{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7805398cf9a89b36", "name": "Possible secret in spec/client_spec.rb", "shortDescription": {"text": "Possible secret in spec/client_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-767920ed5404e036", "name": "Possible secret in spec/request_body_spec.rb", "shortDescription": {"text": "Possible secret in spec/request_body_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-35294f79fda5e1b9", "name": "Possible secret in spec/admin_api_spec.rb", "shortDescription": {"text": "Possible secret in spec/admin_api_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-2a90838b890c9697", "name": "Possible secret in spec/integration/realtime_live_spec.rb", "shortDescription": {"text": "Possible secret in spec/integration/realtime_live_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-8305cc38c751bdbc", "name": "Possible secret in spec/supabase/auth/http_client_audit_spec.rb", "shortDescription": {"text": "Possible secret in spec/supabase/auth/http_client_audit_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-b494a0cdab3117bd", "name": "Possible secret in spec/supabase/auth/us009_http_client_audit_spec.rb", "shortDescription": {"text": "Possible secret in spec/supabase/auth/us009_http_client_audit_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-1af07bfa030c6446", "name": "Possible secret in spec/supabase/auth/us004_admin_api_audit_spec.rb", "shortDescription": {"text": "Possible secret in spec/supabase/auth/us004_admin_api_audit_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-fd0d4b07a54a6fdd", "name": "Possible secret in spec/supabase/auth/us015_comprehensive_coverage_spec.rb", "shortDescription": {"text": "Possible secret in spec/supabase/auth/us015_comprehensive_coverage_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-fd09633143a32463", "name": "Possible secret in spec/supabase/auth/event_subscription_spec.rb", "shortDescription": {"text": "Possible secret in spec/supabase/auth/event_subscription_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-7eacf52fa893e5ec", "name": "Possible secret in spec/supabase/auth/us006_x_client_info_spec.rb", "shortDescription": {"text": "Possible secret in spec/supabase/auth/us006_x_client_info_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-fb7162a1f8f33b4a", "name": "Possible secret in spec/supabase/auth/us003_user_management_audit_spec.rb", "shortDescription": {"text": "Possible secret in spec/supabase/auth/us003_user_management_audit_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-6ea7eb9890cc3e41", "name": "Possible secret in spec/supabase/auth/us012_event_subscription_audit_spec.rb", "shortDescription": {"text": "Possible secret in spec/supabase/auth/us012_event_subscription_audit_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-9c9e4a2b1d39f881", "name": "Possible secret in spec/supabase/auth/audit_findings_spec.rb", "shortDescription": {"text": "Possible secret in spec/supabase/auth/audit_findings_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-2d000f8d92a38d0c", "name": "Possible secret in spec/supabase/auth/api_spec.rb", "shortDescription": {"text": "Possible secret in spec/supabase/auth/api_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "ruby/setup-ruby@v1 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20522"}, "properties": {"repository": "supabase-ruby/supabase-rb", "repoUrl": "https://github.com/supabase-ruby/supabase-rb", "branch": "main"}, "results": [{"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-7805398cf9a89b36", "level": "error", "message": {"text": "Possible secret in spec/client_spec.rb"}, "properties": {"repobilityId": "f03244af6ff083bb", "scanner": "scanner-primary", "fingerprint": "7805398cf9a89b36", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/client_spec.rb"}, "region": {"startLine": 549}}}]}, {"ruleId": "scanner-767920ed5404e036", "level": "error", "message": {"text": "Possible secret in spec/request_body_spec.rb"}, "properties": {"repobilityId": "e3be0c9f47690b8e", "scanner": "scanner-primary", "fingerprint": "767920ed5404e036", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/request_body_spec.rb"}, "region": {"startLine": 80}}}]}, {"ruleId": "scanner-767920ed5404e036", "level": "error", "message": {"text": "Possible secret in spec/request_body_spec.rb"}, "properties": {"repobilityId": "e3be0c9f47690b8e", "scanner": "scanner-primary", "fingerprint": "767920ed5404e036", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/request_body_spec.rb"}, "region": {"startLine": 102}}}]}, {"ruleId": "scanner-767920ed5404e036", "level": "error", "message": {"text": "Possible secret in spec/request_body_spec.rb"}, "properties": {"repobilityId": "e3be0c9f47690b8e", "scanner": "scanner-primary", "fingerprint": "767920ed5404e036", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/request_body_spec.rb"}, "region": {"startLine": 