{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "MINED111", "name": "[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or ", "shortDescription": {"text": "[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose."}, "fullDescription": {"text": "Either narrow the exception type, log the exception with `logger.exception(...)`, or re-raise after handling."}, "properties": {"scanner": "repobility-ast-engine", "category": "quality", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "AUC009", "name": "[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function", "shortDescription": {"text": "[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /de"}, "fullDescription": {"text": "Require an explicit admin, maintainer, super_admin, or scoped service role in code and .repobility/access.yml."}, "properties": {"scanner": "repobility-access-control", "category": "auth", "severity": "medium", "confidence": 0.68, "cwe": "", "owasp": ""}}, {"id": "AUC004", "name": "[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence ", "shortDescription": {"text": "[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: PATCH /settings."}, "fullDescription": {"text": "Define whether this endpoint is admin-only or super_admin-only, then enforce that distinction in code and .repobility/access.yml."}, "properties": {"scanner": "repobility-access-control", "category": "auth", "severity": "medium", "confidence": 0.66, "cwe": "", "owasp": ""}}, {"id": "AUC002", "name": "[AUC002] Low visible authorization coverage in route inventory: Only 17.3% of discovered routes show nearby authenticati", "shortDescription": {"text": "[AUC002] Low visible authorization coverage in route inventory: Only 17.3% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence."}, "fullDescription": {"text": "Review the access matrix and add explicit framework auth declarations or policy-file exceptions for intentionally public routes."}, "properties": {"scanner": "repobility-access-control", "category": "auth", "severity": "medium", "confidence": 0.74, "cwe": "", "owasp": ""}}, {"id": "AUC001", "name": "[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobilit", "shortDescription": {"text": "[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation."}, "fullDescription": {"text": "Add .repobility/access.yml mapping routes to anonymous, authenticated, owner, admin, and super_admin. Keep business-specific rules in the repo so CI can enforce them."}, "properties": {"scanner": "repobility-access-control", "category": "auth", "severity": "medium", "confidence": 0.92, "cwe": "", "owasp": ""}}, {"id": "DKC013", "name": "Database service has no persistent data volume", "shortDescription": {"text": "Database service has no persistent data volume"}, "fullDescription": {"text": "Mount the database data directory to a named Docker volume or managed persistent disk, and document backup and restore testing."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "medium", "confidence": 0.74, "cwe": "", "owasp": ""}}, {"id": "DKR001", "name": "Docker final stage has no non-root USER", "shortDescription": {"text": "Docker final stage has no non-root USER"}, "fullDescription": {"text": "Add a non-root USER in the final runtime stage after files and permissions are prepared."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "medium", "confidence": 0.82, "cwe": "", "owasp": ""}}, {"id": "DKR014", "name": "Dockerfile copies broad context with incomplete .dockerignore", "shortDescription": {"text": "Dockerfile copies broad context with incomplete .dockerignore"}, "fullDescription": {"text": "Tighten .dockerignore or replace COPY . with explicit COPY statements."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "medium", "confidence": 0.76, "cwe": "", "owasp": ""}}, {"id": "SEC045", "name": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a latera", "shortDescription": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use obj"}, "fullDescription": {"text": "For literal data structures: use ast.literal_eval(text) \u2014 only parses literals, raises on code.\nFor formula evaluation: use asteval or simpleeval (purpose-built sandboxes with allow-lists).\nFor Odoo: use odoo.tools.safe_eval(expr, locals_dict, mode='exec').\nIf you genuinely need to execute admin-stored code: require explicit super-admin permission AND log every execution with a stack trace."}, "properties": {"scanner": "repobility-threat-engine", "category": "injection", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC091", "name": "[SEC091] Go: net/http server without timeouts: HTTP server without ReadHeaderTimeout/ReadTimeout/WriteTimeout is vulnera", "shortDescription": {"text": "[SEC091] Go: net/http server without timeouts: HTTP server without ReadHeaderTimeout/ReadTimeout/WriteTimeout is vulnerable to Slowloris. Ported from gosec G112 + G114 (Apache-2.0)."}, "fullDescription": {"text": "Construct `&http.Server{Addr: ..., ReadHeaderTimeout: 5*time.Second, ReadTimeout: 10*time.Second, WriteTimeout: 30*time.Second}`."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "medium", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "CORE_NO_CI", "name": "No CI/CD configuration found", "shortDescription": {"text": "No CI/CD configuration found"}, "fullDescription": {"text": "Add a CI/CD pipeline: create .github/workflows/ci.yml for GitHub Actions with steps to lint, test, and build on every push and pull request."}, "properties": {"scanner": "repobility-core", "category": "practices", "severity": "medium", "confidence": null, "cwe": "", "owasp": ""}}, {"id": "DKC010", "name": "Compose service lacks no-new-privileges hardening", "shortDescription": {"text": "Compose service lacks no-new-privileges hardening"}, "fullDescription": {"text": "Add `security_opt: [\"no-new-privileges:true\"]` unless the service has a documented need for privilege escalation."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "low", "confidence": 0.62, "cwe": "", "owasp": ""}}, {"id": "DKC006", "name": "Compose service does not declare a runtime user", "shortDescription": {"text": "Compose service does not declare a runtime user"}, "fullDescription": {"text": "Set a non-root `user:` in Compose or ensure the final image stage has a non-root USER directive."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "low", "confidence": 0.56, "cwe": "", "owasp": ""}}, {"id": "DKC017", "name": "Database password is wired through an environment variable placeholder", "shortDescription": {"text": "Database password is wired through an environment variable placeholder"}, "fullDescription": {"text": "Prefer Compose secrets or your platform secret manager with *_FILE variables where the image supports them. Rotate only if a real value was committed."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "low", "confidence": 0.58, "cwe": "", "owasp": ""}}, {"id": "DKR008", "name": ".dockerignore misses sensitive defaults", "shortDescription": {"text": ".dockerignore misses sensitive defaults"}, "fullDescription": {"text": "Add missing patterns such as .env, .git, private keys, certificates, dependency folders, and local databases."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "low", "confidence": 0.72, "cwe": "", "owasp": ""}}, {"id": "AIC003", "name": "Duplicated implementation block across source files", "shortDescription": {"text": "Duplicated implementation block across source files"}, "fullDescription": {"text": "Extract the shared behavior into one function/module or delete the inactive duplicate after proving which path is used."}, "properties": {"scanner": "repobility-ai-code-hygiene", "category": "quality", "severity": "low", "confidence": 0.86, "cwe": "", "owasp": ""}}, {"id": "ERR003", "name": "[ERR003] Ignored Error (Go): Ignoring error return values.", "shortDescription": {"text": "[ERR003] Ignored Error (Go): Ignoring error return values."}, "fullDescription": {"text": "Handle the error or use errcheck linter."}, "properties": {"scanner": "repobility-threat-engine", "category": "error_handling", "severity": "low", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "CORE_NO_LICENSE", "name": "No LICENSE file", "shortDescription": {"text": "No LICENSE file"}, "fullDescription": {"text": "Add a LICENSE file to your repository. Use choosealicense.com to pick the right license (MIT for permissive, Apache 2.0 for patent protection, GPL for copyleft)."}, "properties": {"scanner": "repobility-core", "category": "documentation", "severity": "low", "confidence": null, "cwe": "", "owasp": ""}}, {"id": "DKR002", "name": "Compose service `minio` image is selected through a build variable", "shortDescription": {"text": "Compose service `minio` image is selected through a build variable"}, "fullDescription": {"text": "Resolve the variable to a versioned tag or digest in production builds and document the allowed images."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "info", "confidence": 0.48, "cwe": "", "owasp": ""}}, {"id": "MINED071", "name": "[MINED071] Go Panic Call: panic() crashes the process. Should return error in most cases.", "shortDescription": {"text": "[MINED071] Go Panic Call: panic() crashes the process. Should return error in most cases."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-755 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED053", "name": "[MINED053] Placeholder Default Username: foo@bar.com / john.doe@example.com / admin/admin / changeme \u2014 typical AI placeh", "shortDescription": {"text": "[MINED053] Placeholder Default Username: foo@bar.com / john.doe@example.com / admin/admin / changeme \u2014 typical AI placeholder credentials."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-1392,CWE-798 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED033", "name": "[MINED033] Go Recover Without Log (and 2 more): Same pattern found in 2 additional files. Review if needed.", "shortDescription": {"text": "[MINED033] Go Recover Without Log (and 2 more): Same pattern found in 2 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-755 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED043", "name": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data.", "shortDescription": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-319 / A02:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED016", "name": "[MINED016] Go Error Ignored (and 7 more): Same pattern found in 7 additional files. Review if needed.", "shortDescription": {"text": "[MINED016] Go Error Ignored (and 7 more): Same pattern found in 7 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-754 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED060", "name": "[MINED060] Go Context No Cancel (and 26 more): Same pattern found in 26 additional files. Review if needed.", "shortDescription": {"text": "[MINED060] Go Context No Cancel (and 26 more): Same pattern found in 26 additional files. Review if needed."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-401 /  for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "info", "confidence": 0.2, "cwe": "", "owasp": ""}}, {"id": "MINED118", "name": "[MINED118] Dockerfile FROM `alpine:3.21` not pinned by digest: `FROM alpine:3.21` resolves the tag at build time. The re", "shortDescription": {"text": "[MINED118] Dockerfile FROM `alpine:3.21` not pinned by digest: `FROM alpine:3.21` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should"}, "fullDescription": {"text": "Replace with: `FROM alpine:3.21@sha256:<digest>`. Get the digest from `docker manifest inspect`. Re-pin via a scheduled bot (Renovate, Dependabot)."}, "properties": {"scanner": "repobility-supply-chain", "category": "dependency", "severity": "high", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "MINED106", "name": "[MINED106] Phantom test coverage: test_group_interfaces: Test function `test_group_interfaces` runs code but contains no", "shortDescription": {"text": "[MINED106] Phantom test coverage: test_group_interfaces: Test function `test_group_interfaces` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "fullDescription": {"text": "Add an explicit assertion that captures the test's intent, or remove the test."}, "properties": {"scanner": "repobility-ast-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "AUC003", "name": "[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby a", "shortDescription": {"text": "[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /:groupUuid/my-join-applicatio"}, "fullDescription": {"text": "Add ownership, tenant, relationship, or policy checks before reading or mutating the target object."}, "properties": {"scanner": "repobility-access-control", "category": "auth", "severity": "high", "confidence": 0.7, "cwe": "", "owasp": ""}}, {"id": "DKC011", "name": "Database service publishes a host port", "shortDescription": {"text": "Database service publishes a host port"}, "fullDescription": {"text": "Use `expose` for service-to-service access, bind to 127.0.0.1 for local-only access, or protect the port with firewall rules."}, "properties": {"scanner": "repobility-docker", "category": "docker", "severity": "high", "confidence": 0.84, "cwe": "", "owasp": ""}}, {"id": "SEC085", "name": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. ", "shortDescription": {"text": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0)."}, "fullDescription": {"text": "Use execFile / spawn with separate args array; never pass shell strings."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC128", "name": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake): Async call invoked without `await` returns", "shortDescription": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes \u2014 DB writes lost, emails not sent, ra"}, "fullDescription": {"text": "Add `await` before each async call, or chain with `.then`. If you intentionally want fire-and-forget, prefix with `void` (TS) or assign to `_` (Python with `asyncio.create_task`) to make the intent explicit and survive lint."