{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-8369898aede2e375", "name": "Stray `console.log` in TS/JS \u2014 server/index.ts:10", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server/index.ts:10"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-251a4d433650cc1c", "name": "Stray `console.log` in TS/JS \u2014 server/backupScheduler.ts:39", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server/backupScheduler.ts:39"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-74a7be388073aa63", "name": "Stray `console.log` in TS/JS \u2014 server/backupRuntime.ts:19", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server/backupRuntime.ts:19"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d738073b088f0fe", "name": "Stray `console.log` in TS/JS \u2014 server/desktop/launcher.ts:62", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server/desktop/launcher.ts:62"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f1740ebb829a0c1d", "name": "Insecure pattern 'node_child_process' in scripts/build-desktop.mjs:27", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/build-desktop.mjs:27"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-82522e329355e0cc", "name": "Insecure pattern 'subprocess_shell_true' in .claude/skills/webapp-testing/scripts/with_server.py:71", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in .claude/skills/webapp-testing/scripts/with_server.py:71"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-95bf8b2cef25978a", "name": "Insecure pattern 'node_child_process' in server/translateDocker.ts:15", "shortDescription": {"text": "Insecure pattern 'node_child_process' in server/translateDocker.ts:15"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fb81ecfeb861e7cd", "name": "Insecure pattern 'node_child_process' in server/desktop/updater.ts:21", "shortDescription": {"text": "Insecure pattern 'node_child_process' in server/desktop/updater.ts:21"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf96d47c63cb3d42", "name": "Insecure pattern 'node_child_process' in server/desktop/openBrowser.ts:11", "shortDescription": {"text": "Insecure pattern 'node_child_process' in server/desktop/openBrowser.ts:11"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7296e460af937f1d", "name": "Insecure pattern 'node_child_process' in server/desktop/notify.ts:19", "shortDescription": {"text": "Insecure pattern 'node_child_process' in server/desktop/notify.ts:19"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fa87357552f5f194", "name": "Insecure pattern 'node_child_process' in server/desktop/updateRuntime.ts:22", "shortDescription": {"text": "Insecure pattern 'node_child_process' in server/desktop/updateRuntime.ts:22"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3b18f27bdbe3bd12", "name": "Insecure pattern 'exec_used' in src/components/ui/RichField.tsx:256", "shortDescription": {"text": "Insecure pattern 'exec_used' in src/components/ui/RichField.tsx:256"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3d34b3b4b24a77b3", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/components/ui/RichField.tsx:222", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/components/ui/RichField.tsx:222"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7b783f53105d7582", "name": "Insecure pattern 'document_write' in src/components/editor/views/ViewEditor.tsx:77", "shortDescription": {"text": "Insecure pattern 'document_write' in src/components/editor/views/ViewEditor.tsx:77"}, "fullDescription": {"text": "Found a known-risky pattern (document_write). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c7fca8baea0abf3", "name": "Insecure pattern 'domparser_html_parse' in src/lib/richText.ts:34", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in src/lib/richText.ts:34"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 29 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 64 placeholder/mock markers across 16 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c5f98b152cddb6d", "name": "Agent authority lacks a verifier contract: .claude/launch.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/launch.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1ca50ef4047a1626", "name": "Agent authority lacks a verifier contract: .claude/skills/web-design-guidelines/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/web-design-guidelines/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e8df6269cdae6f46", "name": "Commented-code block (5 lines) in vite.config.ts:7", "shortDescription": {"text": "Commented-code block (5 lines) in vite.config.ts:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-977382fcd645feba", "name": "Commented-code block (6 lines) in tests/image.test.ts:101", "shortDescription": {"text": "Commented-code block (6 lines) in tests/image.test.ts:101"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2bb2e983393714f4", "name": "Commented-code block (5 lines) in tests/viewHeader.test.ts:54", "shortDescription": {"text": "Commented-code block (5 lines) in tests/viewHeader.test.ts:54"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d7825a38d441a12f", "name": "Commented-code