{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-a2f7dc53a855ce39", "name": "Stray `console.log` in TS/JS \u2014 engine/test/smoke.ts:12", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 engine/test/smoke.ts:12"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f6841cfd0527d129", "name": "Dockerfile runs as root: engine/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: engine/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2826113905a05955", "name": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7e6696ce25c3721b", "name": "Insecure pattern 'direct_innerhtml_assignment' in v6/signup.html:109", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v6/signup.html:109"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f5532ddede8e0fcf", "name": "Insecure pattern 'direct_innerhtml_assignment' in v6/05-execution.html:240", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v6/05-execution.html:240"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4e741e35b1bcc4db", "name": "Insecure pattern 'direct_innerhtml_assignment' in v6/been.html:85", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v6/been.html:85"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-292ce9cac235949c", "name": "Insecure pattern 'direct_innerhtml_assignment' in v6/06-hiccup-handler.html:257", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v6/06-hiccup-handler.html:257"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-564000b061dfbacd", "name": "Insecure pattern 'direct_innerhtml_assignment' in v6/08-concierge.html:148", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v6/08-concierge.html:148"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-72a5546ba6cf99d6", "name": "Insecure pattern 'direct_innerhtml_assignment' in v6/checkout.html:108", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v6/checkout.html:108"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7195d965a42ea373", "name": "Insecure pattern 'direct_innerhtml_assignment' in v6/04-connections.html:254", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v6/04-connections.html:254"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11ba4ab1597d810c", "name": "Insecure pattern 'direct_outerhtml_assignment' in v6/admin.html:301", "shortDescription": {"text": "Insecure pattern 'direct_outerhtml_assignment' in v6/admin.html:301"}, "fullDescription": {"text": "Found a known-risky pattern (direct_outerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3163d1675d45e4b8", "name": "Insecure pattern 'insert_adjacent_html' in v6/07-itinerary.html:156", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in v6/07-itinerary.html:156"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9fb5a36b956c0b9", "name": "Insecure pattern 'direct_innerhtml_assignment' in v6/welcome.html:208", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v6/welcome.html:208"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8a2f2910d7c0abd9", "name": "Insecure pattern 'direct_innerhtml_assignment' in v6/account.html:141", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v6/account.html:141"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-39c219447a62f79a", "name": "Insecure pattern 'direct_innerhtml_assignment' in v6/03-paste-trip.html:233", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v6/03-paste-trip.html:233"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3fc41dac74fc4f9e", "name": "Insecure pattern 'direct_innerhtml_assignment' in v6/02-taste-engine.html:239", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v6/02-taste-engine.html:239"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c546ad79683eaba1", "name": "Insecure pattern 'insert_adjacent_html' in v6/02-taste-engine.html:205", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in v6/02-taste-engine.html:205"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e178b58b4804d9aa", "name": "Insecure pattern 'direct_innerhtml_assignment' in v6/auth/signup.html:158", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v6/auth/signup.html:158"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d7d5fdca339ae5a5", "name": "Insecure pattern 'direct_innerhtml_assignment' in v6/auth/login.html:145", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v6/auth/login.html:145"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-692ff24571c0f938", "name": "Insecure pattern 'direct_innerhtml_assignment' in v6/assets/menu.js:65", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v6/assets/menu.js:65"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1739c487e0ef11df", "name": "Insecure pattern 'direct_innerhtml_assignment' in v8/signup.html:125", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/signup.html:125"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-103adbf089e7077b", "name": "Insecure pattern 'direct_innerhtml_assignment' in v8/05-execution.html:256", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/05-execution.html:256"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-183cfad5ef021268", "name": "Insecure pattern 'direct_innerhtml_assignment' in v8/been.html:101", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/been.html:101"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a7d395a979676e70", "name": "Insecure pattern 'direct_innerhtml_assignment' in v8/06-hiccup-handler.html:273", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/06-hiccup-handler.html:273"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e04d6650cfd1cfc4", "name": "Insecure pattern 'direct_innerhtml_assignment' in v8/08-concierge.html:164", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/08-concierge.html:164"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-479a0eafa2f34a4d", "name": "Insecure pattern 'direct_innerhtml_assignment' in v8/checkout.html:166", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/checkout.html:166"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-515ce52beea8fa50", "name": "Insecure pattern 'direct_innerhtml_assignment' in v8/04-connections.html:270", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/04-connections.html:270"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5e7b9161f87f8b4c", "name": "Insecure pattern 'direct_outerhtml_assignment' in v8/admin.html:316", "shortDescription": {"text": "Insecure pattern 'direct_outerhtml_assignment' in v8/admin.html:316"}, "fullDescription": {"text": "Found a known-risky pattern (direct_outerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-77876feb34b7f743", "name": "Insecure pattern 'insert_adjacent_html' in v8/07-itinerary.html:182", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in v8/07-itinerary.html:182"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f6aa4d0767def8da", "name": "Insecure pattern 'direct_innerhtml_assignment' in