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "MINED004", "name": "[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums).", "shortDescription": {"text": "[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums)."}, "fullDescription": {"text": "Review and fix per the pattern semantics. See CWE-327 / A02:2021 for context."}, "properties": {"scanner": "repobility-threat-engine", "category": "quality", "severity": "high", "confidence": 1.0, "cwe": "", "owasp": ""}}, {"id": "SEC020", "name": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequen", "shortDescription": {"text": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for troubleshooting."}, "fullDescription": {"text": "Log only redacted, hashed, or last-four-style metadata. Rotate any secret that may have reached logs."}, "properties": {"scanner": "repobility-threat-engine", "category": "credential_exposure", "severity": "high", "confidence": 0.85, "cwe": "", "owasp": ""}}, {"id": "SEC001", "name": "[SEC001] Hardcoded Password: Hardcoded password found in source code.", "shortDescription": {"text": "[SEC001] Hardcoded Password: Hardcoded password found in source code."}, "fullDescription": {"text": "Use environment variables or a secrets manager."}, "properties": {"scanner": "repobility-threat-engine", "category": "credential_exposure", "severity": "critical", "confidence": 0.9, "cwe": "", "owasp": ""}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-86f709d148d54907", "name": "Docker base image is tag-pinned but not digest-pinned: golang:1.25-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: golang:1.25-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-33d1d1cc6ee6ad3c", "name": "Docker base image is tag-pinned but not digest-pinned: alpine:3.21", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: alpine:3.21"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-35e3c3ffa0733836", "name": "Possible secret in docker-compose.yml", "shortDescription": {"text": "Possible secret in docker-compose.yml"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6694c18359abe2c1", "name": "Very large file: apps/group/internal/repository/group_repository.go (2026 lines)", "shortDescription": {"text": "Very large file: apps/group/internal/repository/group_repository.go (2026 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a4d3d0df7667fbd", "name": "Very large file: scripts/gateway_blackbox_test.py (1674 lines)", "shortDescription": {"text": "Very large file: scripts/gateway_blackbox_test.py (1674 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 19 placeholder/mock markers across 6 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ad6df829cfc62dd3", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/gateway_blackbox_test.py:343", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/gateway_blackbox_test.py:343"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nscripts/gateway_blackbox_test.py:redis_set_direct, scripts/gateway_blackbox_test.py:redis_set\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23758"}, "properties": {"repository": "013677890/LCchat-Backend", "repoUrl": "https://github.com/013677890/LCchat-Backend", "branch": "main"}, "results": [{"ruleId": "MINED111", "level": "warning", "message": {"text": "[MINED111] Bare except continues silently: Bare `except:` (or `except Exception:`) that runs code without re-raising or logging the exception. Hides real failures and makes bugs hard to diagnose."}, "properties": {"repobilityId": 223575, "scanner": "repobility-ast-engine", "fingerprint": "9302752d7692a672c7d4a632c5e10e54cf8a70123f0e70cbd99e09c47d47a392", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "bare-except-without-pass", "owasp": null, "cwe_ids": [], "languages": ["python"], "observations_count": 21610}, "scanner": "repobility-ast-engine", "correlation_key": "fp|9302752d7692a672c7d4a632c5e10e54cf8a70123f0e70cbd99e09c47d47a392"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/gateway_blackbox_test.py"}, "region": {"startLine": 1666}}}]}, {"ruleId": "AUC009", "level": "warning", "message": {"text": "[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /devices."}, "properties": {"repobilityId": 223570, "scanner": "repobility-access-control", "fingerprint": "5de0604f472637d35d54346e7795f78b24d2b913a6945623dc1d801e4aac5e35", "category": "auth", "severity": "medium", "confidence": 0.68, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/devices", "method": "GET", "scanner": "repobility-access-control", "framework": "Gin", "correlation_key": "code|auth|token|194|auc009", "identity_targets": ["unknown"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/internal/router/router.go"}, "region": {"startLine": 194}}}]}, {"ruleId": "AUC009", "level": "warning", "message": {"text": "[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /batch-profile."}, "properties": {"repobilityId": 223569, "scanner": "repobility-access-control", "fingerprint": "3f61348a258fa451c9f3969aabd8190aa3d0ea3d06699ad312e1f37dca2bfa46", "category": "auth", "severity": "medium", "confidence": 0.68, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/batch-profile", "method": "POST", "scanner": "repobility-access-control", "framework": "Gin", "correlation_key": "code|auth|token|193|auc009", "identity_targets": ["unknown"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/internal/router/router.go"}, "region": {"startLine": 193}}}]}, {"ruleId": "AUC009", "level": "warning", "message": {"text": "[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /qrcode."}, "properties": {"repobilityId": 223568, "scanner": "repobility-access-control", "fingerprint": "2c9a56e39ef55b05f189ddeb7393145919ad82bf37091a1342115636245dd963", "category": "auth", "severity": "medium", "confidence": 0.68, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/qrcode", "method": "GET", "scanner": "repobility-access-control", "framework": "Gin", "correlation_key": "code|auth|token|192|auc009", "identity_targets": ["unknown"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/internal/router/router.go"}, "region": {"startLine": 192}}}]}, {"ruleId": "AUC009", "level": "warning", "message": {"text": "[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /avatar."}, "properties": {"repobilityId": 223567, "scanner": "repobility-access-control", "fingerprint": "545c2f2b073a3fa935bcf77bb31d81c6ddf2a7551d9bff91f026ea57206365e4", "category": "auth", "severity": "medium", "confidence": 0.68, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/avatar", "method": "POST", "scanner": "repobility-access-control", "framework": "Gin", "correlation_key": "code|auth|token|191|auc009", "identity_targets": ["unknown"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/internal/router/router.go"}, "region": {"startLine": 191}}}]}, {"ruleId": "AUC009", "level": "warning", "message": {"text": "[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /search."}, "properties": {"repobilityId": 223566, "scanner": "repobility-access-control", "fingerprint": "a78bf3f3bc7d7a6d1aa1d512177672e389e7742ef4a8e449177cae5a17b29886", "category": "auth", "severity": "medium", "confidence": 0.68, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/search", "method": "GET", "scanner": "repobility-access-control", "framework": "Gin", "correlation_key": "code|auth|token|190|auc009", "identity_targets": ["unknown"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/internal/router/router.go"}, "region": {"startLine": 190}}}]}, {"ruleId": "AUC009", "level": "warning", "message": {"text": "[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /profile/:userUuid."}, "properties": {"repobilityId": 223565, "scanner": "repobility-access-control", "fingerprint": "965d77f5dc1819c93659c15605f23e41cc46c01144ffac33dffe550290db4b9f", "category": "auth", "severity": "medium", "confidence": 0.68, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/profile/:userUuid", "method": "GET", "scanner": "repobility-access-control", "framework": "Gin", "correlation_key": "code|auth|token|189|auc009", "identity_targets": ["unknown", "owner"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/internal/router/router.go"}, "region": {"startLine": 189}}}]}, {"ruleId": "AUC009", "level": "warning", "message": {"text": "[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /parse-qrcode."}, "properties": {"repobilityId": 223564, "scanner": "repobility-access-control", "fingerprint": "878c0d418d0647fac39f657b2cba638f220942e1c0eb0edc15b35aecee196cdf", "category": "auth", "severity": "medium", "confidence": 0.68, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/parse-qrcode", "method": "POST", "scanner": "repobility-access-control", "framework": "Gin", "correlation_key": "code|auth|token|172|auc009", "identity_targets": ["authenticated"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/internal/router/router.go"}, "region": {"startLine": 172}}}]}, {"ruleId": "AUC009", "level": "warning", "message": {"text": "[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /verify-code."}, "properties": {"repobilityId": 223563, "scanner": "repobility-access-control", "fingerprint": "27034765a02355b53bde10cbb9adb013989479481648552c29eb76ad7117bfa5", "category": "auth", "severity": "medium", "confidence": 0.68, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/verify-code", "method": "POST", "scanner": "repobility-access-control", "framework": "Gin", "correlation_key": "code|auth|token|171|auc009", "identity_targets": ["authenticated"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/internal/router/router.go"}, "region": {"startLine": 171}}}]}, {"ruleId": "AUC009", "level": "warning", "message": {"text": "[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: POST /refresh-token."}, "properties": {"repobilityId": 223562, "scanner": "repobility-access-control", "fingerprint": "6c042cd9c2d1af1e9fe898b15c047b1f3a4099b8349f4c564d4ea6efbeea8ed2", "category": "auth", "severity": "medium", "confidence": 0.68, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/refresh-token", "method": "POST", "scanner": "repobility-access-control", "framework": "Gin", "correlation_key": "code|auth|token|170|auc009", "identity_targets": ["unknown"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/internal/router/router.go"}, "region": {"startLine": 170}}}]}, {"ruleId": "AUC009", "level": "warning", "message": {"text": "[AUC009] Sensitive function route lacks elevated authorization evidence: A route appears to perform a sensitive function such as export, invite, role, token, billing, or destructive action without elevated policy evidence. Endpoint: GET /Origin."}, "properties": {"repobilityId": 223561, "scanner": "repobility-access-control", "fingerprint": "8237fc1f0c171b3e22207880d2ea5c1adf50174ae09373b7ba7fa56db76abd17", "category": "auth", "severity": "medium", "confidence": 0.68, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/Origin", "method": "GET", "scanner": "repobility-access-control", "framework": "Gin", "correlation_key": "code|auth|token|33|auc009", "identity_targets": ["authenticated"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/internal/middleware/cors.go"}, "region": {"startLine": 33}}}]}, {"ruleId": "AUC004", "level": "warning", "message": {"text": "[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: PATCH /settings."}, "properties": {"repobilityId": 223560, "scanner": "repobility-access-control", "fingerprint": "985004bab518adc414b4c49ad321c826f1fa5d8b02ac39ea9fe42bef79d83f81", "category": "auth", "severity": "medium", "confidence": 0.66, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/settings", "method": "PATCH", "scanner": "repobility-access-control", "framework": "Gin", "correlation_key": "code|auth|token|247|auc004", "identity_targets": ["unknown", "admin"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/internal/router/router.go"}, "region": {"startLine": 247}}}]}, {"ruleId": "AUC004", "level": "warning", "message": {"text": "[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /ws."}, "properties": {"repobilityId": 223559, "scanner": "repobility-access-control", "fingerprint": "ca4c4db700d0224862f4aa1a36a5cd7561db43a3b28a8caaccadc264d3b37a3d", "category": "auth", "severity": "medium", "confidence": 0.66, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/ws", "method": "GET", "scanner": "repobility-access-control", "framework": "Gin", "correlation_key": "code|auth|token|85|auc004", "identity_targets": ["unknown", "admin"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/connect/internal/server/server.go"}, "region": {"startLine": 85}}}]}, {"ruleId": "AUC004", "level": "warning", "message": {"text": "[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /metrics."}, "properties": {"repobilityId": 223558, "scanner": "repobility-access-control", "fingerprint": "81ac8a9bbfdfdab39f193c279ca59620f0a8df3f7d4b844e790cb4f5f0e1c155", "category": "auth", "severity": "medium", "confidence": 0.66, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/metrics", "method": "GET", "scanner": "repobility-access-control", "framework": "Gin", "correlation_key": "code|auth|token|77|auc004", "identity_targets": ["anonymous", "authenticated"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/connect/internal/server/server.go"}, "region": {"startLine": 77}}}]}, {"ruleId": "AUC004", "level": "warning", "message": {"text": "[AUC004] Admin route does not show super_admin separation: An administrative route was detected without nearby evidence that platform super_admin access is separated from tenant/application admin access. Endpoint: GET /health."}, "properties": {"repobilityId": 223557, "scanner": "repobility-access-control", "fingerprint": "8f4f99ef4ca7c88e95dca88a522f802f03d0439edb79a87674a784d857270bd2", "category": "auth", "severity": "medium", "confidence": 0.66, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/health", "method": "GET", "scanner": "repobility-access-control", "framework": "Gin", "correlation_key": "code|auth|token|70|auc004", "identity_targets": ["anonymous", "authenticated"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/connect/internal/server/server.go"}, "region": {"startLine": 70}}}]}, {"ruleId": "AUC002", "level": "warning", "message": {"text": "[AUC002] Low visible authorization coverage in route inventory: Only 17.3% of discovered routes show nearby authentication, authorization, middleware, or public-route evidence."