{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-5f04a1d06dd8b68f", "name": "Stray `console.log` in TS/JS \u2014 test/unit/snapshot-completeness.test.ts:252", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 test/unit/snapshot-completeness.test.ts:252"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-58c0657837220570", "name": "Stray `console.log` in TS/JS \u2014 test/unit/bundle-safety.test.ts:146", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 test/unit/bundle-safety.test.ts:146"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-886bbb41af47dc69", "name": "Stray `console.log` in TS/JS \u2014 scripts/seed-kanban-testvault.ts:43", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/seed-kanban-testvault.ts:43"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d06e199790e51609", "name": "Stray `console.log` in TS/JS \u2014 src/main.ts:572", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/main.ts:572"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-01d7896de574f76d", "name": "Stray `console.log` in TS/JS \u2014 src/logger.ts:20", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/logger.ts:20"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fa94c0a860b298a3", "name": "Possible secret in test/harness/obsidian-mock.ts", "shortDescription": {"text": "Possible secret in test/harness/obsidian-mock.ts"}, "fullDescription": {"text": "Detected pattern matching openai_or_anthropic_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-5abe98fc9501a73e", "name": "Insecure pattern 'node_child_process' in scripts/create-test-vault.mjs:20", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/create-test-vault.mjs:20"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f9f33dbc09df7284", "name": "Insecure pattern 'exec_used' in src/AgentDashboard.ts:444", "shortDescription": {"text": "Insecure pattern 'exec_used' in src/AgentDashboard.ts:444"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-87fe6236908ea9d1", "name": "Insecure pattern 'node_child_process' in src/AgentDashboard.ts:440", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/AgentDashboard.ts:440"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a645259ae571f462", "name": "Insecure pattern 'node_child_process' in src/SkillsManagerView.ts:863", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/SkillsManagerView.ts:863"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5ba293f590c3bc7c", "name": "Insecure pattern 'node_child_process' in src/WakeLockService.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/WakeLockService.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c42f280558959fda", "name": "Insecure pattern 'exec_used' in src/KanbanView.ts:521", "shortDescription": {"text": "Insecure pattern 'exec_used' in src/KanbanView.ts:521"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9f7b3883e5bf12e7", "name": "Insecure pattern 'node_child_process' in src/KanbanView.ts:517", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/KanbanView.ts:517"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c1316623c8879c98", "name": "Insecure pattern 'node_child_process' in src/ObsidianTools.ts:12", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/ObsidianTools.ts:12"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f5f9a9e3e107c207", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/stt.ts:47", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/stt.ts:47"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f5fcdc1218c38a01", "name": "Very large file: screenshots/src/ClaudeThreadsShots.tsx (1238 lines)", "shortDescription": {"text": "Very large file: screenshots/src/ClaudeThreadsShots.tsx (1238 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f2c9dae570cd357a", "name": "Very large file: src/main.ts (1290 lines)", "shortDescription": {"text": "Very large file: src/main.ts (1290 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab2a4b07d44def25", "name": "Very large file: src/ObsidianTools.ts (1867 lines)", "shortDescription": {"text": "Very large file: src/ObsidianTools.ts (1867 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e7e5c1f3ca6f747b", "name": "Very large file: src/ThreadsView.ts (3165 lines)", "shortDescription": {"text": "Very large file: src/ThreadsView.ts (3165 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 17 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 25 placeholder/mock markers across 10 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-67ac72d7b657d26f", "name": "Commented-code block (6 lines) in playwright.config.ts:19", "shortDescription": {"text": "Commented-code block (6 lines) in playwright.config.ts:19"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5bd002105a65ade5", "name": "`fetch()` without try/.catch or AbortSignal \u2014 relay/test/room.test.ts:257", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 