v8/welcome.html:238", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/welcome.html:238"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0e316658845a4a50", "name": "Insecure pattern 'direct_innerhtml_assignment' in v8/palette.html:134", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/palette.html:134"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1e94863cd91660b5", "name": "Insecure pattern 'direct_innerhtml_assignment' in v8/write.html:234", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/write.html:234"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-61f0293e8faf77d0", "name": "Insecure pattern 'direct_innerhtml_assignment' in v8/account.html:156", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/account.html:156"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e44121bb73137636", "name": "Insecure pattern 'direct_innerhtml_assignment' in v8/03-paste-trip.html:301", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/03-paste-trip.html:301"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c65ff8b05a7a6420", "name": "Insecure pattern 'direct_innerhtml_assignment' in v8/02-taste-engine.html:264", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/02-taste-engine.html:264"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aa4836ac59e63b56", "name": "Insecure pattern 'insert_adjacent_html' in v8/02-taste-engine.html:230", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in v8/02-taste-engine.html:230"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0ede806e6aa1ffb5", "name": "Insecure pattern 'direct_innerhtml_assignment' in v8/auth/signup.html:173", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/auth/signup.html:173"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-60e431767e87fa9a", "name": "Insecure pattern 'direct_innerhtml_assignment' in v8/auth/login.html:160", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/auth/login.html:160"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-28088565f9ed542d", "name": "Insecure pattern 'direct_innerhtml_assignment' in v8/assets/menu.js:54", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/assets/menu.js:54"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c420727704a314d4", "name": "Insecure pattern 'direct_innerhtml_assignment' in v8/assets/voice.js:62", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/assets/voice.js:62"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a202304ff40944ff", "name": "Insecure pattern 'direct_innerhtml_assignment' in v7/signup.html:109", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/signup.html:109"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-757636a3872fd981", "name": "Insecure pattern 'direct_innerhtml_assignment' in v7/05-execution.html:240", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/05-execution.html:240"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7869a6da6133bf74", "name": "Insecure pattern 'direct_innerhtml_assignment' in v7/been.html:85", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/been.html:85"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0e0d03208e859edc", "name": "Insecure pattern 'direct_innerhtml_assignment' in v7/06-hiccup-handler.html:257", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/06-hiccup-handler.html:257"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ebc089208c8aee70", "name": "Insecure pattern 'direct_innerhtml_assignment' in v7/08-concierge.html:148", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/08-concierge.html:148"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0b3305da9fbfd378", "name": "Insecure pattern 'direct_innerhtml_assignment' in v7/checkout.html:108", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/checkout.html:108"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-74aaccb7cbd324e9", "name": "Insecure pattern 'direct_innerhtml_assignment' in v7/04-connections.html:254", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/04-connections.html:254"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2257a5ca1dfc5b6b", "name": "Insecure pattern 'direct_outerhtml_assignment' in v7/admin.html:301", "shortDescription": {"text": "Insecure pattern 'direct_outerhtml_assignment' in v7/admin.html:301"}, "fullDescription": {"text": "Found a known-risky pattern (direct_outerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7fde03580d55ef71", "name": "Insecure pattern 'insert_adjacent_html' in v7/07-itinerary.html:156", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in v7/07-itinerary.html:156"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ab95a4d05fca0811", "name": "Insecure pattern 'direct_innerhtml_assignment' in v7/welcome.html:222", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/welcome.html:222"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-90e0974d59313ca1", "name": "Insecure pattern 'direct_innerhtml_assignment' in v7/account.html:141", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/account.html:141"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ac82736ee0652d6", "name": "Insecure pattern 'direct_innerhtml_assignment' in v7/03-paste-trip.html:267", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/03-paste-trip.html:267"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eb22cea5fe99a47b", "name": "Insecure pattern 'direct_innerhtml_assignment' in v7/02-taste-engine.html:239", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/02-taste-engine.html:239"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-96ec1246fa2ab801", "name": "Insecure pattern 'insert_adjacent_html' in v7/02-taste-engine.html:205", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in v7/02-taste-engine.html:205"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fa59b16353f5dbad", "name": "Insecure pattern 'direct_innerhtml_assignment' in v7/auth/signup.html:158", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/auth/signup.html:158"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c2123a9c0198d929", "name": "Insecure pattern 'direct_innerhtml_assignment' in v7/auth/login.html:145", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/auth/login.html:145"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-edd6f78ba3985a84", "name": "Insecure pattern 'direct_innerhtml_assignment' in v7/assets/menu.js:25", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/assets/menu.js:25"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c6f331be53364cdd", "name": "Insecure pattern 'direct_innerhtml_assignment' in v7/assets/voice.js:62", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/assets/voice.js:62"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8bd7f1d7d2d29325", "name": "Insecure pattern 'direct_innerhtml_assignment' in v5/signup.html:109", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v5/signup.html:109"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0323f34872a8d9dc", "name": "Insecure