}, "properties": {"repobilityId": 223541, "scanner": "repobility-access-control", "fingerprint": "eb4e1c601ae30061312e69b8f13eef1472774e6a11113417c7c3585723817bd7", "category": "auth", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"scanner": "repobility-access-control", "endpoint_count": 104, "correlation_key": "fp|eb4e1c601ae30061312e69b8f13eef1472774e6a11113417c7c3585723817bd7", "auth_visible_percent": 17.3}}}, {"ruleId": "AUC001", "level": "warning", "message": {"text": "[AUC001] No Repobility access matrix policy found: The repository uses web/API frameworks but does not define .repobility/access.yml or equivalent authorization documentation."}, "properties": {"repobilityId": 223538, "scanner": "repobility-access-control", "fingerprint": "f1305052c3ba1e6c1cdb5dccc19e58a8168cf78b176658f32b1fc823df3e9d10", "category": "auth", "severity": "medium", "confidence": 0.92, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"scanner": "repobility-access-control", "frameworks": ["Gin"], "expected_files": [".repobility/access.yml", ".repobility/access.yaml", ".repobility/access.json", ".repobility/authorization.yml"], "correlation_key": "fp|f1305052c3ba1e6c1cdb5dccc19e58a8168cf78b176658f32b1fc823df3e9d10"}}}, {"ruleId": "DKC013", "level": "warning", "message": {"text": "Database service has no persistent data volume"}, "properties": {"repobilityId": 223501, "scanner": "repobility-docker", "fingerprint": "0b801bf8ccab9c3cf229f01674f537899d47b134240600850cfd03084738f147", "category": "docker", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Database-like service does not mount a known data directory.", "evidence": {"rule_id": "DKC013", "scanner": "repobility-docker", "service": "kafka-connect", "references": ["https://docs.docker.com/engine/storage/volumes/"], "correlation_key": "fp|0b801bf8ccab9c3cf229f01674f537899d47b134240600850cfd03084738f147", "expected_targets": ["/bitnami/kafka", "/var/lib/kafka/data"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 73}}}]}, {"ruleId": "DKC013", "level": "warning", "message": {"text": "Database service has no persistent data volume"}, "properties": {"repobilityId": 223488, "scanner": "repobility-docker", "fingerprint": "64ba448a96d94b982b66760e280a0cd5ec7d10d65d2c8ec572f3fb7dab933e40", "category": "docker", "severity": "medium", "confidence": 0.74, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Database-like service does not mount a known data directory.", "evidence": {"rule_id": "DKC013", "scanner": "repobility-docker", "service": "kafka", "references": ["https://docs.docker.com/engine/storage/volumes/"], "correlation_key": "fp|64ba448a96d94b982b66760e280a0cd5ec7d10d65d2c8ec572f3fb7dab933e40", "expected_targets": ["/bitnami/kafka", "/var/lib/kafka/data"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 47}}}]}, {"ruleId": "DKR001", "level": "warning", "message": {"text": "Docker final stage has no non-root USER"}, "properties": {"repobilityId": 223473, "scanner": "repobility-docker", "fingerprint": "feb548057a256076c3b022fd93e70f4d97d8bc5100bf34647720559db7630416", "category": "docker", "severity": "medium", "confidence": 0.82, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "No USER directive was found in the final runtime stage.", "evidence": {"rule_id": "DKR001", "scanner": "repobility-docker", "final_base": "alpine:3.21", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html", "https://github.com/hadolint/hadolint"], "correlation_key": "fp|feb548057a256076c3b022fd93e70f4d97d8bc5100bf34647720559db7630416"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 27}}}]}, {"ruleId": "DKR014", "level": "warning", "message": {"text": "Dockerfile copies broad context with incomplete .dockerignore"}, "properties": {"repobilityId": 223471, "scanner": "repobility-docker", "fingerprint": "dd75da3d09ed883daa831ef8d2683f4d6ce9295f58b3a00601fb91a4a3d894ab", "category": "docker", "severity": "medium", "confidence": 0.76, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Broad context copy found and .dockerignore misses sensitive defaults.", "evidence": {"rule_id": "DKR014", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/"], "correlation_key": "fp|dd75da3d09ed883daa831ef8d2683f4d6ce9295f58b3a00601fb91a4a3d894ab", "missing_patterns": [".env", "id_rsa", "*.pem", "*.key"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 14}}}]}, {"ruleId": "SEC045", "level": "warning", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use object introspection (().__class__.__mro__[-1].__subclasses__()) to reach os.system. CWE-95 (eval injection)."}, "properties": {"repobilityId": 223311, "scanner": "repobility-threat-engine", "fingerprint": "0bdeccdaa041f50ef87219e5bdfadd712fee11e412cf576805a557e00cb002ba", "category": "injection", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".Exec(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|pkg/redisretry/consumer.go|153|sec045"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/redisretry/consumer.go"}, "region": {"startLine": 153}}}]}, {"ruleId": "SEC045", "level": "warning", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use object introspection (().__class__.__mro__[-1].__subclasses__()) to reach os.system. CWE-95 (eval injection)."}, "properties": {"repobilityId": 223310, "scanner": "repobility-threat-engine", "fingerprint": "78fe9b70c17f7720dd43f9c740a227d51d8e91de254e6ad521f0ac76d106a40f", "category": "injection", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".Exec(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|token|73|sec045"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/message-push/internal/route/repository.go"}, "region": {"startLine": 73}}}]}, {"ruleId": "SEC045", "level": "warning", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data: eval() and exec() on data \u2014 even admin-stored data \u2014 is a lateral-movement vector after any one credential compromise. Sandboxes (__builtins__ cleared) are escapable: attackers use object introspection (().__class__.__mro__[-1].__subclasses__()) to reach os.system. CWE-95 (eval injection)."}, "properties": {"repobilityId": 223309, "scanner": "repobility-threat-engine", "fingerprint": "d81a4baa7f5719d652f6ec4bddff53cf12080cd3d1b897164670d31fddb299b6", "category": "injection", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": ".Exec(", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "code|injection|token|28|sec045"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/connect/internal/svc/routing.go"}, "region": {"startLine": 28}}}]}, {"ruleId": "SEC091", "level": "warning", "message": {"text": "[SEC091] Go: net/http server without timeouts: HTTP server without ReadHeaderTimeout/ReadTimeout/WriteTimeout is vulnerable to Slowloris. Ported from gosec G112 + G114 (Apache-2.0)."}, "properties": {"repobilityId": 223261, "scanner": "repobility-threat-engine", "fingerprint": "415600dfe99ff3e11b86be02a4f9f0df18978f8251238a4801aa660f62893c99", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "http.Server {\n\treturn grpcx.NewMetricsHTTPServer(string(addr), built.Metrics)\n}", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC091", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|415600dfe99ff3e11b86be02a4f9f0df18978f8251238a4801aa660f62893c99"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/group/cmd/providers.go"}, "region": {"startLine": 132}}}]}, {"ruleId": "SEC091", "level": "warning", "message": {"text": "[SEC091] Go: net/http server without timeouts: HTTP server without ReadHeaderTimeout/ReadTimeout/WriteTimeout is vulnerable to Slowloris. Ported from gosec G112 + G114 (Apache-2.0)."}, "properties": {"repobilityId": 223260, "scanner": "repobility-threat-engine", "fingerprint": "0dc712115e298b6ad1f432e55c33339ac91f8fbf40c83d30a0f72f7d0824fe81", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "http.Server{\n\t\t\tAddr:              cfg.Addr,\n\t\t\tHandler:           r,\n\t\t\tReadHeaderTimeout: cfg.Read", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC091", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|0dc712115e298b6ad1f432e55c33339ac91f8fbf40c83d30a0f72f7d0824fe81"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/connect/internal/server/server.go"}, "region": {"startLine": 88}}}]}, {"ruleId": "SEC091", "level": "warning", "message": {"text": "[SEC091] Go: net/http server without timeouts: HTTP server without ReadHeaderTimeout/ReadTimeout/WriteTimeout is vulnerable to Slowloris. Ported from gosec G112 + G114 (Apache-2.0)."}, "properties": {"repobilityId": 223256, "scanner": "repobility-threat-engine", "fingerprint": "8e4fefdab6cd488e5d7405df77dfc651335e7b6c86fcaecec4c7d88d5a3a5ccf", "category": "quality", "severity": "medium", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "http.Server {\n\treturn grpcx.NewMetricsHTTPServer(string(addr), built.Metrics)\n}", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC091", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|8e4fefdab6cd488e5d7405df77dfc651335e7b6c86fcaecec4c7d88d5a3a5ccf"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/auth/cmd/providers.go"}, "region": {"startLine": 123}}}]}, {"ruleId": "CORE_NO_CI", "level": "warning", "message": {"text": "No CI/CD configuration found"}, "properties": {"repobilityId": 223204, "scanner": "repobility-core", "fingerprint": "ca5da3551af97272c4f099fc472740148135a15816b81b90bd862e8f91ec66ce", "category": "practices", "severity": "medium", "confidence": null, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"rule_id": "CORE_NO_CI", "scanner": "repobility-core", "correlation_key": "repo|practices|core_no_ci"}}}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 223537, "scanner": "repobility-docker", "fingerprint": "53b2fbd66936e4f59609530087bc131a707cfb0c5f746a785923f429ed9d4f47", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "message-push", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|53b2fbd66936e4f59609530087bc131a707cfb0c5f746a785923f429ed9d4f47"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 425}}}]}, {"ruleId": "DKC006", "level": "note", "message": {"text": "Compose service does not declare a runtime user"}, "properties": {"repobilityId": 223536, "scanner": "repobility-docker", "fingerprint": "7db78b2d3d9a1359ad9f1093edc4ce7e99f1dcd0c1145097b9285125443727ab", "category": "docker", "severity": "low", "confidence": 0.56, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Service has no user setting and Repobility could not prove the image runs non-root.", "evidence": {"rule_id": "DKC006", "scanner": "repobility-docker", "service": "message-push", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|7db78b2d3d9a1359ad9f1093edc4ce7e99f1dcd0c1145097b9285125443727ab"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 425}}}]}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 223535, "scanner": "repobility-docker", "fingerprint": "e896c574509de013d09fbf99a5afeb29ec7f1c894403e72619a8862414ddc971", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "connect", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|e896c574509de013d09fbf99a5afeb29ec7f1c894403e72619a8862414ddc971"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 392}}}]}, {"ruleId": "DKC006", "level": "note", "message": {"text": "Compose service does not declare a runtime user"}, "properties": {"repobilityId": 223526, "scanner": "repobility-docker", "fingerprint": "3b8916228db03f3a4527512fdcee73ff040b53522fc3dd1764919a891b0791b4", "category": "docker", "severity": "low", "confidence": 0.56, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Service has no user setting and Repobility could not prove the image runs non-root.", "evidence": {"rule_id": "DKC006", "scanner": "repobility-docker", "service": "connect", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|3b8916228db03f3a4527512fdcee73ff040b53522fc3dd1764919a891b0791b4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 392}}}]}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 223525, "scanner": "repobility-docker", "fingerprint": "9a6b05e14a8cc51038d42dd80328ebfaa12b74850f6168837e93fbc66a10f13f", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "gateway", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|9a6b05e14a8cc51038d42dd80328ebfaa12b74850f6168837e93fbc66a10f13f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 351}}}]}, {"ruleId": "DKC006", "level": "note", "message": {"text": "Compose service does not declare a runtime user"}, "properties": {"repobilityId": 223524, "scanner": "repobility-docker", "fingerprint": "42d7dbbb86892a3c6610f26eacba45583359d0d005936fb0e3e5d6a63ed7d247", "category": "docker", "severity": "low", "confidence": 0.56, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Service has no user setting and Repobility could not prove the image runs non-root.", "evidence": {"rule_id": "DKC006", "scanner": "repobility-docker", "service": "gateway", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|42d7dbbb86892a3c6610f26eacba45583359d0d005936fb0e3e5d6a63ed7d247"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 351}}}]}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 223523, "scanner": "repobility-docker", "fingerprint": "872aa9e28df2121fbfb3703f9c6ac28d390788b74bc368ac452d84141acb5f42", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "msg", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|872aa9e28df2121fbfb3703f9c6ac28d390788b74bc368ac452d84141acb5f42"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 312}}}]}, {"ruleId": "DKC006", "level": "note", "message": {"text": "Compose service does not declare a runtime user"}, "properties": {"repobilityId": 223522, "scanner": "repobility-docker", "fingerprint": "8114bd40cb569f0d93ed0e4922e36d4a8c1ee278434e6e06588f819a805e905d", "category": "docker", "severity": "low", "confidence": 