relay/test/room.test.ts:257"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0a7afc16fb553fd3", "name": "`fetch()` without try/.catch or AbortSignal \u2014 relay/src/index.ts:16", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 relay/src/index.ts:16"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5de4b55d3ac58916", "name": "`fetch()` without try/.catch or AbortSignal \u2014 relay/src/RoomDO.ts:16", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 relay/src/RoomDO.ts:16"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a4f3997e40df34fc", "name": "Commented-code block (6 lines) in test/unit/thread-snapshot-ui-status.test.ts:86", "shortDescription": {"text": "Commented-code block (6 lines) in test/unit/thread-snapshot-ui-status.test.ts:86"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ec496753060fa27d", "name": "Legacy-named symbol `acmeOld` in test/unit/kanban-folder-grouping.test.ts:121", "shortDescription": {"text": "Legacy-named symbol `acmeOld` in test/unit/kanban-folder-grouping.test.ts:121"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d331ddd13a98edac", "name": "Commented-code block (5 lines) in test/unit/kanban-folder-grouping.test.ts:161", "shortDescription": {"text": "Commented-code block (5 lines) in test/unit/kanban-folder-grouping.test.ts:161"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6f38810826650957", "name": "Commented-code block (5 lines) in test/screenshots/ui.spec.ts:7", "shortDescription": {"text": "Commented-code block (5 lines) in test/screenshots/ui.spec.ts:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-243e83e30f7de7fb", "name": "Commented-code block (5 lines) in test/harness/fixtures.ts:304", "shortDescription": {"text": "Commented-code block (5 lines) in test/harness/fixtures.ts:304"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-efe1b0842769c7c2", "name": "`fetch()` without try/.catch or AbortSignal \u2014 test/harness/obsidian-mock.ts:662", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 test/harness/obsidian-mock.ts:662"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1df3d9a48c300111", "name": "Commented-code block (6 lines) in src/VaultPersistence.ts:29", "shortDescription": {"text": "Commented-code block (6 lines) in src/VaultPersistence.ts:29"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c589a307609f3222", "name": "Commented-code block (6 lines) in src/ThreadManager.ts:519", "shortDescription": {"text": "Commented-code block (6 lines) in src/ThreadManager.ts:519"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c4c6e8d7ca126b08", "name": "Commented-code block (5 lines) in src/main.ts:73", "shortDescription": {"text": "Commented-code block (5 lines) in src/main.ts:73"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ac10604a90cecb36", "name": "Commented-code block (6 lines) in src/ClaudeSession.ts:418", "shortDescription": {"text": "Commented-code block (6 lines) in src/ClaudeSession.ts:418"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f641605de33727f0", "name": "Commented-code block (7 lines) in src/ObsidianTools.ts:635", "shortDescription": {"text": "Commented-code block (7 lines) in src/ObsidianTools.ts:635"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d12895a88cef0f5c", "name": "Commented-code block (5 lines) in src/ThreadsView.ts:1224", "shortDescription": {"text": "Commented-code block (5 lines) in src/ThreadsView.ts:1224"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/17887"}, "properties": {"repository": "rbcodelabs/obsidian-claude-threads", "repoUrl": "https://github.com/rbcodelabs/obsidian-claude-threads", "branch": "main"}, "results": [{"ruleId": "scanner-5f04a1d06dd8b68f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 test/unit/snapshot-completeness.test.ts:252"}, "properties": {"repobilityId": "cddf9576172fcc0f", "scanner": "scanner-primary", "fingerprint": "5f04a1d06dd8b68f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-58c0657837220570", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 test/unit/bundle-safety.test.ts:146"}, "properties": {"repobilityId": "66b56e68aea9bd9b", "scanner": "scanner-primary", "fingerprint": "58c0657837220570", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-886bbb41af47dc69", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/seed-kanban-testvault.ts:43"}, "properties": {"repobilityId": "8aa5083961f75b63", "scanner": "scanner-primary", "fingerprint": "886bbb41af47dc69", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d06e199790e51609", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/main.ts:572"}, "properties": {"repobilityId": "981eedf4f52fff93", "scanner": "scanner-primary", "fingerprint": "d06e199790e51609", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-01d7896de574f76d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/logger.ts:20"}, "properties": {"repobilityId": "f89f7ddbc9e8a8b3", "scanner": "scanner-primary", "fingerprint": "01d7896de574f76d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-fa94c0a860b298a3", "level": "error", "message": {"text": "Possible