pattern 'direct_innerhtml_assignment' in v5/05-execution.html:240", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v5/05-execution.html:240"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c608a754c64d3de", "name": "Insecure pattern 'direct_innerhtml_assignment' in v5/been.html:85", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v5/been.html:85"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f746a723d958284e", "name": "Insecure pattern 'direct_innerhtml_assignment' in v5/06-hiccup-handler.html:257", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v5/06-hiccup-handler.html:257"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-681cd4c3f71ed7d6", "name": "Insecure pattern 'direct_innerhtml_assignment' in v5/08-concierge.html:148", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v5/08-concierge.html:148"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-505f977fad6c5eb8", "name": "Insecure pattern 'direct_innerhtml_assignment' in v5/checkout.html:108", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v5/checkout.html:108"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-222e6bd537d11554", "name": "Insecure pattern 'direct_innerhtml_assignment' in v5/04-connections.html:254", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v5/04-connections.html:254"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6f3e1d9a437100b4", "name": "Insecure pattern 'direct_outerhtml_assignment' in v5/admin.html:301", "shortDescription": {"text": "Insecure pattern 'direct_outerhtml_assignment' in v5/admin.html:301"}, "fullDescription": {"text": "Found a known-risky pattern (direct_outerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e0b628f20c0faa76", "name": "Insecure pattern 'insert_adjacent_html' in v5/07-itinerary.html:156", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in v5/07-itinerary.html:156"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9c5475b5b0f2b0cb", "name": "Insecure pattern 'direct_innerhtml_assignment' in v5/welcome.html:198", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v5/welcome.html:198"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c08c1279b57650b5", "name": "Insecure pattern 'direct_innerhtml_assignment' in v5/account.html:141", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v5/account.html:141"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3dcc06e7dd3b9131", "name": "Insecure pattern 'direct_innerhtml_assignment' in v5/03-paste-trip.html:233", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v5/03-paste-trip.html:233"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-df485ed2d3b18834", "name": "Insecure pattern 'direct_innerhtml_assignment' in v5/02-taste-engine.html:239", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v5/02-taste-engine.html:239"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f106941cb40069ab", "name": "Insecure pattern 'insert_adjacent_html' in v5/02-taste-engine.html:205", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in v5/02-taste-engine.html:205"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4baaa65a0696e8e6", "name": "Insecure pattern 'direct_innerhtml_assignment' in v5/auth/signup.html:158", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v5/auth/signup.html:158"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-af3685ee1148facf", "name": "Insecure pattern 'direct_innerhtml_assignment' in v5/auth/login.html:145", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v5/auth/login.html:145"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fc22c0d82f4238d0", "name": "Insecure pattern 'direct_innerhtml_assignment' in v5/assets/menu.js:65", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v5/assets/menu.js:65"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0677e6a34b71b250", "name": "Possible secret in engine/test/smoke.ts", "shortDescription": {"text": "Possible secret in engine/test/smoke.ts"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-ce13386fde233595", "name": "Insecure pattern 'direct_innerhtml_assignment' in v4/06-hiccup-handler.html:234", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v4/06-hiccup-handler.html:234"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2e933b8a1835d1c2", "name": "Insecure pattern 'direct_innerhtml_assignment' in v4/08-concierge.html:126", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v4/08-concierge.html:126"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fdf11d750244fc0e", "name": "Insecure pattern 'direct_innerhtml_assignment' in v4/02-taste-engine.html:210", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v4/02-taste-engine.html:210"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2e76c74405edb727", "name": "Insecure pattern 'insert_adjacent_html' in v4/02-taste-engine.html:194", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in v4/02-taste-engine.html:194"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "1 test file(s) for 72 source file(s) (ratio 0.01). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 34 placeholder/mock markers across 11 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c4a8765c85872b70", "name": "`fetch()` without try/.catch or AbortSignal \u2014 v6/assets/engine.js:34", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 v6/assets/engine.js:34"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-995fd9963cf1ce9c", "name": "`fetch()` without try/.catch or AbortSignal \u2014 v8/assets/engine.js:34", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 v8/assets/engine.js:34"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-98b354234f88b9d8", "name": "`fetch()` without try/.catch or AbortSignal \u2014 v7/assets/engine.js:34", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 v7/assets/engine.js:34"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-87f4d6b7eb7d566c", "name": "`fetch()` without try/.catch or AbortSignal \u2014 v5/assets/engine.js:34", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 v5/assets/engine.js:34"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e0e146767f8f0a2b", "name": "`fetch()` without try/.catch or AbortSignal \u2014 engine/src/vault/secretstore.ts:44", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 engine/src/vault/secretstore.ts:44"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6b0748ac8a13ee14", "name": "Commented-code block (5 lines) in engine/src/agent/context.ts:1", "shortDescription": {"text": "Commented-code block (5 lines) in engine/src/agent/context.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-31e62e9365fca816", "name": "Commented-code block (5 lines) in engine/src/agent/orchestrator.ts:3", "shortDescription": {"text": "Commented-code block (5 lines) in engine/src/agent/orchestrator.