0.56, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Service has no user setting and Repobility could not prove the image runs non-root.", "evidence": {"rule_id": "DKC006", "scanner": "repobility-docker", "service": "msg", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|8114bd40cb569f0d93ed0e4922e36d4a8c1ee278434e6e06588f819a805e905d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 312}}}]}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 223516, "scanner": "repobility-docker", "fingerprint": "907667d61f3bdd4f7a7b3c8b02a61227cf3d118a7c0a0ef2b2215b5f4966ab97", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "group", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|907667d61f3bdd4f7a7b3c8b02a61227cf3d118a7c0a0ef2b2215b5f4966ab97"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 274}}}]}, {"ruleId": "DKC006", "level": "note", "message": {"text": "Compose service does not declare a runtime user"}, "properties": {"repobilityId": 223515, "scanner": "repobility-docker", "fingerprint": "8bc9dc18e59abf032d5bfd51bdf229cc87eacfb67c4d40f528e67d0561b5365c", "category": "docker", "severity": "low", "confidence": 0.56, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Service has no user setting and Repobility could not prove the image runs non-root.", "evidence": {"rule_id": "DKC006", "scanner": "repobility-docker", "service": "group", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|8bc9dc18e59abf032d5bfd51bdf229cc87eacfb67c4d40f528e67d0561b5365c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 274}}}]}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 223510, "scanner": "repobility-docker", "fingerprint": "d1828768cc8a47cc36515781eed94db5fdffff4986c08865fd14c3a47487b7c7", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "relation", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|d1828768cc8a47cc36515781eed94db5fdffff4986c08865fd14c3a47487b7c7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 237}}}]}, {"ruleId": "DKC006", "level": "note", "message": {"text": "Compose service does not declare a runtime user"}, "properties": {"repobilityId": 223508, "scanner": "repobility-docker", "fingerprint": "a115f14cd785dcc435ca316b82e950867cad96088156e01c9d21461cd8ad7630", "category": "docker", "severity": "low", "confidence": 0.56, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Service has no user setting and Repobility could not prove the image runs non-root.", "evidence": {"rule_id": "DKC006", "scanner": "repobility-docker", "service": "relation", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|a115f14cd785dcc435ca316b82e950867cad96088156e01c9d21461cd8ad7630"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 237}}}]}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 223507, "scanner": "repobility-docker", "fingerprint": "c42f4e31f68622fd074b755e1c46438c9f2a84e70a3db9026d7981e4dd2a02b3", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "user", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|c42f4e31f68622fd074b755e1c46438c9f2a84e70a3db9026d7981e4dd2a02b3"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 193}}}]}, {"ruleId": "DKC006", "level": "note", "message": {"text": "Compose service does not declare a runtime user"}, "properties": {"repobilityId": 223506, "scanner": "repobility-docker", "fingerprint": "25b884fd6e94969bdba5f1060af33bd952c01d0742dda41607978d7de1e8a376", "category": "docker", "severity": "low", "confidence": 0.56, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Service has no user setting and Repobility could not prove the image runs non-root.", "evidence": {"rule_id": "DKC006", "scanner": "repobility-docker", "service": "user", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|25b884fd6e94969bdba5f1060af33bd952c01d0742dda41607978d7de1e8a376"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 193}}}]}, {"ruleId": "DKC010", "level": "note", "message": {"text": "Compose service lacks no-new-privileges hardening"}, "properties": {"repobilityId": 223505, "scanner": "repobility-docker", "fingerprint": "2ee0b46f6ee8dd6795738001cd8fe22fedefd1a9c7e921583dfc2020fa9c47a4", "category": "docker", "severity": "low", "confidence": 0.62, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "App-like service has no security_opt no-new-privileges setting.", "evidence": {"rule_id": "DKC010", "scanner": "repobility-docker", "service": "auth", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|2ee0b46f6ee8dd6795738001cd8fe22fedefd1a9c7e921583dfc2020fa9c47a4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 149}}}]}, {"ruleId": "DKC006", "level": "note", "message": {"text": "Compose service does not declare a runtime user"}, "properties": {"repobilityId": 223504, "scanner": "repobility-docker", "fingerprint": "1d7da0b616c1fed759052dc10585a5172148bc0f5919e2386286f19cad31d6eb", "category": "docker", "severity": "low", "confidence": 0.56, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Service has no user setting and Repobility could not prove the image runs non-root.", "evidence": {"rule_id": "DKC006", "scanner": "repobility-docker", "service": "auth", "references": ["https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "correlation_key": "fp|1d7da0b616c1fed759052dc10585a5172148bc0f5919e2386286f19cad31d6eb"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 149}}}]}, {"ruleId": "DKC017", "level": "note", "message": {"text": "Database password is wired through an environment variable placeholder"}, "properties": {"repobilityId": 223480, "scanner": "repobility-docker", "fingerprint": "efbc9b7d3fa4f5f2911d29c3ea9c09d9f352c238d5ed4940caa0efd15ecd07b2", "category": "docker", "severity": "low", "confidence": 0.58, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Database image supports file-based secret variables, but only placeholder environment variables were found.", "evidence": {"rule_id": "DKC017", "scanner": "repobility-docker", "service": "mysql", "variables": ["MYSQL_ROOT_PASSWORD"], "references": ["https://docs.docker.com/compose/how-tos/use-secrets/"], "correlation_key": "fp|efbc9b7d3fa4f5f2911d29c3ea9c09d9f352c238d5ed4940caa0efd15ecd07b2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "DKR008", "level": "note", "message": {"text": ".dockerignore misses sensitive defaults"}, "properties": {"repobilityId": 223474, "scanner": "repobility-docker", "fingerprint": "aea2ad92c68c4ee1f8432bb1ec25e7d45ac12c9e1790ac2d3fffe638b1acce12", "category": "docker", "severity": "low", "confidence": 0.72, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "A Docker build context should exclude secrets and repository metadata.", "evidence": {"rule_id": "DKR008", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/"], "correlation_key": "fp|aea2ad92c68c4ee1f8432bb1ec25e7d45ac12c9e1790ac2d3fffe638b1acce12", "missing_patterns": [".env", "id_rsa", "*.pem", "*.key"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".dockerignore"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223469, "scanner": "repobility-ai-code-hygiene", "fingerprint": "acbbbfbfd66fddea9d756fbfea47b0ddbebd91aefc56773a9a49158529cc873c", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/auth/cmd/main.go", "duplicate_line": 1, "correlation_key": "fp|acbbbfbfd66fddea9d756fbfea47b0ddbebd91aefc56773a9a49158529cc873c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/user/cmd/main.go"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223467, "scanner": "repobility-ai-code-hygiene", "fingerprint": "9e68d9f891470bb6a7fc2414948f52eafe200835a738675fec4656aecc23db1c", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/gateway/cmd/app.go", "duplicate_line": 111, "correlation_key": "fp|9e68d9f891470bb6a7fc2414948f52eafe200835a738675fec4656aecc23db1c"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/user/cmd/app.go"}, "region": {"startLine": 148}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223466, "scanner": "repobility-ai-code-hygiene", "fingerprint": "29c098d719223eebf7c3dfa2f2c76ca6a832ff9392d410b903d1f3358584b0a5", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/group/cmd/app.go", "duplicate_line": 107, "correlation_key": "fp|29c098d719223eebf7c3dfa2f2c76ca6a832ff9392d410b903d1f3358584b0a5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/user/cmd/app.go"}, "region": {"startLine": 147}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223462, "scanner": "repobility-ai-code-hygiene", "fingerprint": "0f2a743ef50d094dfd69bd5a0ee5872a32f216696da99a48ac31a3aa579664f6", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/auth/cmd/app.go", "duplicate_line": 70, "correlation_key": "fp|0f2a743ef50d094dfd69bd5a0ee5872a32f216696da99a48ac31a3aa579664f6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/user/cmd/app.go"}, "region": {"startLine": 80}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223461, "scanner": "repobility-ai-code-hygiene", "fingerprint": "73c91d3a54b88a2782f3dadfd4e09a8657cd7b9d71a0bb9627706c6241cb6632", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/group/internal/repository/util.go", "duplicate_line": 313, "correlation_key": "fp|73c91d3a54b88a2782f3dadfd4e09a8657cd7b9d71a0bb9627706c6241cb6632"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/relation/internal/repository/util.go"}, "region": {"startLine": 33}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223459, "scanner": "repobility-ai-code-hygiene", "fingerprint": "b7c7faaa41d7b34fd9382f4ca71174c5eac450a32f1081b87ba91710919bb289", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/relation/internal/repository/apply_repository.go", "duplicate_line": 402, "correlation_key": "fp|b7c7faaa41d7b34fd9382f4ca71174c5eac450a32f1081b87ba91710919bb289"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/relation/internal/repository/friend_repository.go"}, "region": {"startLine": 464}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223443, "scanner": "repobility-ai-code-hygiene", "fingerprint": "f85be8d430e729377628cd125c2fb8779418254ac525fed2709c77118afe94dd", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/relation/internal/repository/blacklist_repository.go", "duplicate_line": 1, "correlation_key": "fp|f85be8d430e729377628cd125c2fb8779418254ac525fed2709c77118afe94dd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/relation/internal/repository/friend_repository.go"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223440, "scanner": "repobility-ai-code-hygiene", "fingerprint": "c4513ecf41f29458dd1b95e50172e44916bf1170425f95f8485f649402310574", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/group/internal/repository/errors.go", "duplicate_line": 1, "correlation_key": "fp|c4513ecf41f29458dd1b95e50172e44916bf1170425f95f8485f649402310574"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/relation/internal/repository/errors.go"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223438, "scanner": "repobility-ai-code-hygiene", "fingerprint": "c5527571f2027adfbdb8616d5dcd1a3a60a2cffc33f7f56f50cc1fe5c4faf168", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/relation/internal/repository/apply_repository.go", "duplicate_line": 538, "correlation_key": "fp|c5527571f2027adfbdb8616d5dcd1a3a60a2cffc33f7f56f50cc1fe5c4faf168"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/relation/internal/repository/blacklist_repository.go"}, "region": {"startLine": 184}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223426, "scanner": "repobility-ai-code-hygiene", "fingerprint": "a60a7f72dfa43c21a88f4a981f8a2111ff9d5f061dbf2aaac90b14809c5eaa3a", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/group/cmd/providers.go", "duplicate_line": 13, "correlation_key": "fp|a60a7f72dfa43c21a88f4a981f8a2111ff9d5f061dbf2aaac90b14809c5eaa3a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/relation/cmd/providers.go"}, "region": {"startLine": 13}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223425, "scanner": "repobility-ai-code-hygiene", "fingerprint": "2c62e3ac792a633abaab1f563bf236a594141bfe0191c3f2a6c2f1e29544f27e", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/auth/cmd/main.go", "duplicate_line": 1, "correlation_key": "fp|2c62e3ac792a633abaab1f563bf236a594141bfe0191c3f2a6c2f1e29544f27e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/relation/cmd/main.go"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223423, "scanner": "repobility-ai-code-hygiene", "fingerprint": "f49bb45fac4ecfbbf9d0e12a2a772134a70d0cb56aecf2febb4212bc8a89e93b", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/auth/cmd/app.go", "duplicate_line": 101, "correlation_key": "fp|f49bb45fac4ecfbbf9d0e12a2a772134a70d0cb56aecf2febb4212bc8a89e93b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/relation/cmd/app.go"}, "region": {"startLine": 93}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223421, "scanner": "repobility-ai-code-hygiene", "fingerprint": "c1996be122637bb7021342d1b2e81bb40619f32b468814fb85ed62eaec39b48a", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/group/cmd/app.go", "duplicate_line": 10, "correlation_key": "fp|c1996be122637bb7021342d1b2e81bb40619f32b468814fb85ed62eaec39b48a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/relation/cmd/app.go"}, "region": {"startLine": 10}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223420, "scanner": "repobility-ai-code-hygiene", "fingerprint": "eea61199d0eb2022e2db5456d89994ea1bd52e8f7fbb71f40efb512d1c16c691", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/msg/internal/domain/conversation/mark_read_events.go", "duplicate_line": 84, "correlation_key": "fp|eea61199d0eb2022e2db5456d89994ea1bd52e8f7fbb71f40efb512d1c16c691"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/msg/internal/domain/message/service.go"}, "region": {"startLine": 252}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223419, "scanner": "repobility-ai-code-hygiene", "fingerprint": "4d3c2eb414ad6541dd8291473a47c1f8bab753449ab439cc7b3c9e0312528aa1", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/auth/cmd/main.go", "duplicate_line": 