint": "fe4122bc3bd60d48", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c087ce56d9c45970", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/web/app/api/waitlist/route.ts:91"}, "properties": {"repobilityId": "b06621b841f832a0", "scanner": "scanner-primary", "fingerprint": "c087ce56d9c45970", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8c9dcaab8b068d2b", "level": "note", "message": {"text": "Legacy-named symbol `update_copy` in apps/web/app/changelog/page.tsx:316"}, "properties": {"repobilityId": "2da81c5d1176d9db", "scanner": "scanner-primary", "fingerprint": "8c9dcaab8b068d2b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-73d11de4715a84c1", "level": "none", "message": {"text": "Commented-code block (7 lines) in apps/web/app/mixer/page.tsx:12"}, "properties": {"repobilityId": "b9832a6c1b6ab485", "scanner": "scanner-primary", "fingerprint": "73d11de4715a84c1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-50a00e88ae1b74c2", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/web/lib/looks-data.ts:5"}, "properties": {"repobilityId": "08ae3a7255184b76", "scanner": "scanner-primary", "fingerprint": "50a00e88ae1b74c2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-734b86ead10e27d8", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/web/lib/parts-data.ts:1"}, "properties": {"repobilityId": "9ab4c80f4db2117c", "scanner": "scanner-primary", "fingerprint": "734b86ead10e27d8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1c0780de40656a5d", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/web/lib/marketplace.ts:3"}, "properties": {"repobilityId": "afdc403dbd086375", "scanner": "scanner-primary", "fingerprint": "1c0780de40656a5d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9198afb8e96b2f04", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/web/lib/design-prompts.ts:1"}, "properties": {"repobilityId": "dbb86fe0f78f1272", "scanner": "scanner-primary", "fingerprint": "9198afb8e96b2f04", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-27f53a6122491a29", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/web/lib/elements-data.ts:1"}, "properties": {"repobilityId": "640d173e5a89c1fc", "scanner": "scanner-primary", "fingerprint": "27f53a6122491a29", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0570b3b1b8ff525b", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/web/lib/scenes-data.ts:1"}, "properties": {"repobilityId": "a2f0f7f01ce6bec1", "scanner": "scanner-primary", "fingerprint": "0570b3b1b8ff525b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-606a8bbb77dd0990", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/web/lib/verticals-data.ts:1"}, "properties": {"repobilityId": "9a8935a82fbb056c", "scanner": "scanner-primary", "fingerprint": "606a8bbb77dd0990", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2b56fa3b6945786a", "level": "none", "message": {"text": "Commented-code block (5 lines) in test-template/next.config.ts:12"}, "properties": {"repobilityId": "7691746661bced1e", "scanner": "scanner-primary", "fingerprint": "2b56fa3b6945786a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ac62a30b5e25cc26", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 test-template/components/voice/VoiceShopOverlay.tsx:134"}, "properties": {"repobilityId": "a2c8c06bd28fa0fd", "scanner": "scanner-primary", "fingerprint": "ac62a30b5e25cc26", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6dc686bd89bc4c8d", "level": "none", "message": {"text": "Commented-code block (5 lines) in test-template/app/api/webhook/stripe/route.ts:149"}, "properties": {"repobilityId": "004a414c9d12fb74", "scanner": "scanner-primary", "fingerprint": "6dc686bd89bc4c8d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0c9e5af849c13d49", "level": "none", "message": {"text": "Commented-code block (5 lines) in test-template/app/api/mcp/route.ts:108"}, "properties": {"repobilityId": "2c29ad817c6acb66", "scanner": "scanner-primary", "fingerprint": "0c9e5af849c13d49", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-df4b79fee48f2f9a", "level": "none", "message": {"text": "Commented-code block (5 lines) in test-template/app/api/admin/chat/route.ts:149"}, "properties": {"repobilityId": "d1555a40a3bcb3b7", "scanner": "scanner-primary", "fingerprint": "df4b79fee48f2f9a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b3bd2ad223c18e07", "level": "none", "message": {"text": "Commented-code block (6 lines) in test-template/lib/validation.ts:151"}, "properties": {"repobilityId": "8d1e0719c7bb01b5", "scanner": "scanner-primary", "fingerprint": "b3bd2ad223c18e07", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4e4142a2651edfcd", "level": "none", "message": {"text": "Commented-code block (8 lines) in test-template/lib/mailer.ts:33"}, "properties": {"repobilityId": "fb13b8aaf50976d5", "scanner": "scanner-primary", "fingerprint": "4e4142a2651edfcd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7cf634b85c43a44b", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 test-template/lib/unsplash.ts:77"}, "properties": {"repobilityId": "7ad11a68628f4048", "scanner": "scanner-primary", "fingerprint": "7cf634b85c43a44b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c1f7187ee8301fb8", "level": "none", "message": {"text": "Commented-code block (5 lines) in test-template/lib/cart.ts:202"}, "properties": {"repobilityId": "3f08230b6ce107a2", "scanner": "scanner-primary", "fingerprint": "c1f7187ee8301fb8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-64bc033a45ab26f1", "level": "note", "message": {"text": "34 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "dab9f6f977f9c414", "scanner": "scanner-primary", "fingerprint": "64bc033a45ab26f1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}]}]}