secret in test/harness/obsidian-mock.ts"}, "properties": {"repobilityId": "ad5d4ae7831702d3", "scanner": "scanner-primary", "fingerprint": "fa94c0a860b298a3", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "test/harness/obsidian-mock.ts"}, "region": {"startLine": 137}}}]}, {"ruleId": "scanner-5abe98fc9501a73e", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/create-test-vault.mjs:20"}, "properties": {"repobilityId": "e5d336224035ead4", "scanner": "scanner-primary", "fingerprint": "5abe98fc9501a73e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/create-test-vault.mjs"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-f9f33dbc09df7284", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in src/AgentDashboard.ts:444"}, "properties": {"repobilityId": "ff0156231e093aae", "scanner": "scanner-primary", "fingerprint": "f9f33dbc09df7284", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/AgentDashboard.ts"}, "region": {"startLine": 444}}}]}, {"ruleId": "scanner-87fe6236908ea9d1", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/AgentDashboard.ts:440"}, "properties": {"repobilityId": "7d9eee02a92bb7e0", "scanner": "scanner-primary", "fingerprint": "87fe6236908ea9d1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/AgentDashboard.ts"}, "region": {"startLine": 440}}}]}, {"ruleId": "scanner-a645259ae571f462", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/SkillsManagerView.ts:863"}, "properties": {"repobilityId": "a6b5ee3f9b97bc11", "scanner": "scanner-primary", "fingerprint": "a645259ae571f462", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/SkillsManagerView.ts"}, "region": {"startLine": 863}}}]}, {"ruleId": "scanner-5ba293f590c3bc7c", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/WakeLockService.ts:1"}, "properties": {"repobilityId": "c8ef97418aa41244", "scanner": "scanner-primary", "fingerprint": "5ba293f590c3bc7c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/WakeLockService.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c42f280558959fda", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in src/KanbanView.ts:521"}, "properties": {"repobilityId": "1e13f92484380507", "scanner": "scanner-primary", "fingerprint": "c42f280558959fda", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/KanbanView.ts"}, "region": {"startLine": 521}}}]}, {"ruleId": "scanner-9f7b3883e5bf12e7", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/KanbanView.ts:517"}, "properties": {"repobilityId": "2dfe3966aeecac18", "scanner": "scanner-primary", "fingerprint": "9f7b3883e5bf12e7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/KanbanView.ts"}, "region": {"startLine": 517}}}]}, {"ruleId": "scanner-c1316623c8879c98", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/ObsidianTools.ts:12"}, "properties": {"repobilityId": "02761d9dfa000fd8", "scanner": "scanner-primary", "fingerprint": "c1316623c8879c98", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/ObsidianTools.ts"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-f5f9a9e3e107c207", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/stt.ts:47"}, "properties": {"repobilityId": "de878f9ce59c5ff0", "scanner": "scanner-primary", "fingerprint": "f5f9a9e3e107c207", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/stt.ts"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ae16880318b99912", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "989a74409a402368", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2644034c718fb80d", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "eeb76410cc935c30", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f5fcdc1218c38a01", "level": "note", "message": {"text": "Very large file: screenshots/src/ClaudeThreadsShots.tsx (1238 lines)"}, "properties": {"repobilityId": "e45c8777ee6e2627", "scanner": "scanner-primary", "fingerprint": "f5fcdc1218c38a01", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f2c9dae570cd357a", "level": "note", "message": {"text": "Very large file: src/main.ts (1290 lines)"}, "properties": {"repobilityId": "ee45022efe610d16", "scanner": "scanner-primary", "fingerprint": "f2c9dae570cd357a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ab2a4b07d44def25", "level": "note", "message": {"text": "Very large file: src/ObsidianTools.ts (1867 lines)"}, "properties": {"repobilityId": "1ae1eac09f22410a", "scanner": "scanner-primary", "fingerprint": "ab2a4b07d44def25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e7e5c1f3ca6f747b", "level": "note", "message": {"text": "Very large file: src/ThreadsView.ts (3165 