1, "correlation_key": "fp|4d3c2eb414ad6541dd8291473a47c1f8bab753449ab439cc7b3c9e0312528aa1"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/msg/cmd/main.go"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223418, "scanner": "repobility-ai-code-hygiene", "fingerprint": "20c88286f8f35851291d95d7688e44dfd481104c41e62bb1f8999188f3a3e72e", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/gateway/cmd/app.go", "duplicate_line": 111, "correlation_key": "fp|20c88286f8f35851291d95d7688e44dfd481104c41e62bb1f8999188f3a3e72e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/msg/cmd/app.go"}, "region": {"startLine": 96}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223417, "scanner": "repobility-ai-code-hygiene", "fingerprint": "6090cdd2eb7eff6d412bbe604f91ea670d92f1310b317172fd8f720f8fd6669e", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/group/cmd/app.go", "duplicate_line": 99, "correlation_key": "fp|6090cdd2eb7eff6d412bbe604f91ea670d92f1310b317172fd8f720f8fd6669e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/msg/cmd/app.go"}, "region": {"startLine": 87}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223416, "scanner": "repobility-ai-code-hygiene", "fingerprint": "975bb6b658d72c39534bf2b93af36975ddf9afc8bfce4698590aa4d6bd9266fd", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/auth/cmd/app.go", "duplicate_line": 101, "correlation_key": "fp|975bb6b658d72c39534bf2b93af36975ddf9afc8bfce4698590aa4d6bd9266fd"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/msg/cmd/app.go"}, "region": {"startLine": 81}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223412, "scanner": "repobility-ai-code-hygiene", "fingerprint": "0b1552f54e9283b8997f36d89ca5d2cf6d07c4e0090ae0a9e151e4c35918728d", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/connect/internal/server/server.go", "duplicate_line": 64, "correlation_key": "fp|0b1552f54e9283b8997f36d89ca5d2cf6d07c4e0090ae0a9e151e4c35918728d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/message-push/internal/server/server.go"}, "region": {"startLine": 44}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223411, "scanner": "repobility-ai-code-hygiene", "fingerprint": "0adf3e4a9619944e40c5251dc3669f99707a5655330311c9a1c11c2fb1d08ec2", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/auth/cmd/main.go", "duplicate_line": 1, "correlation_key": "fp|0adf3e4a9619944e40c5251dc3669f99707a5655330311c9a1c11c2fb1d08ec2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/message-push/cmd/main.go"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223409, "scanner": "repobility-ai-code-hygiene", "fingerprint": "841f3ea926035da65f7c829d1b04c6b703169ccdbc0eba8557b599af7296fe25", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/group/internal/service/group_member_service.go", "duplicate_line": 51, "correlation_key": "fp|841f3ea926035da65f7c829d1b04c6b703169ccdbc0eba8557b599af7296fe25"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/group/internal/service/group_service.go"}, "region": {"startLine": 247}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223408, "scanner": "repobility-ai-code-hygiene", "fingerprint": "78f73e71b0d62df3344f62a59fccfccdeec90e7d5a6d9f67d386b4ca8e0ade6b", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/auth/cmd/main.go", "duplicate_line": 1, "correlation_key": "fp|78f73e71b0d62df3344f62a59fccfccdeec90e7d5a6d9f67d386b4ca8e0ade6b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/group/cmd/main.go"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223407, "scanner": "repobility-ai-code-hygiene", "fingerprint": "a2bc741ae974b3e1e9e913baf2d50c1e041cb619bc7c832b2a1aa35239f5b28d", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/gateway/cmd/app.go", "duplicate_line": 111, "correlation_key": "fp|a2bc741ae974b3e1e9e913baf2d50c1e041cb619bc7c832b2a1aa35239f5b28d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/group/cmd/app.go"}, "region": {"startLine": 108}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223406, "scanner": "repobility-ai-code-hygiene", "fingerprint": "aee4918bf6959a700a73b42341f961512c4e7501679ca0dbc81456e0f49f9f5b", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/auth/cmd/app.go", "duplicate_line": 101, "correlation_key": "fp|aee4918bf6959a700a73b42341f961512c4e7501679ca0dbc81456e0f49f9f5b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/group/cmd/app.go"}, "region": {"startLine": 93}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223403, "scanner": "repobility-ai-code-hygiene", "fingerprint": "9ab3250fc1579912be680e24b2633ddb7a2386d8b80ab50e296e3d87ba18e8ee", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/gateway/internal/service/blacklist_service.go", "duplicate_line": 73, "correlation_key": "fp|9ab3250fc1579912be680e24b2633ddb7a2386d8b80ab50e296e3d87ba18e8ee"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/internal/service/friend_service.go"}, "region": {"startLine": 256}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223400, "scanner": "repobility-ai-code-hygiene", "fingerprint": "da228393b1ddf7a258137ef4795498321c6b103fb8e50cd195ec8a14651d760a", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/gateway/internal/router/v1/device_handle.go", "duplicate_line": 73, "correlation_key": "fp|da228393b1ddf7a258137ef4795498321c6b103fb8e50cd195ec8a14651d760a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/internal/router/v1/user_handle.go"}, "region": {"startLine": 213}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223398, "scanner": "repobility-ai-code-hygiene", "fingerprint": "9797607f622010d109f79b2b20f50f3ded91e1e802c1932e53ac2f73bc0a62b2", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/connect/internal/middleware/recover.go", "duplicate_line": 43, "correlation_key": "fp|9797607f622010d109f79b2b20f50f3ded91e1e802c1932e53ac2f73bc0a62b2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/internal/middleware/recover.go"}, "region": {"startLine": 42}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223393, "scanner": "repobility-ai-code-hygiene", "fingerprint": "f3bef5bb2bff2e2027a6f83fed3ff34c95fcaec4505ceaa461797ecf4e36eace", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/auth/cmd/main.go", "duplicate_line": 1, "correlation_key": "fp|f3bef5bb2bff2e2027a6f83fed3ff34c95fcaec4505ceaa461797ecf4e36eace"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/cmd/main.go"}, "region": {"startLine": 1}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223392, "scanner": "repobility-ai-code-hygiene", "fingerprint": "1468f9dff03908a5abb6c305082e2fc8cc50c93231209bed10a952cf1c520629", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/connect/internal/svc/connect_service.go", "duplicate_line": 53, "correlation_key": "fp|1468f9dff03908a5abb6c305082e2fc8cc50c93231209bed10a952cf1c520629"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/cmd/app.go"}, "region": {"startLine": 179}}}]}, {"ruleId": "AIC003", "level": "note", "message": {"text": "Duplicated implementation block across source files"}, "properties": {"repobilityId": 223391, "scanner": "repobility-ai-code-hygiene", "fingerprint": "d66d61ca11d551078582c59567896b75a455a0b6cd900b52292f105c64b884ec", "category": "quality", "severity": "low", "confidence": 0.86, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "A normalized source-code window appears in two different non-test files.", "evidence": {"lines": 12, "rule_id": "AIC003", "scanner": "repobility-ai-code-hygiene", "references": ["https://jscpd.dev/"], "duplicate_file": "apps/auth/cmd/main.go", "duplicate_line": 1, "correlation_key": "fp|d66d61ca11d551078582c59567896b75a455a0b6cd900b52292f105c64b884ec"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/connect/cmd/main.go"}, "region": {"startLine": 1}}}]}, {"ruleId": "ERR003", "level": "note", "message": {"text": "[ERR003] Ignored Error (Go): Ignoring error return values."}, "properties": {"repobilityId": 223224, "scanner": "repobility-threat-engine", "fingerprint": "087bfb0a9a4e6dd81e0b93c0e1572325ba2a3bcccf710e37fa643bb30624d24a", "category": "error_handling", "severity": "low", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "_ = h.Write(", "reason": "Pattern matched with no mitigating context found", "rule_id": "ERR003", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|087bfb0a9a4e6dd81e0b93c0e1572325ba2a3bcccf710e37fa643bb30624d24a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/connect/internal/manager/connection_manager.go"}, "region": {"startLine": 275}}}]}, {"ruleId": "ERR003", "level": "note", "message": {"text": "[ERR003] Ignored Error (Go): Ignoring error return values."}, "properties": {"repobilityId": 223217, "scanner": "repobility-threat-engine", "fingerprint": "9ca8aa315799657d0633b19a0153cf0f49050d0ce6eb9804921b0e4ada3f975a", "category": "error_handling", "severity": "low", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "_ = writer.Close(", "reason": "Pattern matched with no mitigating context found", "rule_id": "ERR003", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|9ca8aa315799657d0633b19a0153cf0f49050d0ce6eb9804921b0e4ada3f975a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/connect/internal/manager/client.go"}, "region": {"startLine": 271}}}]}, {"ruleId": "ERR003", "level": "note", "message": {"text": "[ERR003] Ignored Error (Go): Ignoring error return values."}, "properties": {"repobilityId": 223210, "scanner": "repobility-threat-engine", "fingerprint": "009e6cf70b864c8290315af1a4c337569a33155b60a875f553019abf0ca56b2f", "category": "error_handling", "severity": "low", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "_ = util.InitSnowflake(", "reason": "Pattern matched with no mitigating context found", "rule_id": "ERR003", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|009e6cf70b864c8290315af1a4c337569a33155b60a875f553019abf0ca56b2f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/auth/cmd/app.go"}, "region": {"startLine": 176}}}]}, {"ruleId": "CORE_NO_LICENSE", "level": "note", "message": {"text": "No LICENSE file"}, "properties": {"repobilityId": 223199, "scanner": "repobility-core", "fingerprint": "9314e9238cd99885865b92490d1aaa96ca62b1390c9377878d5f3d99227e1c3c", "category": "documentation", "severity": "low", "confidence": null, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"rule_id": "CORE_NO_LICENSE", "scanner": "repobility-core", "correlation_key": "repo|documentation|core_no_license"}}}, {"ruleId": "DKR002", "level": "none", "message": {"text": "Compose service `minio` image is selected through a build variable"}, "properties": {"repobilityId": 223502, "scanner": "repobility-docker", "fingerprint": "7a738909e95cda117caaf225758d81c753b0d90d26e86d6316c0b0a3551dae4b", "category": "docker", "severity": "info", "confidence": 0.48, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Base image contains a variable; manual review is needed to avoid false positives.", "evidence": {"image": "${MINIO_IMAGE:-minio/minio:RELEASE.2025-01-20T14-49-07Z}", "rule_id": "DKR002", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/scout/policy/"], "correlation_key": "fp|7a738909e95cda117caaf225758d81c753b0d90d26e86d6316c0b0a3551dae4b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 125}}}]}, {"ruleId": "DKR002", "level": "none", "message": {"text": "Compose service `kafka-connect` image is selected through a build variable"}, "properties": {"repobilityId": 223489, "scanner": "repobility-docker", "fingerprint": "2885e69f04da427558bd5a33165036d46b11ad4fababb43e43abb04139755be0", "category": "docker", "severity": "info", "confidence": 0.48, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Base image contains a variable; manual review is needed to avoid false positives.", "evidence": {"image": "${KAFKA_CONNECT_IMAGE:-quay.io/debezium/connect:3.0.8.Final}", "rule_id": "DKR002", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/scout/policy/"], "correlation_key": "fp|2885e69f04da427558bd5a33165036d46b11ad4fababb43e43abb04139755be0"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 73}}}]}, {"ruleId": "DKR002", "level": "none", "message": {"text": "Compose service `kafka` image is selected through a build variable"}, "properties": {"repobilityId": 223485, "scanner": "repobility-docker", "fingerprint": "9b28828a5e9930b569f45a45ac1244f830b36fae754b0156c05d932c610d5d41", "category": "docker", "severity": "info", "confidence": 0.48, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Base image contains a variable; manual review is needed to avoid false positives.", "evidence": {"image": "${KAFKA_IMAGE:-apache/kafka:3.9.2}", "rule_id": "DKR002", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/scout/policy/"], "correlation_key": "fp|9b28828a5e9930b569f45a45ac1244f830b36fae754b0156c05d932c610d5d41"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 47}}}]}, {"ruleId": "DKR002", "level": "none", "message": {"text": "Compose service `redis` image is selected through a build variable"}, "properties": {"repobilityId": 223482, "scanner": "repobility-docker", "fingerprint": "1f3f24f2cf6f703ad75c6917d52f91818c67331a3a398f9e590c2998d61147b2", "category": "docker", "severity": "info", "confidence": 0.48, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Base image contains a variable; manual review is needed to avoid false positives.", "evidence": {"image": "${REDIS_IMAGE:-redis/redis-stack-server:7.4.0-v8}", "rule_id": "DKR002", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/scout/policy/"], "correlation_key": "fp|1f3f24f2cf6f703ad75c6917d52f91818c67331a3a398f9e590c2998d61147b2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "DKR002", "level": "none", "message": {"text": "Compose service `mysql` image is selected through a build variable"}, "properties": {"repobilityId": 223475, "scanner": "repobility-docker", "fingerprint": "eb35b24d05a781baf17e3deb2ecb7b621ce14cae370f8be042e536d0f802e15a", "category": "docker", "severity": "info", "confidence": 0.48, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Base image contains a variable; manual review is needed to avoid false positives.", "evidence": {"image": "${MYSQL_IMAGE:-mysql:8.0}", "rule_id": "DKR002", "scanner": "repobility-docker", "references": ["https://docs.docker.com/develop/develop-images/dockerfile_best-practices/", "https://docs.docker.com/scout/policy/"], "correlation_key": "fp|eb35b24d05a781baf17e3deb2ecb7b621ce14cae370f8be042e536d0f802e15a"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "MINED071", "level": "none", "message": {"text": "[MINED071] Go Panic Call: panic() crashes the process. Should return error in most cases."