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-05991f50c5997af5", "name": "Commented-code block (5 lines) in engine/src/wallet/cards.ts:3", "shortDescription": {"text": "Commented-code block (5 lines) in engine/src/wallet/cards.ts:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-319e66a630e14977", "name": "2 env vars used in code but missing from .env.example", "shortDescription": {"text": "2 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `AGENT_MODEL`, `ENGINE_API_KEY`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b322fd49d9a578c1", "name": "Dangling fetch: POST https://api.deepgram.com/v1/listen?smart_format=true&model=nova-2&punctuate=true (engine/src/routes", "shortDescription": {"text": "Dangling fetch: POST https://api.deepgram.com/v1/listen?smart_format=true&model=nova-2&punctuate=true (engine/src/routes/voice.ts:23)"}, "fullDescription": {"text": "`engine/src/routes/voice.ts:23` calls `POST https://api.deepgram.com/v1/listen?smart_format=true&model=nova-2&punctuate=true` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.deepgram.com/v1/listen`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7548cb474042deeb", "name": "Dangling fetch: POST https://api.deepgram.com/v1/speak?model=aura-asteria-en&encoding=mp3 (engine/src/routes/voice.ts:50", "shortDescription": {"text": "Dangling fetch: POST https://api.deepgram.com/v1/speak?model=aura-asteria-en&encoding=mp3 (engine/src/routes/voice.ts:50)"}, "fullDescription": {"text": "`engine/src/routes/voice.ts:50` calls `POST https://api.deepgram.com/v1/speak?model=aura-asteria-en&encoding=mp3` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.deepgram.com/v1/speak`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4a12d5ed34c864c6", "name": "Unused endpoint: POST /auth/signup", "shortDescription": {"text": "Unused endpoint: POST /auth/signup"}, "fullDescription": {"text": "`engine/src/routes/auth.ts` declares `POST /auth/signup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8fdbacfe9430a6ed", "name": "Unused endpoint: POST /auth/login", "shortDescription": {"text": "Unused endpoint: POST /auth/login"}, "fullDescription": {"text": "`engine/src/routes/auth.ts` declares `POST /auth/login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ac42422b23e45104", "name": "Unused endpoint: GET /auth/me", "shortDescription": {"text": "Unused endpoint: GET /auth/me"}, "fullDescription": {"text": "`engine/src/routes/auth.ts` declares `GET /auth/me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-747d120f647f5364", "name": "Unused endpoint: POST /billing/checkout", "shortDescription": {"text": "Unused endpoint: POST /billing/checkout"}, "fullDescription": {"text": "`engine/src/routes/billing.ts` declares `POST /billing/checkout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8dc4583dbbf5b2f3", "name": "Unused endpoint: POST /billing/setup-intent", "shortDescription": {"text": "Unused endpoint: POST /billing/setup-intent"}, "fullDescription": {"text": "`engine/src/routes/billing.ts` declares `POST /billing/setup-intent` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-012feadf0245766b", "name": "Unused endpoint: POST /billing/save-card", "shortDescription": {"text": "Unused endpoint: POST /billing/save-card"}, "fullDescription": {"text": "`engine/src/routes/billing.ts` declares `POST /billing/save-card` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2b171ab6084f5670", "name": "Unused endpoint: POST /billing/webhook", "shortDescription": {"text": "Unused endpoint: POST /billing/webhook"}, "fullDescription": {"text": "`engine/src/routes/billing.ts` declares `POST /billing/webhook` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a517e9a8d0292145", "name": "Unused endpoint: POST /waitlist", "shortDescription": {"text": "Unused endpoint: POST /waitlist"}, "fullDescription": {"text": "`engine/src/routes/waitlist.ts` declares `POST /waitlist` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f1dae9b4a127db0b", "name": "Unused endpoint: GET /waitlist/count", "shortDescription": {"text": "Unused endpoint: GET /waitlist/count"}, "fullDescription": {"text": "`engine/src/routes/waitlist.ts` declares `GET /waitlist/count` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d65dc29ce738c625", "name": "Unused endpoint: POST /travelers", "shortDescription": {"text": "Unused endpoint: POST /travelers"}, "fullDescription": {"text": "`engine/src/routes/travelers.ts` declares `POST /travelers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5ab064e8ef2c1b2a", "name": "Unused endpoint: GET /travelers", "shortDescription": {"text": "Unused endpoint: GET /travelers"}, "fullDescription": {"text": "`engine/src/routes/travelers.ts` declares `GET /travelers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2116b8e72c774fd6", "name": "Unused endpoint: POST /profile", "shortDescription": {"text": "Unused endpoint: POST /profile"}, "fullDescription": {"text": "`engine/src/routes/profile.ts` declares `POST /profile` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5ce02cccbbfdf08b", "name": "Unused endpoint: POST /places", "shortDescription": {"text": "Unused endpoint: POST /places"}, "fullDescription": {"text": "`engine/src/routes/places.ts` declares `POST /places` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c2c6d4d54cbe22d7", "name": "Unused endpoint: GET /places", "shortDescription": {"text": "Unused endpoint: GET /places"}, "fullDescription": {"text": "`engine/src/routes/places.ts` declares `GET /places` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-17a164638609b114", "name": "Unused endpoint: POST /search", "shortDescription": {"text": "Unused endpoint: POST /search"}, "fullDescription": {"text": "`engine/src/routes/search.ts` declares `POST /search` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dad3ebdb1e49793c", "name": "Unused endpoint: POST /disruptions", "shortDescription": {"text": "Unused endpoint: POST /disruptions"}, "fullDescription": {"text": "`engine/src/routes/disruptions.ts` declares `POST /disruptions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ff5506d508a76790", "name": "Unused endpoint: POST /connections", "shortDescription": {"text": "Unused endpoint: POST /connections"}, "fullDescription": {"text": "`engine/src/routes/connections.ts` declares `POST /connections` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b5cf2c9cf572523e", "name": "Unused endpoint: POST /prefs", "shortDescription": {"text": "Unused endpoint: POST /prefs"}, "fullDescription": {"text": "`engine/src/routes/prefs.ts` declares `POST /prefs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-21d4e3431aa9b5dc", "name": "Unused endpoint: POST /parse", "shortDescription": {"text": "Unused endpoint: POST /parse"}, "fullDescription": {"text": "`engine/src/routes/parse.ts` declares `POST /parse` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c35bdeabdbc78d85", "name": "Unused endpoint: POST /plan", "shortDescription": {"text": "Unused endpoint: POST /plan"}, "fullDescription": {"text": "`engine/src/routes/plan.ts` declares `POST /plan` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e3691adfa4e07c2c", "name": "Unused endpoint: GET /wallet/catalog", "shortDescription": {"text": "Unused endpoint: GET /wallet/catalog"}, "fullDescription": {"text": "`engine/src/routes/wallet.ts` declares `GET /wallet/catalog` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2533398051665bdf", "name": "Unused endpoint: POST /book", "shortDescription": {"text": "Unused endpoint: POST /book"}, "fullDescription": {"text": "`engine/src/routes/book.ts` declares `POST /book` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d4c6c482b47953b6", "name": "Unused endpoint: POST /converse", "shortDescription": {"text": "Unused endpoint: POST /converse"}, "fullDescription": {"text": "`engine/src/routes/converse.ts` declares `POST /converse` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e9c13463a99ec9f4", "name": "Unused endpoint: POST /voice/transcribe", "shortDescription": {"text": "Unused endpoint: POST /voice/transcribe"}, "fullDescription": {"text": "`engine/src/routes/voice.ts` declares `POST /voice/transcribe` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a97e59929e984b7", "name": "Unused endpoint: POST /voice/speak", "shortDescription": {"text": "Unused endpoint: POST /voice/speak"}, "fullDescription": {"text": "`engine/src/routes/voice.ts` declares `POST /voice/speak` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3458c4f1434c44a9", "name": "Unused endpoint: POST /air/offer_requests?return_offers=true&supplier_timeout=10000", "shortDescription": {"text": "Unused endpoint: POST /air/offer_requests?return_offers=true&supplier_timeout=10000"}, "fullDescription": {"text": "`engine/src/suppliers/duffel.ts` declares `POST /air/offer_requests?return_offers=true&supplier_timeout=10000` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/21421"}, "properties": {"repository": "toddfishman/tures-demo", "repoUrl": "https://github.com/toddfishman/tures-demo", "branch": "main"}, "results": [{"ruleId": "scanner-a2f7dc53a855ce39", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 engine/test/smoke.ts:12"}, "properties": {"repobilityId": "2b8567ab95c1585a", "scanner": "scanner-primary", "fingerprint": "a2f7dc53a855ce39", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f6841cfd0527d129", "level": "warning", "message": {"text": "Dockerfile runs as root: engine/Dockerfile"}, "properties": {"repobilityId": "26c5044db456d90b", "scanner": "scanner-primary", "fingerprint": "f6841cfd0527d129", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-2826113905a05955", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-alpine"}, "properties": {"repobilityId": "2681bfe5f735c110", "scanner": "scanner-primary", "fingerprint": "2826113905a05955", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "engine/Dockerfile"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-7e6696ce25c3721b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v6/signup.html:109"}, "properties": {"repobilityId": "f5cc758637323fb9", "scanner": "scanner-primary", "fingerprint": "7e6696ce25c3721b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v6/signup.html"}, "region": {"startLine": 109}}}]}, {"ruleId": "scanner-f5532ddede8e0fcf", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v6/05-execution.html:240"}, "properties": {"repobilityId": "402921c7df37b26f", "scanner": "scanner-primary", "fingerprint": "f5532ddede8e0fcf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v6/05-execution.html"}, "region": {"startLine": 240}}}]}, {"ruleId": "scanner-4e741e35b1bcc4db", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v6/been.html:85"}, "properties": {"repobilityId": "7fcb50d80b25303b", "scanner": "scanner-primary", "fingerprint": "4e741e35b1bcc4db", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v6/been.html"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-292ce9cac235949c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v6/06-hiccup-handler.html:257"}, "properties": {"repobilityId": "f41aeb4d0123ae34", "scanner": "scanner-primary", "fingerprint": "292ce9cac235949c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v6/06-hiccup-handler.html"}, "region": {"startLine": 257}}}]}, {"ruleId": "scanner-564000b061dfbacd", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v6/08-concierge.html:148"}, "properties": {"repobilityId": "a811bd216845c49b", "scanner": "scanner-primary", "fingerprint": "564000b061dfbacd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v6/08-concierge.html"}, "region": {"startLine": 148}}}]}, {"ruleId": "scanner-72a5546ba6cf99d6", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v6/checkout.html:108"}, "properties": {"repobilityId": "34077c5a826b6840", "scanner": "scanner-primary", "fingerprint": "72a5546ba6cf99d6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v6/checkout.html"}, "region": {"startLine": 108}}}]}, {"ruleId": "scanner-7195d965a42ea373", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v6/04-connections.html:254"}, "properties": {"repobilityId": "a3051899abd8b8fb", "scanner": "scanner-primary", "fingerprint": "7195d965a42ea373", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v6/04-connections.html"}, "region": {"startLine": 254}}}]}, {"ruleId": "scanner-11ba4ab1597d810c", "level": "warning", "message": {"text": "Insecure pattern 'direct_outerhtml_assignment' in v6/admin.html:301"}, "properties": {"repobilityId": "b2f636d661fd1aa4", "scanner": "scanner-primary", "fingerprint": "11ba4ab1597d810c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_outerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v6/admin.html"}, "region": {"startLine": 301}}}]}, {"ruleId": "scanner-3163d1675d45e4b8", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in v6/07-itinerary.html:156"}, "properties": {"repobilityId": "0fdd81b46edcc14e", "scanner": "scanner-primary", "fingerprint": "3163d1675d45e4b8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v6/07-itinerary.html"}, "region": {"startLine": 156}}}]}, {"ruleId": "scanner-b9fb5a36b956c0b9", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v6/welcome.html:208"}, "properties": {"repobilityId": "00ed10f043a07f08", "scanner": "scanner-primary", "fingerprint": "b9fb5a36b956c0b9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v6/welcome.html"}, "region": {"startLine": 208}}}]}, {"ruleId": "scanner-8a2f2910d7c0abd9", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v6/account.html:141"}, "properties": {"repobilityId": "9a25e8481fb9598e", "scanner": "scanner-primary", "fingerprint": "8a2f2910d7c0abd9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v6/account.html"}, "region": {"startLine": 