lines)"}, "properties": {"repobilityId": "baa13cfc005b700c", "scanner": "scanner-primary", "fingerprint": "e7e5c1f3ca6f747b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "5c35e5693b56845e", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "95b16dafc75d1dd8", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "746d08c3c7314e31", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "e64a39a42b5a76c7", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "5b2a6faa3cd32ed7", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-67ac72d7b657d26f", "level": "none", "message": {"text": "Commented-code block (6 lines) in playwright.config.ts:19"}, "properties": {"repobilityId": "af64c8d91c0280b7", "scanner": "scanner-primary", "fingerprint": "67ac72d7b657d26f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5bd002105a65ade5", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 relay/test/room.test.ts:257"}, "properties": {"repobilityId": "82581454d495a349", "scanner": "scanner-primary", "fingerprint": "5bd002105a65ade5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0a7afc16fb553fd3", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 relay/src/index.ts:16"}, "properties": {"repobilityId": "6b1bb91c6936f431", "scanner": "scanner-primary", "fingerprint": "0a7afc16fb553fd3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-5de4b55d3ac58916", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 relay/src/RoomDO.ts:16"}, "properties": {"repobilityId": "57f7c7b5ebfec9a2", "scanner": "scanner-primary", "fingerprint": "5de4b55d3ac58916", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a4f3997e40df34fc", "level": "none", "message": {"text": "Commented-code block (6 lines) in test/unit/thread-snapshot-ui-status.test.ts:86"}, "properties": {"repobilityId": "c76b43e89fde0463", "scanner": "scanner-primary", "fingerprint": "a4f3997e40df34fc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ec496753060fa27d", "level": "note", "message": {"text": "Legacy-named symbol `acmeOld` in test/unit/kanban-folder-grouping.test.ts:121"}, "properties": {"repobilityId": "c25f4845c464479d", "scanner": "scanner-primary", "fingerprint": "ec496753060fa27d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d331ddd13a98edac", "level": "none", "message": {"text": "Commented-code block (5 lines) in test/unit/kanban-folder-grouping.test.ts:161"}, "properties": {"repobilityId": "067ce98aec813b1e", "scanner": "scanner-primary", "fingerprint": "d331ddd13a98edac", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6f38810826650957", "level": "none", "message": {"text": "Commented-code block (5 lines) in test/screenshots/ui.spec.ts:7"}, "properties": {"repobilityId": "42bdfc5c62947528", "scanner": "scanner-primary", "fingerprint": "6f38810826650957", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-243e83e30f7de7fb", "level": "none", "message": {"text": "Commented-code block (5 lines) in test/harness/fixtures.ts:304"}, "properties": {"repobilityId": "c5cda91d92c7504c", "scanner": "scanner-primary", "fingerprint": "243e83e30f7de7fb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-efe1b0842769c7c2", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 test/harness/obsidian-mock.ts:662"}, "properties": {"repobilityId": "847392edeb9df547", "scanner": "scanner-primary", "fingerprint": "efe1b0842769c7c2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1df3d9a48c300111", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/VaultPersistence.ts:29"}, "properties": {"repobilityId": "da009791dbb6ae98", "scanner": "scanner-primary", "fingerprint": "1df3d9a48c300111", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c589a307609f3222", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/ThreadManager.ts:519"}, "properties": {"repobilityId": "afd5454e990fef18", "scanner": "scanner-primary", "fingerprint": "c589a307609f3222", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c4c6e8d7ca126b08", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/main.ts:73"}, "properties": {"repobilityId": "8e560da585af58a5", "scanner": "scanner-primary", "fingerprint": "c4c6e8d7ca126b08", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ac10604a90cecb36", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/ClaudeSession.ts:418"}, "properties": {"repobilityId": "b7f5da355a7ed167", "scanner": "scanner-primary", "fingerprint": "ac10604a90cecb36", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f641605de33727f0", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/ObsidianTools.ts:635"}, "properties": {"repobilityId": "721a844124b93f5e", "scanner": "scanner-primary", "fingerprint": "f641605de33727f0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d12895a88cef0f5c", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/ThreadsView.ts:1224"}, "properties": {"repobilityId": "332de132fef633fb", "scanner": "scanner-primary", "fingerprint": "d12895a88cef0f5c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}