123}}}]}, {"ruleId": "scanner-767920ed5404e036", "level": "error", "message": {"text": "Possible secret in spec/request_body_spec.rb"}, "properties": {"repobilityId": "e3be0c9f47690b8e", "scanner": "scanner-primary", "fingerprint": "767920ed5404e036", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/request_body_spec.rb"}, "region": {"startLine": 133}}}]}, {"ruleId": "scanner-767920ed5404e036", "level": "error", "message": {"text": "Possible secret in spec/request_body_spec.rb"}, "properties": {"repobilityId": "e3be0c9f47690b8e", "scanner": "scanner-primary", "fingerprint": "767920ed5404e036", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/request_body_spec.rb"}, "region": {"startLine": 145}}}]}, {"ruleId": "scanner-767920ed5404e036", "level": "error", "message": {"text": "Possible secret in spec/request_body_spec.rb"}, "properties": {"repobilityId": "e3be0c9f47690b8e", "scanner": "scanner-primary", "fingerprint": "767920ed5404e036", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/request_body_spec.rb"}, "region": {"startLine": 156}}}]}, {"ruleId": "scanner-767920ed5404e036", "level": "error", "message": {"text": "Possible secret in spec/request_body_spec.rb"}, "properties": {"repobilityId": "e3be0c9f47690b8e", "scanner": "scanner-primary", "fingerprint": "767920ed5404e036", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/request_body_spec.rb"}, "region": {"startLine": 164}}}]}, {"ruleId": "scanner-767920ed5404e036", "level": "error", "message": {"text": "Possible secret in spec/request_body_spec.rb"}, "properties": {"repobilityId": "e3be0c9f47690b8e", "scanner": "scanner-primary", "fingerprint": "767920ed5404e036", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/request_body_spec.rb"}, "region": {"startLine": 174}}}]}, {"ruleId": "scanner-767920ed5404e036", "level": "error", "message": {"text": "Possible secret in spec/request_body_spec.rb"}, "properties": {"repobilityId": "e3be0c9f47690b8e", "scanner": "scanner-primary", "fingerprint": "767920ed5404e036", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/request_body_spec.rb"}, "region": {"startLine": 188}}}]}, {"ruleId": "scanner-767920ed5404e036", "level": "error", "message": {"text": "Possible secret in spec/request_body_spec.rb"}, "properties": {"repobilityId": "e3be0c9f47690b8e", "scanner": "scanner-primary", "fingerprint": "767920ed5404e036", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/request_body_spec.rb"}, "region": {"startLine": 207}}}]}, {"ruleId": "scanner-767920ed5404e036", "level": "error", "message": {"text": "Possible secret in spec/request_body_spec.rb"}, "properties": {"repobilityId": "e3be0c9f47690b8e", "scanner": "scanner-primary", "fingerprint": "767920ed5404e036", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/request_body_spec.rb"}, "region": {"startLine": 1898}}}]}, {"ruleId": "scanner-767920ed5404e036", "level": "error", "message": {"text": "Possible secret in spec/request_body_spec.rb"}, "properties": {"repobilityId": "e3be0c9f47690b8e", "scanner": "scanner-primary", "fingerprint": "767920ed5404e036", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/request_body_spec.rb"}, "region": {"startLine": 1903}}}]}, {"ruleId": "scanner-767920ed5404e036", "level": "error", "message": {"text": "Possible secret in spec/request_body_spec.rb"}, "properties": {"repobilityId": "e3be0c9f47690b8e", "scanner": "scanner-primary", "fingerprint": "767920ed5404e036", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/request_body_spec.rb"}, "region": {"startLine": 1910}}}]}, {"ruleId": "scanner-767920ed5404e036", "level": "error", "message": {"text": "Possible secret in spec/request_body_spec.rb"}, "properties": {"repobilityId": "e3be0c9f47690b8e", "scanner": "scanner-primary", "fingerprint": "767920ed5404e036", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/request_body_spec.rb"}, "region": {"startLine": 2121}}}]}, {"ruleId": "scanner-35294f79fda5e1b9", "level": "error", "message": {"text": "Possible secret in spec/admin_api_spec.rb"}, "properties": {"repobilityId": "90b3f7b8ffc5a3cb", "scanner": "scanner-primary", "fingerprint": "35294f79fda5e1b9", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/admin_api_spec.rb"}, "region": {"startLine": 164}}}]}, {"ruleId": "scanner-35294f79fda5e1b9", "level": "error", "message": {"text": "Possible secret in spec/admin_api_spec.rb"}, "properties": {"repobilityId": "90b3f7b8ffc5a3cb", "scanner": "scanner-primary", "fingerprint": "35294f79fda5e1b9", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/admin_api_spec.rb"}, "region": {"startLine": 174}}}]}, {"ruleId": "scanner-35294f79fda5e1b9", "level": "error", "message": {"text": "Possible secret in spec/admin_api_spec.rb"}, "properties": {"repobilityId": "90b3f7b8ffc5a3cb", "scanner": "scanner-primary", "fingerprint": "35294f79fda5e1b9", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/admin_api_spec.rb"}, "region": {"startLine": 