141}}}]}, {"ruleId": "scanner-39c219447a62f79a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v6/03-paste-trip.html:233"}, "properties": {"repobilityId": "247174358a979e39", "scanner": "scanner-primary", "fingerprint": "39c219447a62f79a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v6/03-paste-trip.html"}, "region": {"startLine": 233}}}]}, {"ruleId": "scanner-3fc41dac74fc4f9e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v6/02-taste-engine.html:239"}, "properties": {"repobilityId": "6ef2c9e56359b2df", "scanner": "scanner-primary", "fingerprint": "3fc41dac74fc4f9e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v6/02-taste-engine.html"}, "region": {"startLine": 239}}}]}, {"ruleId": "scanner-c546ad79683eaba1", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in v6/02-taste-engine.html:205"}, "properties": {"repobilityId": "9c69a0092d3b2fc6", "scanner": "scanner-primary", "fingerprint": "c546ad79683eaba1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v6/02-taste-engine.html"}, "region": {"startLine": 205}}}]}, {"ruleId": "scanner-e178b58b4804d9aa", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v6/auth/signup.html:158"}, "properties": {"repobilityId": "58a3a09ef608f954", "scanner": "scanner-primary", "fingerprint": "e178b58b4804d9aa", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v6/auth/signup.html"}, "region": {"startLine": 158}}}]}, {"ruleId": "scanner-d7d5fdca339ae5a5", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v6/auth/login.html:145"}, "properties": {"repobilityId": "96a86a8548bea674", "scanner": "scanner-primary", "fingerprint": "d7d5fdca339ae5a5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v6/auth/login.html"}, "region": {"startLine": 145}}}]}, {"ruleId": "scanner-692ff24571c0f938", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v6/assets/menu.js:65"}, "properties": {"repobilityId": "4dd27d079b017edd", "scanner": "scanner-primary", "fingerprint": "692ff24571c0f938", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v6/assets/menu.js"}, "region": {"startLine": 65}}}]}, {"ruleId": "scanner-1739c487e0ef11df", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/signup.html:125"}, "properties": {"repobilityId": "af0ee07666a3c0df", "scanner": "scanner-primary", "fingerprint": "1739c487e0ef11df", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v8/signup.html"}, "region": {"startLine": 125}}}]}, {"ruleId": "scanner-103adbf089e7077b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/05-execution.html:256"}, "properties": {"repobilityId": "495e3475890bb812", "scanner": "scanner-primary", "fingerprint": "103adbf089e7077b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v8/05-execution.html"}, "region": {"startLine": 256}}}]}, {"ruleId": "scanner-183cfad5ef021268", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/been.html:101"}, "properties": {"repobilityId": "ae9485858c7c989f", "scanner": "scanner-primary", "fingerprint": "183cfad5ef021268", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v8/been.html"}, "region": {"startLine": 101}}}]}, {"ruleId": "scanner-a7d395a979676e70", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/06-hiccup-handler.html:273"}, "properties": {"repobilityId": "f691b6686f8148aa", "scanner": "scanner-primary", "fingerprint": "a7d395a979676e70", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v8/06-hiccup-handler.html"}, "region": {"startLine": 273}}}]}, {"ruleId": "scanner-e04d6650cfd1cfc4", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/08-concierge.html:164"}, "properties": {"repobilityId": "102daaac11d4b5df", "scanner": "scanner-primary", "fingerprint": "e04d6650cfd1cfc4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v8/08-concierge.html"}, "region": {"startLine": 164}}}]}, {"ruleId": "scanner-479a0eafa2f34a4d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/checkout.html:166"}, "properties": {"repobilityId": "f276786fdafe7ed0", "scanner": "scanner-primary", "fingerprint": "479a0eafa2f34a4d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v8/checkout.html"}, "region": {"startLine": 166}}}]}, {"ruleId": "scanner-515ce52beea8fa50", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/04-connections.html:270"}, "properties": {"repobilityId": "2d45e9416836b0f3", "scanner": "scanner-primary", "fingerprint": "515ce52beea8fa50", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v8/04-connections.html"}, "region": {"startLine": 270}}}]}, {"ruleId": "scanner-5e7b9161f87f8b4c", "level": "warning", "message": {"text": "Insecure pattern 'direct_outerhtml_assignment' in v8/admin.html:316"}, "properties": {"repobilityId": "fb0e43c579840833", "scanner": "scanner-primary", "fingerprint": "5e7b9161f87f8b4c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_outerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v8/admin.html"}, "region": {"startLine": 316}}}]}, {"ruleId": "scanner-77876feb34b7f743", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in v8/07-itinerary.html:182"}, "properties": {"repobilityId": "8bfab9630e0a7e90", "scanner": "scanner-primary", "fingerprint": "77876feb34b7f743", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v8/07-itinerary.html"}, "region": {"startLine": 182}}}]}, {"ruleId": "scanner-f6aa4d0767def8da", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/welcome.html:238"}, "properties": {"repobilityId": "c1a656c000a0ad24", "scanner": "scanner-primary", "fingerprint": "f6aa4d0767def8da", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v8/welcome.html"}, "region": {"startLine": 238}}}]}, {"ruleId": "scanner-0e316658845a4a50", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/palette.html:134"}, "properties": {"repobilityId": "dcd4b5d45cef664a", "scanner": "scanner-primary", "fingerprint": "0e316658845a4a50", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v8/palette.html"}, "region": {"startLine": 134}}}]}, {"ruleId": "scanner-1e94863cd91660b5", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/write.html:234"}, "properties": {"repobilityId": "d24082428db3ede4", "scanner": "scanner-primary", "fingerprint": "1e94863cd91660b5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v8/write.html"}, "region": {"startLine": 234}}}]}, {"ruleId": "scanner-61f0293e8faf77d0", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/account.html:156"}, "properties": {"repobilityId": "b4ec6335ff0077ae", "scanner": "scanner-primary", "fingerprint": "61f0293e8faf77d0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v8/account.html"}, "region": {"startLine": 156}}}]}, {"ruleId": "scanner-e44121bb73137636", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/03-paste-trip.html:301"}, "properties": {"repobilityId": "72682d007d1f7c38", "scanner": "scanner-primary", "fingerprint": "e44121bb73137636", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v8/03-paste-trip.html"}, "region": {"startLine": 