{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-68e4810a931d0efb", "name": "Stray `console.log` in TS/JS \u2014 benchmarks/fixture/src/index.ts:9", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 benchmarks/fixture/src/index.ts:9"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-07117dc64687da27", "name": "Stray `console.log` in TS/JS \u2014 src/bench.ts:207", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/bench.ts:207"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c148d3a1e17c713e", "name": "Stray `console.log` in TS/JS \u2014 src/compare.ts:334", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/compare.ts:334"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c34f9249e93b0ebf", "name": "Stray `console.log` in TS/JS \u2014 src/status.ts:332", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/status.ts:332"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bf5fc88c361a0ebd", "name": "Stray `console.log` in TS/JS \u2014 src/promptbench.ts:138", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/promptbench.ts:138"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9492b0221dd15b49", "name": "Stray `console.log` in TS/JS \u2014 src/share.ts:122", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/share.ts:122"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1fda8fda01f6db65", "name": "Stray `console.log` in TS/JS \u2014 src/modelbench.ts:129", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/modelbench.ts:129"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8a90bd7daeea1286", "name": "Stray `console.log` in TS/JS \u2014 src/attribute.ts:273", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/attribute.ts:273"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-25d50cb01d48fb1e", "name": "Stray `console.log` in TS/JS \u2014 src/gate.ts:158", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/gate.ts:158"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-97c159368102bba1", "name": "Stray `console.log` in TS/JS \u2014 src/verify-ledger.ts:57", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/verify-ledger.ts:57"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-232535a2b5a8fdfb", "name": "Stray `console.log` in TS/JS \u2014 src/select.ts:466", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/select.ts:466"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-66841c99221efa2a", "name": "Stray `console.log` in TS/JS \u2014 src/adopt.ts:154", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/adopt.ts:154"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de024597cddf97eb", "name": "Stray `console.log` in TS/JS \u2014 src/collect.ts:230", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/collect.ts:230"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-18f7b6ae739f39a4", "name": "Stray `console.log` in TS/JS \u2014 src/notify.ts:43", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/notify.ts:43"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-162904dcc46904c7", "name": "Stray `console.log` in TS/JS \u2014 src/evolve.ts:239", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/evolve.ts:239"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-26dfe2b03b0fbaa9", "name": "Insecure pattern 'node_child_process' in src/bench.ts:14", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/bench.ts:14"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8fcfd76e14b5f4e6", "name": "Insecure pattern 'node_child_process' in src/distill.ts:13", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/distill.ts:13"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6a39033f50de2321", "name": "Insecure pattern 'node_child_process' in src/collect.ts:8", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/collect.ts:8"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0a290da557cc751d", "name": "Insecure pattern 'node_child_process' in src/evolve.ts:20", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/evolve.ts:20"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 50 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3c1edbbe64650f9e", "name": "`fetch()` without try/.catch or AbortSignal \u2014 benchmarks/fixture/web/api.ts:4", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 benchmarks/fixture/web/api.ts:4"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f1245fe0a5f31911", "name": "Commented-code block (5 lines) in src/transcript.ts:274", "shortDescription": {"text": "Commented-code block (5 lines) in src/transcript.ts:274"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cf484e40f8621f2d", "name": "Commented-code block (5 lines) in src/collect.ts:217", "shortDescription": {"text": "Commented-code block (5 lines) in src/collect.ts:217"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4e480cf1bc736555", "name": "Unused endpoint: USE /users", "shortDescription": {"text": "Unused endpoint: USE /users"}, "fullDescription": {"text": "`benchmarks/fixture/src/server.ts` declares `USE /users` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9860e6655b7dabe6", "name": "Unused endpoint: USE /products", "shortDescription": {"text": "Unused endpoint: USE /products"}, "fullDescription": {"text": "`benchmarks/fixture/src/server.ts` declares `USE /products` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-79ebee1b808cc8cc", "name": "Unused endpoint: USE /orders", "shortDescription": {"text": "Unused endpoint: USE /orders"}, "fullDescription": {"text": "`benchmarks/fixture/src/server.ts` declares `USE /orders` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`benchmarks/fixture/src/routes/users.ts` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ca5756175765b49d", "name": "Unused endpoint: GET /:id", "shortDescription": {"text": "Unused endpoint: GET /:id"}, "fullDescription": {"text": "`benchmarks/fixture/src/routes/users.ts` declares `GET /:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a009b1a56794f45", "name": "Unused endpoint: POST /", "shortDescription": {"text": "Unused endpoint: POST /"}, "fullDescription": {"text": "`benchmarks/fixture/src/routes/users.ts` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22452"}, "properties": {"repository": "vukkt/token-warden", "repoUrl": "https://github.com/vukkt/token-warden", "branch": "main"}, "results": [{"ruleId": "scanner-68e4810a931d0efb", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 