}, "properties": {"repobilityId": 223388, "scanner": "repobility-threat-engine", "fingerprint": "5e5b5f67888682e2b3327957f5a2c69650395bdab6744f095558cb7f46bcdffc", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "go-panic-call", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["go"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348067+00:00", "triaged_in_corpus": 12, "observations_count": 29174, "ai_coder_pattern_id": 108}, "scanner": "repobility-threat-engine", "correlation_key": "fp|5e5b5f67888682e2b3327957f5a2c69650395bdab6744f095558cb7f46bcdffc"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/util/snowflake.go"}, "region": {"startLine": 45}}}]}, {"ruleId": "MINED053", "level": "none", "message": {"text": "[MINED053] Placeholder Default Username: foo@bar.com / john.doe@example.com / admin/admin / changeme \u2014 typical AI placeholder credentials."}, "properties": {"repobilityId": 223386, "scanner": "repobility-threat-engine", "fingerprint": "5d16e18ae5625229290b4424f1d7c7d07a2f17e4b03063c90d10586fa10bb4f5", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "placeholder-default-username", "owasp": null, "cwe_ids": ["CWE-1392", "CWE-798"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348025+00:00", "triaged_in_corpus": 10, "observations_count": 456953, "ai_coder_pattern_id": 44}, "scanner": "repobility-threat-engine", "correlation_key": "fp|5d16e18ae5625229290b4424f1d7c7d07a2f17e4b03063c90d10586fa10bb4f5"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/_achieve/login_test_service.go"}, "region": {"startLine": 54}}}]}, {"ruleId": "MINED053", "level": "none", "message": {"text": "[MINED053] Placeholder Default Username: foo@bar.com / john.doe@example.com / admin/admin / changeme \u2014 typical AI placeholder credentials."}, "properties": {"repobilityId": 223373, "scanner": "repobility-threat-engine", "fingerprint": "c08352426ff5b0868b83623a5eb19183b35920e564e3b0744d02907a928f7cd2", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "placeholder-default-username", "owasp": null, "cwe_ids": ["CWE-1392", "CWE-798"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348025+00:00", "triaged_in_corpus": 10, "observations_count": 456953, "ai_coder_pattern_id": 44}, "scanner": "repobility-threat-engine", "correlation_key": "fp|c08352426ff5b0868b83623a5eb19183b35920e564e3b0744d02907a928f7cd2"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/_achieve/login_test_handle.go"}, "region": {"startLine": 59}}}]}, {"ruleId": "MINED033", "level": "none", "message": {"text": "[MINED033] Go Recover Without Log (and 2 more): Same pattern found in 2 additional files. Review if needed."}, "properties": {"repobilityId": 223324, "scanner": "repobility-threat-engine", "fingerprint": "f943231638a4b599d4998c0378bf64ab7b993424c24de8aad1fb711c825d941a", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 2 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "go-recover-without-log", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["go"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347975+00:00", "triaged_in_corpus": 15, "observations_count": 3808, "ai_coder_pattern_id": 109}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|f943231638a4b599d4998c0378bf64ab7b993424c24de8aad1fb711c825d941a", "aggregated_count": 2}}}, {"ruleId": "MINED043", "level": "none", "message": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "properties": {"repobilityId": 223318, "scanner": "repobility-threat-engine", "fingerprint": "eb26dd60537a87a7b60447fb03546b569db7c122e6f049ef39e5c63c68e4fa2b", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "http-not-https", "owasp": "A02:2021", "cwe_ids": ["CWE-319"], "precision": 0.917, "promoted_at": "2026-05-18T14:01:32.347999+00:00", "triaged_in_corpus": 12, "observations_count": 4113831, "ai_coder_pattern_id": 15}, "scanner": "repobility-threat-engine", "correlation_key": "fp|eb26dd60537a87a7b60447fb03546b569db7c122e6f049ef39e5c63c68e4fa2b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/cdc/register_outbox_connector.sh"}, "region": {"startLine": 5}}}]}, {"ruleId": "MINED043", "level": "none", "message": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "properties": {"repobilityId": 223317, "scanner": "repobility-threat-engine", "fingerprint": "5d6046a0bcce1bdad01e061a781336c6a5b11f76ead6ae29e98cb3616b53086b", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "http-not-https", "owasp": "A02:2021", "cwe_ids": ["CWE-319"], "precision": 0.917, "promoted_at": "2026-05-18T14:01:32.347999+00:00", "triaged_in_corpus": 12, "observations_count": 4113831, "ai_coder_pattern_id": 15}, "scanner": "repobility-threat-engine", "correlation_key": "fp|5d6046a0bcce1bdad01e061a781336c6a5b11f76ead6ae29e98cb3616b53086b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/_achieve/login_test_service.go"}, "region": {"startLine": 73}}}]}, {"ruleId": "MINED043", "level": "none", "message": {"text": "[MINED043] Http Not Https: Hardcoded http:// (not localhost) for endpoints that handle credentials or data."}, "properties": {"repobilityId": 223316, "scanner": "repobility-threat-engine", "fingerprint": "ac069b8729cd546cf8f9f46e61eac03ac0925f152ef2d2b127ed70fbec4ff882", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "http-not-https", "owasp": "A02:2021", "cwe_ids": ["CWE-319"], "precision": 0.917, "promoted_at": "2026-05-18T14:01:32.347999+00:00", "triaged_in_corpus": 12, "observations_count": 4113831, "ai_coder_pattern_id": 15}, "scanner": "repobility-threat-engine", "correlation_key": "fp|ac069b8729cd546cf8f9f46e61eac03ac0925f152ef2d2b127ed70fbec4ff882"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/connect/internal/handler/ws_handler.go"}, "region": {"startLine": 40}}}]}, {"ruleId": "SEC045", "level": "none", "message": {"text": "[SEC045] eval()/exec() on stored or user-supplied data (and 1 more): Same pattern found in 1 additional files. Review if needed."}, "properties": {"repobilityId": 223312, "scanner": "repobility-threat-engine", "fingerprint": "c59edcd8286991ab7caac4493f8f01b268fef2a5d218265ad20f6e2d1172fefb", "category": "injection", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 1 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 1 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC045", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|c59edcd8286991ab7caac4493f8f01b268fef2a5d218265ad20f6e2d1172fefb"}}}, {"ruleId": "MINED016", "level": "none", "message": {"text": "[MINED016] Go Error Ignored (and 7 more): Same pattern found in 7 additional files. Review if needed."}, "properties": {"repobilityId": 223303, "scanner": "repobility-threat-engine", "fingerprint": "4b6d8eee8856ae8cfc81502c27b15ed14dd19ef02fea0b0ed9c59fe7c378cead", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 7 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "go-error-ignored", "owasp": null, "cwe_ids": ["CWE-754"], "languages": ["go"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347935+00:00", "triaged_in_corpus": 15, "observations_count": 83036, "ai_coder_pattern_id": 107}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|4b6d8eee8856ae8cfc81502c27b15ed14dd19ef02fea0b0ed9c59fe7c378cead", "aggregated_count": 7}}}, {"ruleId": "SEC091", "level": "none", "message": {"text": "[SEC091] Go: net/http server without timeouts (and 5 more): Same pattern found in 5 additional files. Review if needed."}, "properties": {"repobilityId": 223262, "scanner": "repobility-threat-engine", "fingerprint": "a4c3f38740bbcb83e70ddb0baff989fc344dfcb408c44eb2e79c6c43a1707d21", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 5 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 5 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "SEC091", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|a4c3f38740bbcb83e70ddb0baff989fc344dfcb408c44eb2e79c6c43a1707d21"}}}, {"ruleId": "MINED060", "level": "none", "message": {"text": "[MINED060] Go Context No Cancel (and 26 more): Same pattern found in 26 additional files. Review if needed."}, "properties": {"repobilityId": 223255, "scanner": "repobility-threat-engine", "fingerprint": "15f473c93ade14ebb3b629404edab12a6344be090d2200b732513a08afd9327f", "category": "quality", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 26 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"mined": true, "mining": {"slug": "go-context-no-cancel", "owasp": null, "cwe_ids": ["CWE-401"], "languages": ["go"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348041+00:00", "triaged_in_corpus": 12, "observations_count": 132905, "ai_coder_pattern_id": 110}, "scanner": "repobility-threat-engine", "aggregated": true, "correlation_key": "fp|15f473c93ade14ebb3b629404edab12a6344be090d2200b732513a08afd9327f", "aggregated_count": 26}}}, {"ruleId": "MINED060", "level": "none", "message": {"text": "[MINED060] Go Context No Cancel: context.Background() at request handler boundary leaks goroutines."}, "properties": {"repobilityId": 223253, "scanner": "repobility-threat-engine", "fingerprint": "4c300436a9fdaf38afc96e7a400a73330eeef964ae469be69bd93142561db26d", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "go-context-no-cancel", "owasp": null, "cwe_ids": ["CWE-401"], "languages": ["go"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348041+00:00", "triaged_in_corpus": 12, "observations_count": 132905, "ai_coder_pattern_id": 110}, "scanner": "repobility-threat-engine", "correlation_key": "fp|4c300436a9fdaf38afc96e7a400a73330eeef964ae469be69bd93142561db26d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/connect/cmd/main.go"}, "region": {"startLine": 22}}}]}, {"ruleId": "MINED060", "level": "none", "message": {"text": "[MINED060] Go Context No Cancel: context.Background() at request handler boundary leaks goroutines."}, "properties": {"repobilityId": 223252, "scanner": "repobility-threat-engine", "fingerprint": "21be2bce8fa3c98e236b3aa29df351f914f366f02327cb1fa772679b245f93d6", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "go-context-no-cancel", "owasp": null, "cwe_ids": ["CWE-401"], "languages": ["go"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348041+00:00", "triaged_in_corpus": 12, "observations_count": 132905, "ai_coder_pattern_id": 110}, "scanner": "repobility-threat-engine", "correlation_key": "fp|21be2bce8fa3c98e236b3aa29df351f914f366f02327cb1fa772679b245f93d6"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/auth/cmd/providers.go"}, "region": {"startLine": 60}}}]}, {"ruleId": "MINED060", "level": "none", "message": {"text": "[MINED060] Go Context No Cancel: context.Background() at request handler boundary leaks goroutines."}, "properties": {"repobilityId": 223247, "scanner": "repobility-threat-engine", "fingerprint": "db1dae1d6dbbe59947ad823589084792623b659dcff5b89581450d6f3b46b5df", "category": "quality", "severity": "info", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "go-context-no-cancel", "owasp": null, "cwe_ids": ["CWE-401"], "languages": ["go"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.348041+00:00", "triaged_in_corpus": 12, "observations_count": 132905, "ai_coder_pattern_id": 110}, "scanner": "repobility-threat-engine", "correlation_key": "fp|db1dae1d6dbbe59947ad823589084792623b659dcff5b89581450d6f3b46b5df"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/auth/cmd/main.go"}, "region": {"startLine": 23}}}]}, {"ruleId": "ERR003", "level": "none", "message": {"text": "[ERR003] Ignored Error (Go) (and 7 more): Same pattern found in 7 additional files. Review if needed."}, "properties": {"repobilityId": 223240, "scanner": "repobility-threat-engine", "fingerprint": "a37e4eba0d0ea235e7aa28c11b114ee7eead19564443e29e60712173f81bab03", "category": "error_handling", "severity": "info", "confidence": 0.2, "triageState": "false_positive", "verdict": "likely_fp", "isResolved": true, "reason": "Deduplicated summary only: 7 additional occurrences found. The top occurrences remain visible as actionable findings.", "evidence": {"reason": "Deduplicated summary only: 7 additional occurrences found. The top occurrences remain visible as actionable findings.", "rule_id": "ERR003", "scanner": "repobility-threat-engine", "confidence": 0.2, "correlation_key": "fp|a37e4eba0d0ea235e7aa28c11b114ee7eead19564443e29e60712173f81bab03"}}}, {"ruleId": "MINED118", "level": "error", "message": {"text": "[MINED118] Dockerfile FROM `alpine:3.21` not pinned by digest: `FROM alpine:3.21` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity."}, "properties": {"repobilityId": 223580, "scanner": "repobility-supply-chain", "fingerprint": "0b23a7e114853ac253bce7dc6d3d4238432c2a7f392a2a7584ea47f752f93c3e", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|0b23a7e114853ac253bce7dc6d3d4238432c2a7f392a2a7584ea47f752f93c3e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 26}}}]}, {"ruleId": "MINED118", "level": "error", "message": {"text": "[MINED118] Dockerfile FROM `golang:1.25-alpine` not pinned by digest: `FROM golang:1.25-alpine` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity."}, "properties": {"repobilityId": 223576, "scanner": "repobility-supply-chain", "fingerprint": "c511c0ff74fa9e28bfb8f6a9f270611331fabbc00a71d8318c82a419b389e692", "category": "dependency", "severity": "high", "confidence": 0.9, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "docker-from-unpinned", "owasp": "A08:2021", "cwe_ids": ["CWE-829"], "languages": ["dockerfile"], "observations_count": 0}, "scanner": "repobility-supply-chain", "correlation_key": "fp|c511c0ff74fa9e28bfb8f6a9f270611331fabbc00a71d8318c82a419b389e692"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_group_interfaces: Test function `test_group_interfaces` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 223574, "scanner": "repobility-ast-engine", "fingerprint": "99898f69a200144e953cbb1462a893914d055820178b8b73b65197c65076714d", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|99898f69a200144e953cbb1462a893914d055820178b8b73b65197c65076714d"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/gateway_blackbox_test.py"}, "region": {"startLine": 514}}}]}, {"ruleId": "MINED106", "level": "error", "message": {"text": "[MINED106] Phantom test coverage: test_connect_interfaces: Test function `test_connect_interfaces` runs code but contains no assert / expect / should call \u2014 it passes regardless of behaviour. Adds line coverage without verifying anything."