block (5 lines) in tests/exporter.test.ts:47", "shortDescription": {"text": "Commented-code block (5 lines) in tests/exporter.test.ts:47"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-186402069eff4f3d", "name": "Commented-code block (5 lines) in tests/viewFilter.test.ts:391", "shortDescription": {"text": "Commented-code block (5 lines) in tests/viewFilter.test.ts:391"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-836c134ba76a3a3a", "name": "Commented-code block (5 lines) in tests/server/config.test.ts:5", "shortDescription": {"text": "Commented-code block (5 lines) in tests/server/config.test.ts:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-15c39b06956161fb", "name": "Commented-code block (5 lines) in tests/server/settingsRoutes.test.ts:120", "shortDescription": {"text": "Commented-code block (5 lines) in tests/server/settingsRoutes.test.ts:120"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f8ff7b3707a163e8", "name": "Commented-code block (6 lines) in scripts/build-desktop.mjs:40", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/build-desktop.mjs:40"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-571d251684e2bf16", "name": "Commented-code block (5 lines) in server/app.ts:13", "shortDescription": {"text": "Commented-code block (5 lines) in server/app.ts:13"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4f16be82b94f8c9f", "name": "Commented-code block (6 lines) in server/db.ts:214", "shortDescription": {"text": "Commented-code block (6 lines) in server/db.ts:214"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4e43d061e28231b5", "name": "Commented-code block (9 lines) in server/desktop/updateRuntime.ts:341", "shortDescription": {"text": "Commented-code block (9 lines) in server/desktop/updateRuntime.ts:341"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1f33aa3b763e7a38", "name": "Commented-code block (6 lines) in server/routes/settings.ts:104", "shortDescription": {"text": "Commented-code block (6 lines) in server/routes/settings.ts:104"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c0e6e9d7d467b72e", "name": "Commented-code block (5 lines) in src/App.tsx:184", "shortDescription": {"text": "Commented-code block (5 lines) in src/App.tsx:184"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f3cfc91116381910", "name": "Commented-code block (5 lines) in src/components/SnapshotHistory.tsx:53", "shortDescription": {"text": "Commented-code block (5 lines) in src/components/SnapshotHistory.tsx:53"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c57b649a04623b8c", "name": "Commented-code block (5 lines) in src/components/AuthGate.tsx:75", "shortDescription": {"text": "Commented-code block (5 lines) in src/components/AuthGate.tsx:75"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6072e83bf2497424", "name": "Commented-code block (12 lines) in src/components/ui/ImageCropperModal.tsx:171", "shortDescription": {"text": "Commented-code block (12 lines) in src/components/ui/ImageCropperModal.tsx:171"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1fa1883ba1d78512", "name": "Commented-code block (5 lines) in src/lib/api.ts:6", "shortDescription": {"text": "Commented-code block (5 lines) in src/lib/api.ts:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a8b674c0654abecc", "name": "Commented-code block (6 lines) in src/lib/importer.ts:240", "shortDescription": {"text": "Commented-code block (6 lines) in src/lib/importer.ts:240"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0fd3c9282d02e4bd", "name": "Commented-code block (5 lines) in src/lib/exporter.ts:277", "shortDescription": {"text": "Commented-code block (5 lines) in src/lib/exporter.ts:277"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-96b50a9a7c59923e", "name": "Commented-code block (5 lines) in src/lib/migrate.ts:181", "shortDescription": {"text": "Commented-code block (5 lines) in src/lib/migrate.ts:181"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e279ea0e625b0ec7", "name": "Commented-code block (6 lines) in src/lib/viewHeader.ts:20", "shortDescription": {"text": "Commented-code block (6 lines) in src/lib/viewHeader.ts:20"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fb52f66d282e5a24", "name": "Commented-code block (6 lines) in src/lib/sectionSort.ts:96", "shortDescription": {"text": "Commented-code block (6 lines) in src/lib/sectionSort.ts:96"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-030da566069872e9", "name": "15 env vars used in code but missing from .env.example", "shortDescription": {"text": "15 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `CI`, `NODE_ENV`, `RESUME_APP_VERSION`, `RESUME_BACKUP_DIR`, `RESUME_BACKUP_INTERVAL_MS`, `RESUME_CLIENT_DIR`, `RESUME_COMPOSE_FILE`, `RESUME_DATA_DIR` + 7 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-37f44728de6d9103", "name": "Dangling fetch: POST /api/auth/logout (src/lib/api.ts:245)", "shortDescription": {"text": "Dangling fetch: POST /api/auth/logout (src/lib/api.ts:245)"}, "fullDescription": {"text": "`src/lib/api.ts:245` calls `POST /api/auth/logout` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/auth/logout`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6eb452fbfb454d20", "name": "Unused endpoint: USE /api/auth", "shortDescription": {"text": "Unused endpoint: USE /api/auth"}, "fullDescription": {"text": "`server/app.ts` declares `USE /api/auth` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c04b3b0642c449e0", "name": "Unused endpoint: USE /api/resumes", "shortDescription": {"text": "Unused endpoint: USE /api/resumes"}, "fullDescription": {"text": "`server/app.ts` declares `USE /api/resumes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b4a376810bee148", "name": "Unused endpoint: USE /api/translate", "shortDescription": {"text": "Unused endpoint: USE /api/translate"}, "fullDescription": {"text": "`server/app.ts` declares `USE /api/translate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c935dec635de91ea", "name": "Unused endpoint: USE /api/backup", "shortDescription": {"text": "Unused endpoint: USE /api/backup"}, "fullDescription": {"text": "`server/app.ts` declares `USE /api/backup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8ca4664c9cda1cd6", "name": "Unused endpoint: USE /api/settings", "shortDescription": {"text": "Unused endpoint: USE /api/settings"}, "fullDescription": {"text": "`server/app.ts` declares `USE /api/settings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ced75d1c29602761", "name": "Unused endpoint: USE /api/update", "shortDescription": {"text": "Unused endpoint: USE /api/update"}, "fullDescription": {"text": "`server/app.ts` declares `USE /api/update` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-618721b912bad1c2", "name": "Unused endpoint: POST /login", "shortDescription": {"text": "Unused endpoint: POST /login"}, "fullDescription": {"text": "`server/routes/auth.ts` declares `POST /login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-99fc36db98c134ce", "name": "Unused endpoint: POST /logout", "shortDescription": {"text": "Unused endpoint: POST /logout"}, "fullDescription": {"text": "`server/routes/auth.ts` declares `POST /logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`server/routes/resume.ts` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a009b1a56794f45", "name": "Unused endpoint: POST /", "shortDescription": {"text": "Unused endpoint: POST /"}, "fullDescription": {"text": "`server/routes/resume.ts` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a21936a38b7671a9", "name": "Unused endpoint: GET /storage", "shortDescription": {"text": "Unused endpoint: GET /storage"}, "fullDescription": {"text": "`server/routes/resume.ts` declares `GET /storage` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-db0993b39976b123", "name": "Unused endpoint: GET /:id/snapshots", "shortDescription": {"text": "Unused endpoint: GET /:id/snapshots"}, "fullDescription": {"text": "`server/routes/resume.ts` declares `GET /:id/snapshots` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d0f1587316841daa", "name": "Unused endpoint: GET /:id/snapshots/:sid", "shortDescription": {"text": "Unused endpoint: GET /:id/snapshots/:sid"}, "fullDescription": {"text": "`server/routes/resume.ts` declares `GET /:id/snapshots/:sid` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ca5756175765b49d", "name": "Unused endpoint: GET /:id", "shortDescription": {"text": "Unused endpoint: GET /:id"}, "fullDescription": {"text": "`server/routes/resume.ts` declares `GET /:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8d5b2b188d08ca82", "name": "Unused endpoint: PUT /:id", "shortDescription": {"text": "Unused endpoint: PUT /:id"}, "fullDescription": {"text": "`server/routes/resume.ts` declares `PUT /:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5fbc954f63526821", "name": "Unused endpoint: PATCH /:id", "shortDescription": {"text": "Unused endpoint: PATCH /:id"}, "fullDescription": {"text": "`server/routes/resume.ts` declares `PATCH /:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a61c112b611f4bb", "name": "Unused endpoint: DELETE /:id", "shortDescription": {"text": "Unused endpoint: DELETE /:id"}, "fullDescription": {"text": "`server/routes/resume.ts` declares `DELETE /:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-554ffd052999fac9", "name": "Unused endpoint: POST /check", "shortDescription": {"text": "Unused endpoint: POST /check"}, "fullDescription": {"text": "`server/routes/update.ts` declares `POST /check` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-083fba8d34bf5011", "name": "Unused endpoint: POST /install", "shortDescription": {"text": "Unused endpoint: POST /install"}, "fullDescription": {"text": "`server/routes/update.ts` declares `POST /install` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bc797ac64a533cac", "name": "Unused endpoint: POST /now", "shortDescription": {"text": "Unused endpoint: POST /now"}, "fullDescription": {"text": "`server/routes/backup.ts` declares `POST /now` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-947ea837b34b3691", "name": "Unused endpoint: POST /restore", "shortDescription": {"text": "Unused endpoint: POST /restore"}, "fullDescription": {"text": "`server/routes/backup.ts` declares `POST /restore` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-67d28fa8cd6bb12f", "name": "Unused endpoint: PUT /", "shortDescription": {"text": "Unused endpoint: PUT /"}, "fullDescription": {"text": "`server/routes/settings.ts` declares `PUT /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9a7df074602bebca", "name": "Unused endpoint: POST /translate/test", "shortDescription": {"text": "Unused endpoint: POST /translate/test"}, "fullDescription": {"text": "`server/routes/settings.ts` declares `POST /translate/test` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c6dc00baa14b97f0", "name": "Unused endpoint: POST /docker", "shortDescription": {"text": "Unused endpoint: POST /docker"}, "fullDescription": {"text": "`server/routes/settings.ts` declares `POST /docker` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20597"}, "properties": {"repository": "sveinmagnus/resumestudio", "repoUrl": "https://github.com/sveinmagnus/resumestudio", "branch": "main"}, "results": [{"ruleId": "scanner-8369898aede2e375", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server/index.ts:10"}, "properties": {"repobilityId": "b4961a877930fd2f", "scanner": "scanner-primary", "fingerprint": "8369898aede2e375", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-251a4d433650cc1c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server/backupScheduler.ts:39"}, "properties": {"repobilityId": "11976a9c0414ca3b", "scanner": "scanner-primary", "fingerprint": "251a4d433650cc1c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-74a7be388073aa63", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server/backupRuntime.ts:19"}, "properties": {"repobilityId": "06b6348aebe39865", "scanner": "scanner-primary", "fingerprint": "74a7be388073aa63", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0d738073b088f0fe", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server/desktop/launcher.ts:62"}, "properties": {"repobilityId": "3230d7a75bf32d55", "scanner": "scanner-primary", "fingerprint": "0d738073b088f0fe", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-f1740ebb829a0c1d", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/build-desktop.mjs:27"}, "properties": {"repobilityId": "1f47b04a583fc72f", "scanner": "scanner-primary", "fingerprint": "f1740ebb829a0c1d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/build-desktop.mjs"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-82522e329355e0cc", "level": "warning", "message": {"text": "Insecure pattern 'subprocess_shell_true' in .claude/skills/webapp-testing/scripts/with_server.py:71"}, "properties": {"repobilityId": "603ca94dede951d0", "scanner": "scanner-primary", "fingerprint": "82522e329355e0cc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/webapp-testing/scripts/with_server.py"}, "region": {"startLine": 71}}}]}, {"ruleId": "scanner-95bf8b2cef25978a", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in server/translateDocker.ts:15"}, "properties": {"repobilityId": "ddc85db774aa9740", "scanner": "scanner-primary", "fingerprint": "95bf8b2cef25978a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/translateDocker.ts"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-fb81ecfeb861e7cd", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in server/desktop/updater.ts:21"}, "properties": {"repobilityId": "0f86457019f763b1", "scanner": "scanner-primary", "fingerprint": "fb81ecfeb861e7cd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/desktop/updater.ts"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-cf96d47c63cb3d42", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in server/desktop/openBrowser.ts:11"}, "properties": {"repobilityId": "2771c337992a1ed4", "scanner": "scanner-primary", "fingerprint": "cf96d47c63cb3d42", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/desktop/openBrowser.ts"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-7296e460af937f1d", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in server/desktop/notify.ts:19"}, "properties": {"repobilityId": "a97d1a4ec54f96f7", "scanner": "scanner-primary", "fingerprint": "7296e460af937f1d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/desktop/notify.ts"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-fa87357552f5f194", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in server/desktop/updateRuntime.ts:22"}, "properties": {"repobilityId": "0f99c76f49334799", "scanner": "scanner-primary", "fingerprint": "fa87357552f5f194", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/desktop/updateRuntime.ts"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-3b18f27bdbe3bd12", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in src/components/ui/RichField.tsx:256"}, "properties": {"repobilityId": "356c342710606bb0", "scanner": "scanner-primary", "fingerprint": "3b18f27bdbe3bd12", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/components/ui/RichField.tsx"}, "region": {"startLine": 