467}}}]}, {"ruleId": "scanner-35294f79fda5e1b9", "level": "error", "message": {"text": "Possible secret in spec/admin_api_spec.rb"}, "properties": {"repobilityId": "90b3f7b8ffc5a3cb", "scanner": "scanner-primary", "fingerprint": "35294f79fda5e1b9", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/admin_api_spec.rb"}, "region": {"startLine": 468}}}]}, {"ruleId": "scanner-2a90838b890c9697", "level": "error", "message": {"text": "Possible secret in spec/integration/realtime_live_spec.rb"}, "properties": {"repobilityId": "938a35f6b87af9a4", "scanner": "scanner-primary", "fingerprint": "2a90838b890c9697", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/integration/realtime_live_spec.rb"}, "region": {"startLine": 166}}}]}, {"ruleId": "scanner-8305cc38c751bdbc", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/http_client_audit_spec.rb"}, "properties": {"repobilityId": "df02bb98baa100aa", "scanner": "scanner-primary", "fingerprint": "8305cc38c751bdbc", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/http_client_audit_spec.rb"}, "region": {"startLine": 354}}}]}, {"ruleId": "scanner-b494a0cdab3117bd", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/us009_http_client_audit_spec.rb"}, "properties": {"repobilityId": "b7a81176858321be", "scanner": "scanner-primary", "fingerprint": "b494a0cdab3117bd", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/us009_http_client_audit_spec.rb"}, "region": {"startLine": 434}}}]}, {"ruleId": "scanner-1af07bfa030c6446", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/us004_admin_api_audit_spec.rb"}, "properties": {"repobilityId": "b2c53840ac6bf7b0", "scanner": "scanner-primary", "fingerprint": "1af07bfa030c6446", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/us004_admin_api_audit_spec.rb"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-1af07bfa030c6446", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/us004_admin_api_audit_spec.rb"}, "properties": {"repobilityId": "b2c53840ac6bf7b0", "scanner": "scanner-primary", "fingerprint": "1af07bfa030c6446", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/us004_admin_api_audit_spec.rb"}, "region": {"startLine": 72}}}]}, {"ruleId": "scanner-1af07bfa030c6446", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/us004_admin_api_audit_spec.rb"}, "properties": {"repobilityId": "b2c53840ac6bf7b0", "scanner": "scanner-primary", "fingerprint": "1af07bfa030c6446", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/us004_admin_api_audit_spec.rb"}, "region": {"startLine": 81}}}]}, {"ruleId": "scanner-1af07bfa030c6446", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/us004_admin_api_audit_spec.rb"}, "properties": {"repobilityId": "b2c53840ac6bf7b0", "scanner": "scanner-primary", "fingerprint": "1af07bfa030c6446", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/us004_admin_api_audit_spec.rb"}, "region": {"startLine": 404}}}]}, {"ruleId": "scanner-1af07bfa030c6446", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/us004_admin_api_audit_spec.rb"}, "properties": {"repobilityId": "b2c53840ac6bf7b0", "scanner": "scanner-primary", "fingerprint": "1af07bfa030c6446", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/us004_admin_api_audit_spec.rb"}, "region": {"startLine": 419}}}]}, {"ruleId": "scanner-1af07bfa030c6446", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/us004_admin_api_audit_spec.rb"}, "properties": {"repobilityId": "b2c53840ac6bf7b0", "scanner": "scanner-primary", "fingerprint": "1af07bfa030c6446", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/us004_admin_api_audit_spec.rb"}, "region": {"startLine": 531}}}]}, {"ruleId": "scanner-fd0d4b07a54a6fdd", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/us015_comprehensive_coverage_spec.rb"}, "properties": {"repobilityId": "87ca3dd424f1bea2", "scanner": "scanner-primary", "fingerprint": "fd0d4b07a54a6fdd", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/us015_comprehensive_coverage_spec.rb"}, "region": {"startLine": 156}}}]}, {"ruleId": "scanner-fd0d4b07a54a6fdd", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/us015_comprehensive_coverage_spec.rb"}, "properties": {"repobilityId": "87ca3dd424f1bea2", "scanner": "scanner-primary", "fingerprint": "fd0d4b07a54a6fdd", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/us015_comprehensive_coverage_spec.rb"}, "region": {"startLine": 169}}}]}, {"ruleId": "scanner-fd0d4b07a54a6fdd", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/us015_comprehensive_coverage_spec.rb"}, "properties": {"repobilityId": "87ca3dd424f1bea2", "scanner": "scanner-primary", "fingerprint": "fd0d4b07a54a6fdd", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/us015_comprehensive_coverage_spec.rb"}, "region": {"startLine": 