{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-c2a45e8da205fbb5", "name": "Possibly dead Python function: timezone_filter", "shortDescription": {"text": "Possibly dead Python function: timezone_filter"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c9cacb94e3a43e02", "name": "Possibly dead Python function: upload", "shortDescription": {"text": "Possibly dead Python function: upload"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-98f6db39c67cd9f1", "name": "Possibly dead Python function: generate_content", "shortDescription": {"text": "Possibly dead Python function: generate_content"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f7328ed7843ab4cb", "name": "Possibly dead Python function: new_init", "shortDescription": {"text": "Possibly dead Python function: new_init"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d89c8764f1e32b32", "name": "Possibly dead Python function: patched_upload", "shortDescription": {"text": "Possibly dead Python function: patched_upload"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-adb64beaeb6aadbd", "name": "Possibly dead Python function: patched_generate", "shortDescription": {"text": "Possibly dead Python function: patched_generate"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f3476ffddba5c291", "name": "Docker base image is tag-pinned but not digest-pinned: mcr.microsoft.com/playwright:v1.52.0-noble", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: mcr.microsoft.com/playwright:v1.52.0-noble"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-77a464701f01cedf", "name": "Possible secret in README.md", "shortDescription": {"text": "Possible secret in README.md"}, "fullDescription": {"text": "Detected pattern matching openai_or_anthropic_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-d56e84d180abcf46", "name": "Possible secret in docker-compose.yaml", "shortDescription": {"text": "Possible secret in docker-compose.yaml"}, "fullDescription": {"text": "Detected pattern matching openai_or_anthropic_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7f0f9976570faa6d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-68a2b8f5c8cd6b53", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-117f6527ca023e42", "name": "Very large file: src/epic_free/epic/store.py (1628 lines)", "shortDescription": {"text": "Very large file: src/epic_free/epic/store.py (1628 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "1 test file(s) for 16 source file(s) (ratio 0.06). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8d79201050f56b0e", "name": "Commented-code block (7 lines) in src/epic_free/llm/openai_compat.py:43", "shortDescription": {"text": "Commented-code block (7 lines) in src/epic_free/llm/openai_compat.py:43"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1b5a76780c3df9aa", "name": "1 env vars used in code but missing from .env.example", "shortDescription": {"text": "1 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `LOG_LEVEL`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24398"}, "properties": {"repository": "Autsunset/epic-free", "repoUrl": "https://github.com/Autsunset/epic-free", "branch": "main"}, "results": [{"ruleId": "scanner-c2a45e8da205fbb5", "level": "note", "message": {"text": "Possibly dead Python function: timezone_filter"}, "properties": {"repobilityId": "c9fdc4a35f18432a", "scanner": "scanner-primary", "fingerprint": "c2a45e8da205fbb5", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/epic_free/logging_setup.py:8"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c9cacb94e3a43e02", "level": "note", "message": {"text": "Possibly dead Python function: upload"}, "properties": {"repobilityId": "7f7222445cb54387", "scanner": "scanner-primary", "fingerprint": "c9cacb94e3a43e02", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/epic_free/llm/openai_compat.py:101"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-98f6db39c67cd9f1", "level": "note", "message": {"text": "Possibly dead Python function: generate_content"}, "properties": {"repobilityId": "b441b32ded4d6a68", "scanner": "scanner-primary", "fingerprint": "98f6db39c67cd9f1", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/epic_free/llm/openai_compat.py:338"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f7328ed7843ab4cb", "level": "note", "message": {"text": "Possibly dead Python function: new_init"}, "properties": {"repobilityId": "4d0aa0fcf5625cda", "scanner": "scanner-primary", "fingerprint": "f7328ed7843ab4cb", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/epic_free/llm/gemini.py:27"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d89c8764f1e32b32", "level": "note", "message": {"text": "Possibly dead Python function: patched_upload"}, "properties": {"repobilityId": "c293e2b08cdd18ce", "scanner": "scanner-primary", "fingerprint": "d89c8764f1e32b32", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/epic_free/llm/gemini.py:49"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-adb64beaeb6aadbd", "level": "note", "message": {"text": "Possibly dead Python function: patched_generate"}, "properties": {"repobilityId": "db588cd3052a236a", "scanner": "scanner-primary", "fingerprint": "adb64beaeb6aadbd", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/epic_free/llm/gemini.py:57"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-f3476ffddba5c291", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: mcr.microsoft.com/playwright:v1.52.0-noble"}, "properties": {"repobilityId": "1ece927216e73f3e", "scanner": "scanner-primary", "fingerprint": "f3476ffddba5c291", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-77a464701f01cedf", "level": "error", "message": {"text": "Possible secret in README.md"}, "properties": {"repobilityId": "a59ac585d982c828", "scanner": "scanner-primary", "fingerprint": "77a464701f01cedf", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "README.md"}, "region": {"startLine": 77}}}]}, {"ruleId": "scanner-d56e84d180abcf46", "level": "error", "message": {"text": "Possible secret in docker-compose.yaml"}, "properties": {"repobilityId": "cc490da28d4d5f29", "scanner": "scanner-primary", "fingerprint": "d56e84d180abcf46", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.yaml"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-7f0f9976570faa6d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "8ae5e48e366ecdcb", "scanner": "scanner-primary", "fingerprint": "7f0f9976570faa6d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker.yml"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-7f0f9976570faa6d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "49f477cbbe083433", "scanner": "scanner-primary", "fingerprint": "7f0f9976570faa6d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker.yml"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-7f0f9976570faa6d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "19a3e05b43a287b5", "scanner": "scanner-primary", "fingerprint": "7f0f9976570faa6d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-7f0f9976570faa6d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d6aa7210cf6c969d", "scanner": "scanner-primary", "fingerprint": "7f0f9976570faa6d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker.yml"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-7f0f9976570faa6d", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5f7d5d8fad9ae56d", "scanner": "scanner-primary", "fingerprint": "7f0f9976570faa6d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker.yml"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-68a2b8f5c8cd6b53", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "0036b33690fe05ae", "scanner": "scanner-primary", "fingerprint": "68a2b8f5c8cd6b53", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/docker.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-117f6527ca023e42", "level": "note", "message": {"text": "Very large file: src/epic_free/epic/store.py (1628 lines)"}, "properties": {"repobilityId": "b1ec19303cda2187", "scanner": "scanner-primary", "fingerprint": "117f6527ca023e42", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-8d79201050f56b0e", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/epic_free/llm/openai_compat.py:43"}, "properties": {"repobilityId": "2c09d76cb0539782", "scanner": "scanner-primary", "fingerprint": "8d79201050f56b0e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1b5a76780c3df9aa", "level": "none", "message": {"text": "1 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "d04379b337b44a15", "scanner": "scanner-primary", "fingerprint": "1b5a76780c3df9aa", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}]}]}