256}}}]}, {"ruleId": "scanner-3d34b3b4b24a77b3", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/components/ui/RichField.tsx:222"}, "properties": {"repobilityId": "40926fb1fbcb316d", "scanner": "scanner-primary", "fingerprint": "3d34b3b4b24a77b3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/components/ui/RichField.tsx"}, "region": {"startLine": 222}}}]}, {"ruleId": "scanner-7b783f53105d7582", "level": "note", "message": {"text": "Insecure pattern 'document_write' in src/components/editor/views/ViewEditor.tsx:77"}, "properties": {"repobilityId": "d911e9dcd02e3d25", "scanner": "scanner-primary", "fingerprint": "7b783f53105d7582", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "document_write"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/components/editor/views/ViewEditor.tsx"}, "region": {"startLine": 77}}}]}, {"ruleId": "scanner-5c7fca8baea0abf3", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in src/lib/richText.ts:34"}, "properties": {"repobilityId": "00df003a4e1d21da", "scanner": "scanner-primary", "fingerprint": "5c7fca8baea0abf3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/lib/richText.ts"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4a63b1fd6887cae9", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4a63b1fd6887cae9", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bd7f3c1c34d83159", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 61}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4a63b1fd6887cae9", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 80}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "04f6c832d67a7838", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b28f2eb9ce3eea56", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f0c3d4499b6cd885", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 124}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "58d55b332370bb20", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "2f6481502be0ee1d", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "776da4adea08c86a", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "63261745dea0d7ac", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "081f908d6f602fa9", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-2c5f98b152cddb6d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/launch.json"}, "properties": {"repobilityId": "0de48c0f4ab303d8", "scanner": "scanner-primary", "fingerprint": "2c5f98b152cddb6d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/launch.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1ca50ef4047a1626", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/web-design-guidelines/SKILL.md"}, "properties": {"repobilityId": "f2451fa9a31e4611", "scanner": "scanner-primary", "fingerprint": "1ca50ef4047a1626", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/web-design-guidelines/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e8df6269cdae6f46", "level": "none", "message": {"text": "Commented-code block (5 lines) in vite.config.ts:7"}, "properties": {"repobilityId": "cc87cd3c9fe4a734", "scanner": "scanner-primary", "fingerprint": "e8df6269cdae6f46", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-977382fcd645feba", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/image.test.ts:101"}, "properties": {"repobilityId": "15a9fed8f20e7c2b", "scanner": "scanner-primary", "fingerprint": "977382fcd645feba", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2bb2e983393714f4", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/viewHeader.test.ts:54"}, "properties": {"repobilityId": "9050eee58a3eeeaf", "scanner": "scanner-primary", "fingerprint": "2bb2e983393714f4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d7825a38d441a12f", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/exporter.test.ts:47"}, "properties": {"repobilityId": "4b7ba1864c3fab60", "scanner": "scanner-primary", "fingerprint": "d7825a38d441a12f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-186402069eff4f3d", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/viewFilter.test.ts:391"}, "properties": {"repobilityId": "d86534b23787c427", "scanner": "scanner-primary", "fingerprint": "186402069eff4f3d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-836c134ba76a3a3a", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/server/config.test.ts:5"}, "properties": {"repobilityId": "c9016bc81f2bcc4a", "scanner": "scanner-primary", "fingerprint": "836c134ba76a3a3a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-15c39b06956161fb", "level": "none", "message": {"text": "Commented-code block (5 lines) in tests/server/settingsRoutes.test.ts:120"}, "properties": {"repobilityId": "f15e31c74366a9a3", "scanner": "scanner-primary", "fingerprint": "15c39b06956161fb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f8ff7b3707a163e8", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/build-desktop.mjs:40"}, "properties": {"repobilityId": "fb2fd3a88df14c8f", "scanner": "scanner-primary", "fingerprint": "f8ff7b3707a163e8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-571d251684e2bf16", "level": "none", "message": {"text": "Commented-code block (5 lines) in