}, "properties": {"repobilityId": 223571, "scanner": "repobility-ast-engine", "fingerprint": "76a6e2dc40c4e258617f0f0e40a606302531da83f157efc92b28831a033c9996", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "", "isResolved": false, "reason": "", "evidence": {"mined": true, "mining": {"slug": "phantom-test-coverage", "owasp": null, "cwe_ids": ["CWE-1126"], "languages": ["python"], "observations_count": 982154}, "scanner": "repobility-ast-engine", "correlation_key": "fp|76a6e2dc40c4e258617f0f0e40a606302531da83f157efc92b28831a033c9996"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/gateway_blackbox_test.py"}, "region": {"startLine": 479}}}]}, {"ruleId": "AUC003", "level": "error", "message": {"text": "[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /:groupUuid/my-join-application."}, "properties": {"repobilityId": 223556, "scanner": "repobility-access-control", "fingerprint": "83531c38d49811488f6c0d3ab394de61527c867b2f3089e32303a964d44dbc31", "category": "auth", "severity": "high", "confidence": 0.7, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/:groupUuid/my-join-application", "method": "GET", "scanner": "repobility-access-control", "framework": "Gin", "correlation_key": "code|auth|token|262|auc003", "identity_targets": ["unknown", "owner"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/internal/router/router.go"}, "region": {"startLine": 262}}}]}, {"ruleId": "AUC003", "level": "error", "message": {"text": "[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: DELETE /:groupUuid/apply."}, "properties": {"repobilityId": 223555, "scanner": "repobility-access-control", "fingerprint": "ac882b7da3515a5f8c9d43086cafe58c1db5df4b52e7b8ebcf287c722a36cc7d", "category": "auth", "severity": "high", "confidence": 0.7, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/:groupUuid/apply", "method": "DELETE", "scanner": "repobility-access-control", "framework": "Gin", "correlation_key": "code|auth|token|261|auc003", "identity_targets": ["unknown", "owner"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/internal/router/router.go"}, "region": {"startLine": 261}}}]}, {"ruleId": "AUC003", "level": "error", "message": {"text": "[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: POST /:groupUuid/apply."}, "properties": {"repobilityId": 223554, "scanner": "repobility-access-control", "fingerprint": "5ef14c742aa181c515675ec26f8b7675a7e7073844caf1c18a7f913e19be98c5", "category": "auth", "severity": "high", "confidence": 0.7, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/:groupUuid/apply", "method": "POST", "scanner": "repobility-access-control", "framework": "Gin", "correlation_key": "code|auth|token|260|auc003", "identity_targets": ["unknown", "owner"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/internal/router/router.go"}, "region": {"startLine": 260}}}]}, {"ruleId": "AUC003", "level": "error", "message": {"text": "[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: PUT /:groupUuid/notice."}, "properties": {"repobilityId": 223553, "scanner": "repobility-access-control", "fingerprint": "9a811284d19deea01ffa3b611a415887c37b08c7cbdb5f499fed0e8974f4aea7", "category": "auth", "severity": "high", "confidence": 0.7, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/:groupUuid/notice", "method": "PUT", "scanner": "repobility-access-control", "framework": "Gin", "correlation_key": "code|auth|token|259|auc003", "identity_targets": ["unknown", "owner"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/internal/router/router.go"}, "region": {"startLine": 259}}}]}, {"ruleId": "AUC003", "level": "error", "message": {"text": "[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: PATCH /:groupUuid."}, "properties": {"repobilityId": 223552, "scanner": "repobility-access-control", "fingerprint": "a9ab5fc94854c1c41acf131298a43a8c809cf604b736483787a2d37cecd18b6f", "category": "auth", "severity": "high", "confidence": 0.7, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/:groupUuid", "method": "PATCH", "scanner": "repobility-access-control", "framework": "Gin", "correlation_key": "code|auth|token|258|auc003", "identity_targets": ["unknown", "owner"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/internal/router/router.go"}, "region": {"startLine": 258}}}]}, {"ruleId": "AUC003", "level": "error", "message": {"text": "[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /:groupUuid."}, "properties": {"repobilityId": 223551, "scanner": "repobility-access-control", "fingerprint": "5d5228c4cde1f58b32ea6fdcfef2260bd3f0ebdf8ac0837c14acd7d456479fc2", "category": "auth", "severity": "high", "confidence": 0.7, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/:groupUuid", "method": "GET", "scanner": "repobility-access-control", "framework": "Gin", "correlation_key": "code|auth|token|257|auc003", "identity_targets": ["unknown", "owner"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/internal/router/router.go"}, "region": {"startLine": 257}}}]}, {"ruleId": "AUC003", "level": "error", "message": {"text": "[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: DELETE /:convId."}, "properties": {"repobilityId": 223550, "scanner": "repobility-access-control", "fingerprint": "27b0f066c0b2d6912e521e22f40dfa5de2a6ebb3103f32a09370c56c1c481aac", "category": "auth", "severity": "high", "confidence": 0.7, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/:convId", "method": "DELETE", "scanner": "repobility-access-control", "framework": "Gin", "correlation_key": "code|auth|token|246|auc003", "identity_targets": ["unknown", "owner"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/internal/router/router.go"}, "region": {"startLine": 246}}}]}, {"ruleId": "AUC003", "level": "error", "message": {"text": "[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: DELETE /:userUuid."}, "properties": {"repobilityId": 223548, "scanner": "repobility-access-control", "fingerprint": "345df79c870c5b189a4aae7a03cd884de0028ecde80948cd04f0a67c9e8acbf2", "category": "auth", "severity": "high", "confidence": 0.7, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/:userUuid", "method": "DELETE", "scanner": "repobility-access-control", "framework": "Gin", "correlation_key": "code|auth|token|230|auc003", "identity_targets": ["unknown", "owner"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/internal/router/router.go"}, "region": {"startLine": 230}}}]}, {"ruleId": "AUC003", "level": "error", "message": {"text": "[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: DELETE /devices/:deviceId."}, "properties": {"repobilityId": 223546, "scanner": "repobility-access-control", "fingerprint": "c5f15c6736fde2f5a63ed86dd5cf62800e73fd1cbfbb9946a697e167217c6162", "category": "auth", "severity": "high", "confidence": 0.7, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/devices/:deviceId", "method": "DELETE", "scanner": "repobility-access-control", "framework": "Gin", "correlation_key": "code|auth|token|195|auc003", "identity_targets": ["unknown", "owner"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/internal/router/router.go"}, "region": {"startLine": 195}}}]}, {"ruleId": "AUC003", "level": "error", "message": {"text": "[AUC003] Object-level route lacks visible authorization: A route with an object id-like parameter does not show nearby authentication or authorization evidence. This is a BOLA/IDOR review target. Endpoint: GET /profile/:userUuid."}, "properties": {"repobilityId": 223543, "scanner": "repobility-access-control", "fingerprint": "1d69dd6e7263436d61b2e32c284ac456f539ebb89184514494411de674a74c66", "category": "auth", "severity": "high", "confidence": 0.7, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Static route and framework evidence require project-owner confirmation.", "evidence": {"path": "/profile/:userUuid", "method": "GET", "scanner": "repobility-access-control", "framework": "Gin", "correlation_key": "code|auth|token|189|auc003", "identity_targets": ["unknown", "owner"]}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/internal/router/router.go"}, "region": {"startLine": 189}}}]}, {"ruleId": "DKC011", "level": "error", "message": {"text": "Database service publishes a host port"}, "properties": {"repobilityId": 223503, "scanner": "repobility-docker", "fingerprint": "5e54337a3e9a821b80a6cb05ef3de78c81b630c042394ee855a7d7fa0151d65f", "category": "docker", "severity": "high", "confidence": 0.84, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Database-like image publishes host ports without a loopback-only bind.", "evidence": {"ports": [{"raw": "${MINIO_API_PORT:-9000}:9000", "target": "9000", "host_ip": "${MINIO_API_PORT", "published": "-9000}"}, {"raw": "${MINIO_CONSOLE_PORT:-9001}:9001", "target": "9001", "host_ip": "${MINIO_CONSOLE_PORT", "published": "-9001}"}], "rule_id": "DKC011", "scanner": "repobility-docker", "service": "minio", "references": ["https://docs.docker.com/compose/how-tos/environment-variables/best-practices/", "https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "exposure_scope": "public", "correlation_key": "fp|5e54337a3e9a821b80a6cb05ef3de78c81b630c042394ee855a7d7fa0151d65f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 125}}}]}, {"ruleId": "DKC011", "level": "error", "message": {"text": "Database service publishes a host port"}, "properties": {"repobilityId": 223500, "scanner": "repobility-docker", "fingerprint": "7c4605b30925ffaf392daa733851c1b7aa0aaa1a9a7dad75df579c69e8e16e0e", "category": "docker", "severity": "high", "confidence": 0.84, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Database-like image publishes host ports without a loopback-only bind.", "evidence": {"ports": [{"raw": "${KAFKA_CONNECT_PORT:-8083}:8083", "target": "8083", "host_ip": "${KAFKA_CONNECT_PORT", "published": "-8083}"}], "rule_id": "DKC011", "scanner": "repobility-docker", "service": "kafka-connect", "references": ["https://docs.docker.com/compose/how-tos/environment-variables/best-practices/", "https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "exposure_scope": "public", "correlation_key": "fp|7c4605b30925ffaf392daa733851c1b7aa0aaa1a9a7dad75df579c69e8e16e0e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 73}}}]}, {"ruleId": "DKC011", "level": "error", "message": {"text": "Database service publishes a host port"}, "properties": {"repobilityId": 223487, "scanner": "repobility-docker", "fingerprint": "ce7a6bfc88ab1430b0b9d57116b55c86201590b06a71751dd72c36d1c62e9657", "category": "docker", "severity": "high", "confidence": 0.84, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Database-like image publishes host ports without a loopback-only bind.", "evidence": {"ports": [{"raw": "${KAFKA_PORT:-9092}:9092", "target": "9092", "host_ip": "${KAFKA_PORT", "published": "-9092}"}], "rule_id": "DKC011", "scanner": "repobility-docker", "service": "kafka", "references": ["https://docs.docker.com/compose/how-tos/environment-variables/best-practices/", "https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "exposure_scope": "public", "correlation_key": "fp|ce7a6bfc88ab1430b0b9d57116b55c86201590b06a71751dd72c36d1c62e9657"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 47}}}]}, {"ruleId": "DKC011", "level": "error", "message": {"text": "Database service publishes a host port"}, "properties": {"repobilityId": 223483, "scanner": "repobility-docker", "fingerprint": "dd4c81d2448866c381998df5188b28c35bca7504f28a325aedb803588b944871", "category": "docker", "severity": "high", "confidence": 0.84, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Database-like image publishes host ports without a loopback-only bind.", "evidence": {"ports": [{"raw": "${REDIS_PORT:-16379}:6379", "target": "6379", "host_ip": "${REDIS_PORT", "published": "-16379}"}], "rule_id": "DKC011", "scanner": "repobility-docker", "service": "redis", "references": ["https://docs.docker.com/compose/how-tos/environment-variables/best-practices/", "https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "exposure_scope": "public", "correlation_key": "fp|dd4c81d2448866c381998df5188b28c35bca7504f28a325aedb803588b944871"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "DKC011", "level": "error", "message": {"text": "Database service publishes a host port"}, "properties": {"repobilityId": 223476, "scanner": "repobility-docker", "fingerprint": "11addb5e9a4d29977edc18889edbc418d4512932f393eaf17855bfc710e4ba2b", "category": "docker", "severity": "high", "confidence": 0.84, "triageState": "open", "verdict": "likely", "isResolved": false, "reason": "Database-like image publishes host ports without a loopback-only bind.", "evidence": {"ports": [{"raw": "${MYSQL_PORT:-13306}:3306", "target": "3306", "host_ip": "${MYSQL_PORT", "published": "-13306}"}], "rule_id": "DKC011", "scanner": "repobility-docker", "service": "mysql", "references": ["https://docs.docker.com/compose/how-tos/environment-variables/best-practices/", "https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html"], "exposure_scope": "public", "correlation_key": "fp|11addb5e9a4d29977edc18889edbc418d4512932f393eaf17855bfc710e4ba2b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "SEC085", "level": "error", "message": {"text": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0)."