{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-bead75b0f9233e05", "name": "No API endpoints detected", "shortDescription": {"text": "No API endpoints detected"}, "fullDescription": {"text": "The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "info", "confidence": 1.0}}, {"id": "scanner-827ec3eb0bf93095", "name": "Insecure pattern 'domparser_html_parse' in src/shared/utils/html.ts:2", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in src/shared/utils/html.ts:2"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb639d9a10a47b23", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b0c30d88a17d4d9e", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/shared/testing/fixtures.ts:15", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/shared/testing/fixtures.ts:15"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-231567e3d5cbbbea", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/routing/loaders/root-index-loader.test.ts:50", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/routing/loaders/root-index-loader.test.ts:50"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d09813567e65a857", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/features/board/import/import-from-url.ts:4", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/features/board/import/import-from-url.ts:4"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9dc37309efc85140", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/features/board/storage/board-hydration.test.ts:20", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/features/board/storage/board-hydration.test.ts:20"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5c4de94eb4fdad4f", "name": "Frontend route `/sets/:setId/boards/:boardId` has no Link/navigate to it \u2014 src/features/board/navigation/use-board-navig", "shortDescription": {"text": "Frontend route `/sets/:setId/boards/:boardId` has no Link/navigate to it \u2014 src/features/board/navigation/use-board-navigation.test.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-86d1a85b327a562c", "name": "Frontend route `/boards/:boardId` has no Link/navigate to it \u2014 src/features/board/navigation/use-board-navigation.test.t", "shortDescription": {"text": "Frontend route `/boards/:boardId` has no Link/navigate to it \u2014 src/features/board/navigation/use-board-navigation.test.tsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19433"}, "properties": {"repository": "shayc/aac-board-ai", "repoUrl": "https://github.com/shayc/aac-board-ai", "branch": "main"}, "results": [{"ruleId": "scanner-bead75b0f9233e05", "level": "none", "message": {"text": "No API endpoints detected"}, "properties": {"repobilityId": "0f8bb852027c38f8", "scanner": "scanner-primary", "fingerprint": "bead75b0f9233e05", "layer": "api", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-827ec3eb0bf93095", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in src/shared/utils/html.ts:2"}, "properties": {"repobilityId": "56aa4ae367b328a5", "scanner": "scanner-primary", "fingerprint": "827ec3eb0bf93095", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/shared/utils/html.ts"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "97a9a5de61d82fcd", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4a63b1fd6887cae9", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-cb639d9a10a47b23", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "b86179956da3a4a8", "scanner": "scanner-primary", "fingerprint": "cb639d9a10a47b23", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "be3e2f1969f92edd", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "eb1c7c74ab2620a9", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-b0c30d88a17d4d9e", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/shared/testing/fixtures.ts:15"}, "properties": {"repobilityId": "1a449150625b6943", "scanner": "scanner-primary", "fingerprint": "b0c30d88a17d4d9e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-231567e3d5cbbbea", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/app/routing/loaders/root-index-loader.test.ts:50"}, "properties": {"repobilityId": "498c58b71796786d", "scanner": "scanner-primary", "fingerprint": "231567e3d5cbbbea", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d09813567e65a857", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/features/board/import/import-from-url.ts:4"}, "properties": {"repobilityId": "1f63697f131fffe5", "scanner": "scanner-primary", "fingerprint": "d09813567e65a857", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9dc37309efc85140", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/features/board/storage/board-hydration.test.ts:20"}, "properties": {"repobilityId": "1a754b3d5113b2e4", "scanner": "scanner-primary", "fingerprint": "9dc37309efc85140", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-5c4de94eb4fdad4f", "level": "warning", "message": {"text": "Frontend route `/sets/:setId/boards/:boardId` has no Link/navigate to it \u2014 src/features/board/navigation/use-board-navigation.test.tsx"}, "properties": {"repobilityId": "e487dce8e3200a12", "scanner": "scanner-primary", "fingerprint": "5c4de94eb4fdad4f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-86d1a85b327a562c", "level": "warning", "message": {"text": "Frontend route `/boards/:boardId` has no Link/navigate to it \u2014 src/features/board/navigation/use-board-navigation.test.tsx"}, "properties": {"repobilityId": "d287d67d131dbd11", "scanner": "scanner-primary", "fingerprint": "86d1a85b327a562c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}]}]}