198}}}]}, {"ruleId": "scanner-fd09633143a32463", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/event_subscription_spec.rb"}, "properties": {"repobilityId": "e64a007c016fcde9", "scanner": "scanner-primary", "fingerprint": "fd09633143a32463", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/event_subscription_spec.rb"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-fd09633143a32463", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/event_subscription_spec.rb"}, "properties": {"repobilityId": "e64a007c016fcde9", "scanner": "scanner-primary", "fingerprint": "fd09633143a32463", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/event_subscription_spec.rb"}, "region": {"startLine": 95}}}]}, {"ruleId": "scanner-fd09633143a32463", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/event_subscription_spec.rb"}, "properties": {"repobilityId": "e64a007c016fcde9", "scanner": "scanner-primary", "fingerprint": "fd09633143a32463", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/event_subscription_spec.rb"}, "region": {"startLine": 265}}}]}, {"ruleId": "scanner-fd09633143a32463", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/event_subscription_spec.rb"}, "properties": {"repobilityId": "e64a007c016fcde9", "scanner": "scanner-primary", "fingerprint": "fd09633143a32463", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/event_subscription_spec.rb"}, "region": {"startLine": 292}}}]}, {"ruleId": "scanner-fd09633143a32463", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/event_subscription_spec.rb"}, "properties": {"repobilityId": "e64a007c016fcde9", "scanner": "scanner-primary", "fingerprint": "fd09633143a32463", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/event_subscription_spec.rb"}, "region": {"startLine": 313}}}]}, {"ruleId": "scanner-fd09633143a32463", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/event_subscription_spec.rb"}, "properties": {"repobilityId": "e64a007c016fcde9", "scanner": "scanner-primary", "fingerprint": "fd09633143a32463", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/event_subscription_spec.rb"}, "region": {"startLine": 332}}}]}, {"ruleId": "scanner-7eacf52fa893e5ec", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/us006_x_client_info_spec.rb"}, "properties": {"repobilityId": "10cbfee83169b6ca", "scanner": "scanner-primary", "fingerprint": "7eacf52fa893e5ec", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/us006_x_client_info_spec.rb"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-7eacf52fa893e5ec", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/us006_x_client_info_spec.rb"}, "properties": {"repobilityId": "10cbfee83169b6ca", "scanner": "scanner-primary", "fingerprint": "7eacf52fa893e5ec", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/us006_x_client_info_spec.rb"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-7eacf52fa893e5ec", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/us006_x_client_info_spec.rb"}, "properties": {"repobilityId": "10cbfee83169b6ca", "scanner": "scanner-primary", "fingerprint": "7eacf52fa893e5ec", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/us006_x_client_info_spec.rb"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-7eacf52fa893e5ec", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/us006_x_client_info_spec.rb"}, "properties": {"repobilityId": "10cbfee83169b6ca", "scanner": "scanner-primary", "fingerprint": "7eacf52fa893e5ec", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/us006_x_client_info_spec.rb"}, "region": {"startLine": 94}}}]}, {"ruleId": "scanner-fb7162a1f8f33b4a", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/us003_user_management_audit_spec.rb"}, "properties": {"repobilityId": "f6adccf940dc6d5b", "scanner": "scanner-primary", "fingerprint": "fb7162a1f8f33b4a", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/us003_user_management_audit_spec.rb"}, "region": {"startLine": 176}}}]}, {"ruleId": "scanner-6ea7eb9890cc3e41", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/us012_event_subscription_audit_spec.rb"}, "properties": {"repobilityId": "115ec87138293e01", "scanner": "scanner-primary", "fingerprint": "6ea7eb9890cc3e41", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/us012_event_subscription_audit_spec.rb"}, "region": {"startLine": 114}}}]}, {"ruleId": "scanner-6ea7eb9890cc3e41", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/us012_event_subscription_audit_spec.rb"}, "properties": {"repobilityId": "115ec87138293e01", "scanner": "scanner-primary", "fingerprint": "6ea7eb9890cc3e41", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/us012_event_subscription_audit_spec.rb"}, "region": {"startLine": 128}}}]}, {"ruleId": "scanner-6ea7eb9890cc3e41", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/us012_event_subscription_audit_spec.rb"}, "properties": {"repobilityId": "115ec87138293e01", "scanner": "scanner-primary", "fingerprint": "6ea7eb9890cc3e41", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/us012_event_subscription_audit_spec.rb"}, "region": {"startLine": 