{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-166dff3c3df6a10e", "name": "ORM models found but no DB engine detected", "shortDescription": {"text": "ORM models found but no DB engine detected"}, "fullDescription": {"text": "The repo defines tables/models but no DB connection string was found. Likely lives in env vars or a config file the scanner didn't read."}, "properties": {"scanner": "scanner-primary", "layer": "data", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f2a26690a0e7aa0d", "name": "Insecure pattern 'direct_innerhtml_assignment' in custom-music.html:327", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in custom-music.html:327"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7e6e7fdcdcfa6478", "name": "Insecure pattern 'direct_innerhtml_assignment' in licensing.html:289", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in licensing.html:289"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dc87f7123e986426", "name": "Insecure pattern 'direct_innerhtml_assignment' in script.js:28", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in script.js:28"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4cb32ff8732fb00a", "name": "Insecure pattern 'direct_innerhtml_assignment' in order.html:335", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in order.html:335"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5ff246bbd74c6ecc", "name": "Insecure pattern 'direct_innerhtml_assignment' in studio.html:348", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in studio.html:348"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-375a73303d7ec8c6", "name": "Insecure pattern 'insert_adjacent_html' in studio.html:349", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in studio.html:349"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c2bb7e13e9e3bbb3", "name": "Insecure pattern 'direct_innerhtml_assignment' in success.html:180", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in success.html:180"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-62af26641ea911c3", "name": "Commented-code block (6 lines) in script.js:178", "shortDescription": {"text": "Commented-code block (6 lines) in script.js:178"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4602e8597afcbf84", "name": "`fetch()` without try/.catch or AbortSignal \u2014 script.js:379", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 script.js:379"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/29255"}, "properties": {"repository": "sambakels/flotionrecords", "repoUrl": "https://github.com/sambakels/flotionrecords", "branch": "main"}, "results": [{"ruleId": "scanner-166dff3c3df6a10e", "level": "warning", "message": {"text": "ORM models found but no DB engine detected"}, "properties": {"repobilityId": "cda36de65e114635", "scanner": "scanner-primary", "fingerprint": "166dff3c3df6a10e", "layer": "data", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-f2a26690a0e7aa0d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in custom-music.html:327"}, "properties": {"repobilityId": "75ae6fda4f474275", "scanner": "scanner-primary", "fingerprint": "f2a26690a0e7aa0d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "custom-music.html"}, "region": {"startLine": 327}}}]}, {"ruleId": "scanner-7e6e7fdcdcfa6478", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in licensing.html:289"}, "properties": {"repobilityId": "aed57104bbb56f8e", "scanner": "scanner-primary", "fingerprint": "7e6e7fdcdcfa6478", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "licensing.html"}, "region": {"startLine": 289}}}]}, {"ruleId": "scanner-dc87f7123e986426", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in script.js:28"}, "properties": {"repobilityId": "6579c6710200525f", "scanner": "scanner-primary", "fingerprint": "dc87f7123e986426", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "script.js"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-4cb32ff8732fb00a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in order.html:335"}, "properties": {"repobilityId": "5f925db1f92f761b", "scanner": "scanner-primary", "fingerprint": "4cb32ff8732fb00a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "order.html"}, "region": {"startLine": 335}}}]}, {"ruleId": "scanner-5ff246bbd74c6ecc", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in studio.html:348"}, "properties": {"repobilityId": "114f7e83c2f77d44", "scanner": "scanner-primary", "fingerprint": "5ff246bbd74c6ecc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "studio.html"}, "region": {"startLine": 348}}}]}, {"ruleId": "scanner-375a73303d7ec8c6", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in studio.html:349"}, "properties": {"repobilityId": "a1a35043c3da6ed9", "scanner": "scanner-primary", "fingerprint": "375a73303d7ec8c6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "studio.html"}, "region": {"startLine": 349}}}]}, {"ruleId": "scanner-c2bb7e13e9e3bbb3", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in success.html:180"}, "properties": {"repobilityId": "76c0468f1fb08a79", "scanner": "scanner-primary", "fingerprint": "c2bb7e13e9e3bbb3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "success.html"}, "region": {"startLine": 180}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-62af26641ea911c3", "level": "none", "message": {"text": "Commented-code block (6 lines) in script.js:178"}, "properties": {"repobilityId": "6ad1ccd0f442ef78", "scanner": "scanner-primary", "fingerprint": "62af26641ea911c3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4602e8597afcbf84", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 script.js:379"}, "properties": {"repobilityId": "ced3a2f6fd859a75", "scanner": "scanner-primary", "fingerprint": "4602e8597afcbf84", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}]}]}