benchmarks/fixture/src/index.ts:9"}, "properties": {"repobilityId": "70e5d378e878c1fa", "scanner": "scanner-primary", "fingerprint": "68e4810a931d0efb", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-07117dc64687da27", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/bench.ts:207"}, "properties": {"repobilityId": "23a4e60c1394ff42", "scanner": "scanner-primary", "fingerprint": "07117dc64687da27", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c148d3a1e17c713e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/compare.ts:334"}, "properties": {"repobilityId": "1ea2c995a7580e87", "scanner": "scanner-primary", "fingerprint": "c148d3a1e17c713e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c34f9249e93b0ebf", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/status.ts:332"}, "properties": {"repobilityId": "31d0cdbd219afb46", "scanner": "scanner-primary", "fingerprint": "c34f9249e93b0ebf", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-bf5fc88c361a0ebd", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/promptbench.ts:138"}, "properties": {"repobilityId": "960616f8bea13ab8", "scanner": "scanner-primary", "fingerprint": "bf5fc88c361a0ebd", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9492b0221dd15b49", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/share.ts:122"}, "properties": {"repobilityId": "7c1547e7bbad389d", "scanner": "scanner-primary", "fingerprint": "9492b0221dd15b49", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1fda8fda01f6db65", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/modelbench.ts:129"}, "properties": {"repobilityId": "7bb663dcac6cdfaa", "scanner": "scanner-primary", "fingerprint": "1fda8fda01f6db65", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8a90bd7daeea1286", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/attribute.ts:273"}, "properties": {"repobilityId": "644eda130630a305", "scanner": "scanner-primary", "fingerprint": "8a90bd7daeea1286", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-25d50cb01d48fb1e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/gate.ts:158"}, "properties": {"repobilityId": "491b9a07170ce4a0", "scanner": "scanner-primary", "fingerprint": "25d50cb01d48fb1e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-97c159368102bba1", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/verify-ledger.ts:57"}, "properties": {"repobilityId": "87d4e0bfcab3b8c5", "scanner": "scanner-primary", "fingerprint": "97c159368102bba1", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-232535a2b5a8fdfb", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/select.ts:466"}, "properties": {"repobilityId": "3f8111eaa6e9eb7f", "scanner": "scanner-primary", "fingerprint": "232535a2b5a8fdfb", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-66841c99221efa2a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/adopt.ts:154"}, "properties": {"repobilityId": "b02c3c069c595d30", "scanner": "scanner-primary", "fingerprint": "66841c99221efa2a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-de024597cddf97eb", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/collect.ts:230"}, "properties": {"repobilityId": "c9f0596b90b55e4e", "scanner": "scanner-primary", "fingerprint": "de024597cddf97eb", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-18f7b6ae739f39a4", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/notify.ts:43"}, "properties": {"repobilityId": "221b07a96b74edd0", "scanner": "scanner-primary", "fingerprint": "18f7b6ae739f39a4", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-162904dcc46904c7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/evolve.ts:239"}, "properties": {"repobilityId": "5965071ca265f09a", "scanner": "scanner-primary", "fingerprint": "162904dcc46904c7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-26dfe2b03b0fbaa9", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/bench.ts:14"}, "properties": {"repobilityId": "159f9c798e9b045d", "scanner": "scanner-primary", "fingerprint": "26dfe2b03b0fbaa9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/bench.ts"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-8fcfd76e14b5f4e6", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/distill.ts:13"}, "properties": {"repobilityId": "815ee1fecaa0588c", "scanner": "scanner-primary", "fingerprint": "8fcfd76e14b5f4e6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/distill.ts"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-6a39033f50de2321", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/collect.ts:8"}, "properties": {"repobilityId": "377cbdec8f77a303", "scanner": "scanner-primary", "fingerprint": "6a39033f50de2321", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/collect.ts"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-0a290da557cc751d", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/evolve.ts:20"}, "properties": {"repobilityId": "6ff422029dd51314", "scanner": "scanner-primary", "fingerprint": "0a290da557cc751d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/evolve.ts"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "be8b99a467c684ad", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "21f3a8c25c0c41cf", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "c9ec7bdba8b8d2a6", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "ac5e810485e04f18", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-3c1edbbe64650f9e", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 benchmarks/fixture/web/api.ts:4"}, "properties": {"repobilityId": "75c702473d744037", "scanner": "scanner-primary", "fingerprint": "3c1edbbe64650f9e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f1245fe0a5f31911", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/transcript.ts:274"}, "properties": {"repobilityId": "634d0e04c94b967b", "scanner": "scanner-primary", "fingerprint": "f1245fe0a5f31911", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cf484e40f8621f2d", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/collect.ts:217"}, "properties": {"repobilityId": "eb86363dfde55c72", "scanner": "scanner-primary", "fingerprint": "cf484e40f8621f2d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4e480cf1bc736555", "level": "note", "message": {"text": "Unused endpoint: USE /users"}, "properties": {"repobilityId": "337b4de292b36db2", "scanner": "scanner-primary", "fingerprint": "4e480cf1bc736555", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9860e6655b7dabe6", "level": "note", "message": {"text": "Unused endpoint: USE /products"}, "properties": {"repobilityId": "780f052ed1116ba8", "scanner": "scanner-primary", "fingerprint": "9860e6655b7dabe6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-79ebee1b808cc8cc", "level": "note", "message": {"text": "Unused endpoint: USE /orders"}, "properties": {"repobilityId": "1460d36224598973", "scanner": "scanner-primary", "fingerprint": "79ebee1b808cc8cc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "2e626e7149aafebe", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ca5756175765b49d", "level": "note", "message": {"text": "Unused endpoint: GET /:id"}, "properties": {"repobilityId": "13cc776f31f2f8c5", "scanner": "scanner-primary", "fingerprint": "ca5756175765b49d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a009b1a56794f45", "level": "note", "message": {"text": "Unused endpoint: POST /"}, "properties": {"repobilityId": "cc87195ca00e5806", "scanner": "scanner-primary", "fingerprint": "7a009b1a56794f45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}