}, "properties": {"repobilityId": 223372, "scanner": "repobility-threat-engine", "fingerprint": "3a21c5bc233f7661bd8059046cd1c55f2e5e2689311a80d312385237337dd064", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "Exec(ctx", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC085", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|3a21c5bc233f7661bd8059046cd1c55f2e5e2689311a80d312385237337dd064"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/redisretry/consumer.go"}, "region": {"startLine": 153}}}]}, {"ruleId": "SEC085", "level": "error", "message": {"text": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0)."}, "properties": {"repobilityId": 223357, "scanner": "repobility-threat-engine", "fingerprint": "955b6fb0b75657776f5d42ff7d25072d8416609fd99db0a18a96da8d8b404716", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "Exec(ctx", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC085", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|955b6fb0b75657776f5d42ff7d25072d8416609fd99db0a18a96da8d8b404716"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/message-push/internal/route/repository.go"}, "region": {"startLine": 73}}}]}, {"ruleId": "SEC085", "level": "error", "message": {"text": "[SEC085] JS: child_process.exec with non-literal: child_process.exec with user-derived input enables command injection. Ported from eslint-plugin-security detect-child-process (Apache-2.0)."}, "properties": {"repobilityId": 223356, "scanner": "repobility-threat-engine", "fingerprint": "57fb70c634be4d74f068a7eeaf601620654633e4a796b1ce552b1c6b8615c9ac", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "Exec(ctx", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC085", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|57fb70c634be4d74f068a7eeaf601620654633e4a796b1ce552b1c6b8615c9ac"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/connect/internal/svc/routing.go"}, "region": {"startLine": 28}}}]}, {"ruleId": "SEC128", "level": "error", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes \u2014 DB writes lost, emails not sent, race conditions. This is one of the top-3 errors AI coders make: they understand async-shape but drop the await keyword when chaining multiple ops. Surfaces as flaky tests or silently dropped data in production."}, "properties": {"repobilityId": 223343, "scanner": "repobility-threat-engine", "fingerprint": "cfd233904abd2a75a8a44b808e860006732c114b5c68eb5dbdda1db30e01dd91", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "md.Delete(ctxmeta.MetadataSpanID)", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|cfd233904abd2a75a8a44b808e860006732c114b5c68eb5dbdda1db30e01dd91"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/grpcx/client_metadata.go"}, "region": {"startLine": 36}}}]}, {"ruleId": "SEC128", "level": "error", "message": {"text": "[SEC128] Async function without await \u2014 fire-and-forget Promise (AI mistake): Async call invoked without `await` returns an unhandled Promise. The outer function resolves before the inner work completes \u2014 DB writes lost, emails not sent, race conditions. This is one of the top-3 errors AI coders make: they understand async-shape but drop the await keyword when chaining multiple ops. Surfaces as flaky tests or silently dropped data in production."}, "properties": {"repobilityId": 223342, "scanner": "repobility-threat-engine", "fingerprint": "67f0060b487c43878a0cdf26bc3d15a281d6b6ad9b9d5feb736df4c514cd75ee", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"match": "s.activeSyncer.Delete(session.UserUUID, session.DeviceID)", "reason": "Pattern matched with no mitigating context found", "rule_id": "SEC128", "scanner": "repobility-threat-engine", "confidence": 1.0, "correlation_key": "fp|67f0060b487c43878a0cdf26bc3d15a281d6b6ad9b9d5feb736df4c514cd75ee"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/connect/internal/svc/lifecycle.go"}, "region": {"startLine": 49}}}]}, {"ruleId": "MINED004", "level": "error", "message": {"text": "[MINED004] Weak Crypto: MD5/SHA1/DES/RC4 used for security context (not just checksums)."}, "properties": {"repobilityId": 223336, "scanner": "repobility-threat-engine", "fingerprint": "155bda14b804fd3ead7e34be1db9fbe842044014e13133620eaecd050384e53b", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "weak-crypto", "owasp": "A02:2021", "cwe_ids": ["CWE-327"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347906+00:00", "triaged_in_corpus": 15, "observations_count": 303181, "ai_coder_pattern_id": 13}, "scanner": "repobility-threat-engine", "correlation_key": "fp|155bda14b804fd3ead7e34be1db9fbe842044014e13133620eaecd050384e53b"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/connect/internal/svc/auth.go"}, "region": {"startLine": 5}}}]}, {"ruleId": "SEC020", "level": "error", "message": {"text": "[SEC020] Secret Printed to Logs: Debug or diagnostic code appears to print a credential-bearing value. This is a frequent AI-assisted coding failure: the helper exposes the exact value needed for troubleshooting."}, "properties": {"repobilityId": 223332, "scanner": "repobility-threat-engine", "fingerprint": "1c3172395d7e901648e30f6e70eb77134b9bc713e15ed54b1d8f6fa78eb463f7", "category": "credential_exposure", "severity": "high", "confidence": 0.85, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Credential-bearing variable appears to be printed or logged", "evidence": {"match": "logger.Warn(ctx, \"\u8fde\u63a5\u9274\u6743\u5931\u8d25\uff1a\u7f3a\u5c11 token\")", "reason": "Credential-bearing variable appears to be printed or logged", "rule_id": "SEC020", "scanner": "repobility-threat-engine", "confidence": 0.85, "correlation_key": "secret|token|4|logger.warn ctx token"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/connect/internal/svc/auth.go"}, "region": {"startLine": 42}}}]}, {"ruleId": "MINED033", "level": "error", "message": {"text": "[MINED033] Go Recover Without Log: defer func() { recover() }() that silently swallows panic."}, "properties": {"repobilityId": 223323, "scanner": "repobility-threat-engine", "fingerprint": "1a605f1f039d3b2f9af4f6409e28ac7b08857790fba45e6807f1a7000ccc89d4", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "go-recover-without-log", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["go"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347975+00:00", "triaged_in_corpus": 15, "observations_count": 3808, "ai_coder_pattern_id": 109}, "scanner": "repobility-threat-engine", "correlation_key": "fp|1a605f1f039d3b2f9af4f6409e28ac7b08857790fba45e6807f1a7000ccc89d4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/async/pool.go"}, "region": {"startLine": 270}}}]}, {"ruleId": "MINED033", "level": "error", "message": {"text": "[MINED033] Go Recover Without Log: defer func() { recover() }() that silently swallows panic."}, "properties": {"repobilityId": 223322, "scanner": "repobility-threat-engine", "fingerprint": "2e85562c51b12f036f731c4478e4b0cc9b07a39f859f18fbf9a0d1181645ec3e", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "go-recover-without-log", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["go"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347975+00:00", "triaged_in_corpus": 15, "observations_count": 3808, "ai_coder_pattern_id": 109}, "scanner": "repobility-threat-engine", "correlation_key": "fp|2e85562c51b12f036f731c4478e4b0cc9b07a39f859f18fbf9a0d1181645ec3e"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/gateway/internal/middleware/recover.go"}, "region": {"startLine": 22}}}]}, {"ruleId": "MINED033", "level": "error", "message": {"text": "[MINED033] Go Recover Without Log: defer func() { recover() }() that silently swallows panic."}, "properties": {"repobilityId": 223320, "scanner": "repobility-threat-engine", "fingerprint": "4fc0e46508c5241223571e8b9e6ad00199485b8baf9cba4b768c7aa4d05ce9c7", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "go-recover-without-log", "owasp": null, "cwe_ids": ["CWE-755"], "languages": ["go"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347975+00:00", "triaged_in_corpus": 15, "observations_count": 3808, "ai_coder_pattern_id": 109}, "scanner": "repobility-threat-engine", "correlation_key": "fp|4fc0e46508c5241223571e8b9e6ad00199485b8baf9cba4b768c7aa4d05ce9c7"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/connect/internal/middleware/recover.go"}, "region": {"startLine": 22}}}]}, {"ruleId": "MINED016", "level": "error", "message": {"text": "[MINED016] Go Error Ignored: _, err := fn() with err not checked. Go anti-pattern."}, "properties": {"repobilityId": 223297, "scanner": "repobility-threat-engine", "fingerprint": "337d5abe8ecfbfdb0dad8537628068c3ab18f97d15f7ab0edec54fc74d99222f", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "go-error-ignored", "owasp": null, "cwe_ids": ["CWE-754"], "languages": ["go"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347935+00:00", "triaged_in_corpus": 15, "observations_count": 83036, "ai_coder_pattern_id": 107}, "scanner": "repobility-threat-engine", "correlation_key": "fp|337d5abe8ecfbfdb0dad8537628068c3ab18f97d15f7ab0edec54fc74d99222f"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/connect/internal/svc/lifecycle.go"}, "region": {"startLine": 123}}}]}, {"ruleId": "MINED016", "level": "error", "message": {"text": "[MINED016] Go Error Ignored: _, err := fn() with err not checked. Go anti-pattern."}, "properties": {"repobilityId": 223296, "scanner": "repobility-threat-engine", "fingerprint": "18798891141c68c0df7f5939e69abc78ce95abd30c8c1b31b0478776b979a090", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "go-error-ignored", "owasp": null, "cwe_ids": ["CWE-754"], "languages": ["go"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347935+00:00", "triaged_in_corpus": 15, "observations_count": 83036, "ai_coder_pattern_id": 107}, "scanner": "repobility-threat-engine", "correlation_key": "fp|18798891141c68c0df7f5939e69abc78ce95abd30c8c1b31b0478776b979a090"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/connect/internal/svc/ack.go"}, "region": {"startLine": 244}}}]}, {"ruleId": "MINED016", "level": "error", "message": {"text": "[MINED016] Go Error Ignored: _, err := fn() with err not checked. Go anti-pattern."}, "properties": {"repobilityId": 223266, "scanner": "repobility-threat-engine", "fingerprint": "d76ee0cf3b3e34c5f94541467406038037c868dd45da5be71db6bc85464edff4", "category": "quality", "severity": "high", "confidence": 1.0, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Pattern matched with no mitigating context found", "evidence": {"mined": true, "mining": {"slug": "go-error-ignored", "owasp": null, "cwe_ids": ["CWE-754"], "languages": ["go"], "precision": 1.0, "promoted_at": "2026-05-18T14:01:32.347935+00:00", "triaged_in_corpus": 15, "observations_count": 83036, "ai_coder_pattern_id": 107}, "scanner": "repobility-threat-engine", "correlation_key": "fp|d76ee0cf3b3e34c5f94541467406038037c868dd45da5be71db6bc85464edff4"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/auth/internal/consumer/profile_display_changed_consumer.go"}, "region": {"startLine": 74}}}]}, {"ruleId": "SEC001", "level": "error", "message": {"text": "[SEC001] Hardcoded Password: Hardcoded password found in source code."}, "properties": {"repobilityId": 223389, "scanner": "repobility-threat-engine", "fingerprint": "80096f096c98977e7d145c02d91bfe244e504e71a5047e3a73de65691fa57094", "category": "credential_exposure", "severity": "critical", "confidence": 0.9, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "High entropy value (4.8 bits) \u2014 likely real secret", "evidence": {"match": "PASSWORD=\"<redacted>}\"", "reason": "High entropy value (4.8 bits) \u2014 likely real secret", "rule_id": "SEC001", "scanner": "repobility-threat-engine", "confidence": 0.9, "correlation_key": "secret|token|1|password redacted"}}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/cdc/register_outbox_connector.sh"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-86f709d148d54907", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: golang:1.25-alpine"}, "properties": {"repobilityId": "d7d95669377ce14c", "scanner": "scanner-primary", "fingerprint": "86f709d148d54907", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-33d1d1cc6ee6ad3c", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: alpine:3.21"}, "properties": {"repobilityId": "59dd6e4b044ee026", "scanner": "scanner-primary", "fingerprint": "33d1d1cc6ee6ad3c", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-35e3c3ffa0733836", "level": "error", "message": {"text": "Possible secret in docker-compose.yml"}, "properties": {"repobilityId": "0b3c1e9672660863", "scanner": "scanner-primary", "fingerprint": "35e3c3ffa0733836", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yml"}, "region": {"startLine": 136}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-6694c18359abe2c1", "level": "note", "message": {"text": "Very large file: apps/group/internal/repository/group_repository.go (2026 lines)"}, "properties": {"repobilityId": "7a4211e2a1fc7933", "scanner": "scanner-primary", "fingerprint": "6694c18359abe2c1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7a4d3d0df7667fbd", "level": "note", "message": {"text": "Very large file: scripts/gateway_blackbox_test.py (1674 lines)"}, "properties": {"repobilityId": "862df087278716c5", "scanner": "scanner-primary", "fingerprint": "7a4d3d0df7667fbd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "6b9f4bae3ac8b731", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "38f3cccdf95cceb5", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "2a24705e06c4e8d7", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "c2d8fc65e1fe0216", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "a6e10eaecadb98cc", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "6a3e8105f2e40d8c", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "95da39886eef8d05", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-ad6df829cfc62dd3", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/gateway_blackbox_test.py:343"}, "properties": {"repobilityId": "64efddb3b28038e0", "scanner": "scanner-primary", "fingerprint": "ad6df829cfc62dd3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c59292dc10501de3", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}]}]}