301}}}]}, {"ruleId": "scanner-c65ff8b05a7a6420", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/02-taste-engine.html:264"}, "properties": {"repobilityId": "0b1e654101d42f03", "scanner": "scanner-primary", "fingerprint": "c65ff8b05a7a6420", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v8/02-taste-engine.html"}, "region": {"startLine": 264}}}]}, {"ruleId": "scanner-aa4836ac59e63b56", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in v8/02-taste-engine.html:230"}, "properties": {"repobilityId": "e6af60fbe144ac32", "scanner": "scanner-primary", "fingerprint": "aa4836ac59e63b56", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v8/02-taste-engine.html"}, "region": {"startLine": 230}}}]}, {"ruleId": "scanner-0ede806e6aa1ffb5", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/auth/signup.html:173"}, "properties": {"repobilityId": "379b5aa8485ed300", "scanner": "scanner-primary", "fingerprint": "0ede806e6aa1ffb5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v8/auth/signup.html"}, "region": {"startLine": 173}}}]}, {"ruleId": "scanner-60e431767e87fa9a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/auth/login.html:160"}, "properties": {"repobilityId": "f97b72cf51d0d4ca", "scanner": "scanner-primary", "fingerprint": "60e431767e87fa9a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v8/auth/login.html"}, "region": {"startLine": 160}}}]}, {"ruleId": "scanner-28088565f9ed542d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/assets/menu.js:54"}, "properties": {"repobilityId": "fdcee761283dec7e", "scanner": "scanner-primary", "fingerprint": "28088565f9ed542d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v8/assets/menu.js"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-c420727704a314d4", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v8/assets/voice.js:62"}, "properties": {"repobilityId": "05723fe7dc2fc42c", "scanner": "scanner-primary", "fingerprint": "c420727704a314d4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v8/assets/voice.js"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-a202304ff40944ff", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/signup.html:109"}, "properties": {"repobilityId": "c64dd6b12537fdf9", "scanner": "scanner-primary", "fingerprint": "a202304ff40944ff", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v7/signup.html"}, "region": {"startLine": 109}}}]}, {"ruleId": "scanner-757636a3872fd981", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/05-execution.html:240"}, "properties": {"repobilityId": "a68a516adb0a3038", "scanner": "scanner-primary", "fingerprint": "757636a3872fd981", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v7/05-execution.html"}, "region": {"startLine": 240}}}]}, {"ruleId": "scanner-7869a6da6133bf74", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/been.html:85"}, "properties": {"repobilityId": "a29251e0df7243b2", "scanner": "scanner-primary", "fingerprint": "7869a6da6133bf74", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v7/been.html"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-0e0d03208e859edc", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/06-hiccup-handler.html:257"}, "properties": {"repobilityId": "20de4019d05a0086", "scanner": "scanner-primary", "fingerprint": "0e0d03208e859edc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v7/06-hiccup-handler.html"}, "region": {"startLine": 257}}}]}, {"ruleId": "scanner-ebc089208c8aee70", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/08-concierge.html:148"}, "properties": {"repobilityId": "bb789a0b74903db9", "scanner": "scanner-primary", "fingerprint": "ebc089208c8aee70", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v7/08-concierge.html"}, "region": {"startLine": 148}}}]}, {"ruleId": "scanner-0b3305da9fbfd378", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/checkout.html:108"}, "properties": {"repobilityId": "205ebc4de852aedb", "scanner": "scanner-primary", "fingerprint": "0b3305da9fbfd378", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v7/checkout.html"}, "region": {"startLine": 108}}}]}, {"ruleId": "scanner-74aaccb7cbd324e9", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/04-connections.html:254"}, "properties": {"repobilityId": "480c0797ecb026cf", "scanner": "scanner-primary", "fingerprint": "74aaccb7cbd324e9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v7/04-connections.html"}, "region": {"startLine": 254}}}]}, {"ruleId": "scanner-2257a5ca1dfc5b6b", "level": "warning", "message": {"text": "Insecure pattern 'direct_outerhtml_assignment' in v7/admin.html:301"}, "properties": {"repobilityId": "58e2c786b5d35cb1", "scanner": "scanner-primary", "fingerprint": "2257a5ca1dfc5b6b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_outerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v7/admin.html"}, "region": {"startLine": 301}}}]}, {"ruleId": "scanner-7fde03580d55ef71", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in v7/07-itinerary.html:156"}, "properties": {"repobilityId": "2fa911bd7c1afc4d", "scanner": "scanner-primary", "fingerprint": "7fde03580d55ef71", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v7/07-itinerary.html"}, "region": {"startLine": 156}}}]}, {"ruleId": "scanner-ab95a4d05fca0811", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/welcome.html:222"}, "properties": {"repobilityId": "db1040bbfbedeae5", "scanner": "scanner-primary", "fingerprint": "ab95a4d05fca0811", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v7/welcome.html"}, "region": {"startLine": 222}}}]}, {"ruleId": "scanner-90e0974d59313ca1", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/account.html:141"}, "properties": {"repobilityId": "5364356873475c13", "scanner": "scanner-primary", "fingerprint": "90e0974d59313ca1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v7/account.html"}, "region": {"startLine": 141}}}]}, {"ruleId": "scanner-3ac82736ee0652d6", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/03-paste-trip.html:267"}, "properties": {"repobilityId": "ba828895d3453879", "scanner": "scanner-primary", "fingerprint": "3ac82736ee0652d6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v7/03-paste-trip.html"}, "region": {"startLine": 267}}}]}, {"ruleId": "scanner-eb22cea5fe99a47b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/02-taste-engine.html:239"}, "properties": {"repobilityId": "7f7be3531e4ce798", "scanner": "scanner-primary", "fingerprint": "eb22cea5fe99a47b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v7/02-taste-engine.html"}, "region": {"startLine": 239}}}]}, {"ruleId": "scanner-96ec1246fa2ab801", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in