server/app.ts:13"}, "properties": {"repobilityId": "90494f5af2542598", "scanner": "scanner-primary", "fingerprint": "571d251684e2bf16", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4f16be82b94f8c9f", "level": "none", "message": {"text": "Commented-code block (6 lines) in server/db.ts:214"}, "properties": {"repobilityId": "5276e4a8314ed778", "scanner": "scanner-primary", "fingerprint": "4f16be82b94f8c9f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4e43d061e28231b5", "level": "none", "message": {"text": "Commented-code block (9 lines) in server/desktop/updateRuntime.ts:341"}, "properties": {"repobilityId": "f3a8d3a289e3c7b8", "scanner": "scanner-primary", "fingerprint": "4e43d061e28231b5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1f33aa3b763e7a38", "level": "none", "message": {"text": "Commented-code block (6 lines) in server/routes/settings.ts:104"}, "properties": {"repobilityId": "39474223a067ac32", "scanner": "scanner-primary", "fingerprint": "1f33aa3b763e7a38", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c0e6e9d7d467b72e", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/App.tsx:184"}, "properties": {"repobilityId": "a0ad8aaa95493a98", "scanner": "scanner-primary", "fingerprint": "c0e6e9d7d467b72e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f3cfc91116381910", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/components/SnapshotHistory.tsx:53"}, "properties": {"repobilityId": "4e82bd58edff8bda", "scanner": "scanner-primary", "fingerprint": "f3cfc91116381910", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c57b649a04623b8c", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/components/AuthGate.tsx:75"}, "properties": {"repobilityId": "08f3f324dbaa4a0b", "scanner": "scanner-primary", "fingerprint": "c57b649a04623b8c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6072e83bf2497424", "level": "none", "message": {"text": "Commented-code block (12 lines) in src/components/ui/ImageCropperModal.tsx:171"}, "properties": {"repobilityId": "d7fdcde31c03ea38", "scanner": "scanner-primary", "fingerprint": "6072e83bf2497424", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1fa1883ba1d78512", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/lib/api.ts:6"}, "properties": {"repobilityId": "07ed53cebabb9bd0", "scanner": "scanner-primary", "fingerprint": "1fa1883ba1d78512", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a8b674c0654abecc", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/lib/importer.ts:240"}, "properties": {"repobilityId": "2c0b859281f63939", "scanner": "scanner-primary", "fingerprint": "a8b674c0654abecc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0fd3c9282d02e4bd", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/lib/exporter.ts:277"}, "properties": {"repobilityId": "c8998d9399ea9777", "scanner": "scanner-primary", "fingerprint": "0fd3c9282d02e4bd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-96b50a9a7c59923e", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/lib/migrate.ts:181"}, "properties": {"repobilityId": "e21dd399c0011347", "scanner": "scanner-primary", "fingerprint": "96b50a9a7c59923e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e279ea0e625b0ec7", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/lib/viewHeader.ts:20"}, "properties": {"repobilityId": "506dc3a44dd282cf", "scanner": "scanner-primary", "fingerprint": "e279ea0e625b0ec7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fb52f66d282e5a24", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/lib/sectionSort.ts:96"}, "properties": {"repobilityId": "49187c797458cd37", "scanner": "scanner-primary", "fingerprint": "fb52f66d282e5a24", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-030da566069872e9", "level": "note", "message": {"text": "15 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "0519c1c0e8c1f8e4", "scanner": "scanner-primary", "fingerprint": "030da566069872e9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-37f44728de6d9103", "level": "error", "message": {"text": "Dangling fetch: POST /api/auth/logout (src/lib/api.ts:245)"}, "properties": {"repobilityId": "0f0284c732655cdf", "scanner": "scanner-primary", "fingerprint": "37f44728de6d9103", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-6eb452fbfb454d20", "level": "note", "message": {"text": "Unused endpoint: USE /api/auth"}, "properties": {"repobilityId": "5241ad692fd8ce4f", "scanner": "scanner-primary", "fingerprint": "6eb452fbfb454d20", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c04b3b0642c449e0", "level": "note", "message": {"text": "Unused endpoint: USE /api/resumes"}, "properties": {"repobilityId": "191bfb3891a891c9", "scanner": "scanner-primary", "fingerprint": "c04b3b0642c449e0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3b4a376810bee148", "level": "note", "message": {"text": "Unused endpoint: USE /api/translate"}, "properties": {"repobilityId": "f16baa3c3e30598c", "scanner": "scanner-primary", "fingerprint": "3b4a376810bee148", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c935dec635de91ea", "level": "note", "message": {"text": "Unused endpoint: USE /api/backup"}, "properties": {"repobilityId": "67b6acca7da57754", "scanner": "scanner-primary", "fingerprint": "c935dec635de91ea", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8ca4664c9cda1cd6", "level": "note", "message": {"text": "Unused endpoint: USE /api/settings"}, "properties": {"repobilityId": "e56efa865a115156", "scanner": "scanner-primary", "fingerprint": "8ca4664c9cda1cd6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ced75d1c29602761", "level": "note", "message": {"text": "Unused endpoint: USE /api/update"}, "properties": {"repobilityId": "470606f0959687cf", "scanner": "scanner-primary", "fingerprint": "ced75d1c29602761", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-618721b912bad1c2", "level": "note", "message": {"text": "Unused endpoint: POST /login"}, "properties": {"repobilityId": "bb03ad9b5da2e65b", "scanner": "scanner-primary", "fingerprint": "618721b912bad1c2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-99fc36db98c134ce", "level": "note", "message": {"text": "Unused endpoint: POST /logout"}, "properties": {"repobilityId": "221d213665cbb011", "scanner": "scanner-primary", "fingerprint": "99fc36db98c134ce", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "710181c24660ddba", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a009b1a56794f45", "level": "note", "message": {"text": "Unused endpoint: POST /"}, "properties": {"repobilityId": "1c8fef8d45becc93", "scanner": "scanner-primary", "fingerprint": "7a009b1a56794f45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a21936a38b7671a9", "level": "note", "message": {"text": "Unused endpoint: GET /storage"}, "properties": {"repobilityId": "35a5541a91de073c", "scanner": "scanner-primary", "fingerprint": "a21936a38b7671a9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-db0993b39976b123", "level": "note", "message": {"text": "Unused endpoint: GET /:id/snapshots"}, "properties": {"repobilityId": "63a4d399ea938875", "scanner": "scanner-primary", "fingerprint": "db0993b39976b123", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d0f1587316841daa", "level": "note", "message": {"text": "Unused endpoint: GET /:id/snapshots/:sid"}, "properties": {"repobilityId": "89ce0eff8d0fe46f", "scanner": "scanner-primary", "fingerprint": "d0f1587316841daa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ca5756175765b49d", "level": "note", "message": {"text": "Unused endpoint: GET /:id"}, "properties": {"repobilityId": "aa3574dab1bc2a56", "scanner": "scanner-primary", "fingerprint": "ca5756175765b49d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8d5b2b188d08ca82", "level": "note", "message": {"text": "Unused endpoint: PUT /:id"}, "properties": {"repobilityId": "be44da6bb08a4caf", "scanner": "scanner-primary", "fingerprint": "8d5b2b188d08ca82", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5fbc954f63526821", "level": "note", "message": {"text": "Unused endpoint: PATCH /:id"}, "properties": {"repobilityId": "4a9615b23685581f", "scanner": "scanner-primary", "fingerprint": "5fbc954f63526821", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a61c112b611f4bb", "level": "note", "message": {"text": "Unused endpoint: DELETE /:id"}, "properties": {"repobilityId": "7bad453cbed4e0b4", "scanner": "scanner-primary", "fingerprint": "7a61c112b611f4bb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-554ffd052999fac9", "level": "note", "message": {"text": "Unused endpoint: POST /check"}, "properties": {"repobilityId": "282b0a89dd503aab", "scanner": "scanner-primary", "fingerprint": "554ffd052999fac9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-083fba8d34bf5011", "level": "note", "message": {"text": "Unused endpoint: POST /install"}, "properties": {"repobilityId": "a0e517590f05ca19", "scanner": "scanner-primary", "fingerprint": "083fba8d34bf5011", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bc797ac64a533cac", "level": "note", "message": {"text": "Unused endpoint: POST /now"}, "properties": {"repobilityId": "c4e5a81a15c48ba6", "scanner": "scanner-primary", "fingerprint": "bc797ac64a533cac", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-947ea837b34b3691", "level": "note", "message": {"text": "Unused endpoint: POST /restore"}, "properties": {"repobilityId": "c89105b6d7cd03eb", "scanner": "scanner-primary", "fingerprint": "947ea837b34b3691", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-67d28fa8cd6bb12f", "level": "note", "message": {"text": "Unused endpoint: PUT /"}, "properties": {"repobilityId": "3911713bc357e875", "scanner": "scanner-primary", "fingerprint": "67d28fa8cd6bb12f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9a7df074602bebca", "level": "note", "message": {"text": "Unused endpoint: POST /translate/test"}, "properties": {"repobilityId": "dd7933a19e596ff0", "scanner": "scanner-primary", "fingerprint": "9a7df074602bebca", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c6dc00baa14b97f0", "level": "note", "message": {"text": "Unused endpoint: POST /docker"}, "properties": {"repobilityId": "801e345c0fadaecc", "scanner": "scanner-primary", "fingerprint": "c6dc00baa14b97f0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}