294}}}]}, {"ruleId": "scanner-6ea7eb9890cc3e41", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/us012_event_subscription_audit_spec.rb"}, "properties": {"repobilityId": "115ec87138293e01", "scanner": "scanner-primary", "fingerprint": "6ea7eb9890cc3e41", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/us012_event_subscription_audit_spec.rb"}, "region": {"startLine": 313}}}]}, {"ruleId": "scanner-6ea7eb9890cc3e41", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/us012_event_subscription_audit_spec.rb"}, "properties": {"repobilityId": "115ec87138293e01", "scanner": "scanner-primary", "fingerprint": "6ea7eb9890cc3e41", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/us012_event_subscription_audit_spec.rb"}, "region": {"startLine": 332}}}]}, {"ruleId": "scanner-6ea7eb9890cc3e41", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/us012_event_subscription_audit_spec.rb"}, "properties": {"repobilityId": "115ec87138293e01", "scanner": "scanner-primary", "fingerprint": "6ea7eb9890cc3e41", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/us012_event_subscription_audit_spec.rb"}, "region": {"startLine": 337}}}]}, {"ruleId": "scanner-6ea7eb9890cc3e41", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/us012_event_subscription_audit_spec.rb"}, "properties": {"repobilityId": "115ec87138293e01", "scanner": "scanner-primary", "fingerprint": "6ea7eb9890cc3e41", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/us012_event_subscription_audit_spec.rb"}, "region": {"startLine": 352}}}]}, {"ruleId": "scanner-6ea7eb9890cc3e41", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/us012_event_subscription_audit_spec.rb"}, "properties": {"repobilityId": "115ec87138293e01", "scanner": "scanner-primary", "fingerprint": "6ea7eb9890cc3e41", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/us012_event_subscription_audit_spec.rb"}, "region": {"startLine": 358}}}]}, {"ruleId": "scanner-6ea7eb9890cc3e41", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/us012_event_subscription_audit_spec.rb"}, "properties": {"repobilityId": "115ec87138293e01", "scanner": "scanner-primary", "fingerprint": "6ea7eb9890cc3e41", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/us012_event_subscription_audit_spec.rb"}, "region": {"startLine": 399}}}]}, {"ruleId": "scanner-6ea7eb9890cc3e41", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/us012_event_subscription_audit_spec.rb"}, "properties": {"repobilityId": "115ec87138293e01", "scanner": "scanner-primary", "fingerprint": "6ea7eb9890cc3e41", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/us012_event_subscription_audit_spec.rb"}, "region": {"startLine": 511}}}]}, {"ruleId": "scanner-9c9e4a2b1d39f881", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/audit_findings_spec.rb"}, "properties": {"repobilityId": "9900c5b226c65cb1", "scanner": "scanner-primary", "fingerprint": "9c9e4a2b1d39f881", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/audit_findings_spec.rb"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-9c9e4a2b1d39f881", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/audit_findings_spec.rb"}, "properties": {"repobilityId": "9900c5b226c65cb1", "scanner": "scanner-primary", "fingerprint": "9c9e4a2b1d39f881", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/audit_findings_spec.rb"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-9c9e4a2b1d39f881", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/audit_findings_spec.rb"}, "properties": {"repobilityId": "9900c5b226c65cb1", "scanner": "scanner-primary", "fingerprint": "9c9e4a2b1d39f881", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/audit_findings_spec.rb"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-9c9e4a2b1d39f881", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/audit_findings_spec.rb"}, "properties": {"repobilityId": "9900c5b226c65cb1", "scanner": "scanner-primary", "fingerprint": "9c9e4a2b1d39f881", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/audit_findings_spec.rb"}, "region": {"startLine": 75}}}]}, {"ruleId": "scanner-2d000f8d92a38d0c", "level": "error", "message": {"text": "Possible secret in spec/supabase/auth/api_spec.rb"}, "properties": {"repobilityId": "a418af9cc73b22e4", "scanner": "scanner-primary", "fingerprint": "2d000f8d92a38d0c", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/supabase/auth/api_spec.rb"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "64978d6af70613bb", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "94496af5c2f647df", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "08edc2a05eab2f1a", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "acd528282d5f40f6", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "db784a35a2271309", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "60fecdf71a2aba42", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}]}]}