v7/02-taste-engine.html:205"}, "properties": {"repobilityId": "58de1f4559dce040", "scanner": "scanner-primary", "fingerprint": "96ec1246fa2ab801", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v7/02-taste-engine.html"}, "region": {"startLine": 205}}}]}, {"ruleId": "scanner-fa59b16353f5dbad", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/auth/signup.html:158"}, "properties": {"repobilityId": "120cd51abb329425", "scanner": "scanner-primary", "fingerprint": "fa59b16353f5dbad", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v7/auth/signup.html"}, "region": {"startLine": 158}}}]}, {"ruleId": "scanner-c2123a9c0198d929", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/auth/login.html:145"}, "properties": {"repobilityId": "9d73a9861470834a", "scanner": "scanner-primary", "fingerprint": "c2123a9c0198d929", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v7/auth/login.html"}, "region": {"startLine": 145}}}]}, {"ruleId": "scanner-edd6f78ba3985a84", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/assets/menu.js:25"}, "properties": {"repobilityId": "91cfc7a9fb4eb315", "scanner": "scanner-primary", "fingerprint": "edd6f78ba3985a84", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v7/assets/menu.js"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-c6f331be53364cdd", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v7/assets/voice.js:62"}, "properties": {"repobilityId": "2e3f7d37f3ee6ff8", "scanner": "scanner-primary", "fingerprint": "c6f331be53364cdd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v7/assets/voice.js"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-8bd7f1d7d2d29325", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v5/signup.html:109"}, "properties": {"repobilityId": "19b95b4ef00d9f33", "scanner": "scanner-primary", "fingerprint": "8bd7f1d7d2d29325", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v5/signup.html"}, "region": {"startLine": 109}}}]}, {"ruleId": "scanner-0323f34872a8d9dc", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v5/05-execution.html:240"}, "properties": {"repobilityId": "f81a319db19968d1", "scanner": "scanner-primary", "fingerprint": "0323f34872a8d9dc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v5/05-execution.html"}, "region": {"startLine": 240}}}]}, {"ruleId": "scanner-2c608a754c64d3de", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v5/been.html:85"}, "properties": {"repobilityId": "10dc915d9baeb863", "scanner": "scanner-primary", "fingerprint": "2c608a754c64d3de", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v5/been.html"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-f746a723d958284e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v5/06-hiccup-handler.html:257"}, "properties": {"repobilityId": "46211bd061116e0b", "scanner": "scanner-primary", "fingerprint": "f746a723d958284e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v5/06-hiccup-handler.html"}, "region": {"startLine": 257}}}]}, {"ruleId": "scanner-681cd4c3f71ed7d6", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v5/08-concierge.html:148"}, "properties": {"repobilityId": "4a38cd25205d7083", "scanner": "scanner-primary", "fingerprint": "681cd4c3f71ed7d6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v5/08-concierge.html"}, "region": {"startLine": 148}}}]}, {"ruleId": "scanner-505f977fad6c5eb8", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v5/checkout.html:108"}, "properties": {"repobilityId": "2b22460a054c38d1", "scanner": "scanner-primary", "fingerprint": "505f977fad6c5eb8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v5/checkout.html"}, "region": {"startLine": 108}}}]}, {"ruleId": "scanner-222e6bd537d11554", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v5/04-connections.html:254"}, "properties": {"repobilityId": "ff28e3428e938664", "scanner": "scanner-primary", "fingerprint": "222e6bd537d11554", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v5/04-connections.html"}, "region": {"startLine": 254}}}]}, {"ruleId": "scanner-6f3e1d9a437100b4", "level": "warning", "message": {"text": "Insecure pattern 'direct_outerhtml_assignment' in v5/admin.html:301"}, "properties": {"repobilityId": "51bc609c3be970d8", "scanner": "scanner-primary", "fingerprint": "6f3e1d9a437100b4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_outerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v5/admin.html"}, "region": {"startLine": 301}}}]}, {"ruleId": "scanner-e0b628f20c0faa76", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in v5/07-itinerary.html:156"}, "properties": {"repobilityId": "24a87d99f86c49a8", "scanner": "scanner-primary", "fingerprint": "e0b628f20c0faa76", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v5/07-itinerary.html"}, "region": {"startLine": 156}}}]}, {"ruleId": "scanner-9c5475b5b0f2b0cb", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v5/welcome.html:198"}, "properties": {"repobilityId": "36768a0e90f09974", "scanner": "scanner-primary", "fingerprint": "9c5475b5b0f2b0cb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v5/welcome.html"}, "region": {"startLine": 198}}}]}, {"ruleId": "scanner-c08c1279b57650b5", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v5/account.html:141"}, "properties": {"repobilityId": "ed68e64d9710bee1", "scanner": "scanner-primary", "fingerprint": "c08c1279b57650b5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v5/account.html"}, "region": {"startLine": 141}}}]}, {"ruleId": "scanner-3dcc06e7dd3b9131", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v5/03-paste-trip.html:233"}, "properties": {"repobilityId": "123524e1c7ad8a77", "scanner": "scanner-primary", "fingerprint": "3dcc06e7dd3b9131", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v5/03-paste-trip.html"}, "region": {"startLine": 233}}}]}, {"ruleId": "scanner-df485ed2d3b18834", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v5/02-taste-engine.html:239"}, "properties": {"repobilityId": "d9b586a89f6be34f", "scanner": "scanner-primary", "fingerprint": "df485ed2d3b18834", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v5/02-taste-engine.html"}, "region": {"startLine": 239}}}]}, {"ruleId": "scanner-f106941cb40069ab", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in v5/02-taste-engine.html:205"}, "properties": {"repobilityId": "9abf3873f4a37005", "scanner": "scanner-primary", "fingerprint": "f106941cb40069ab", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v5/02-taste-engine.html"}, "region": {"startLine": 205}}}]}, {"ruleId": "scanner-4baaa65a0696e8e6", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v5/auth/signup.html:158"}, "properties": {"repobilityId": "caae8cba071cf3ce", "scanner": "scanner-primary", "fingerprint": "4baaa65a0696e8e6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v5/auth/signup.html"}, "region": {"startLine": 158}}}]}, {"ruleId": "scanner-af3685ee1148facf", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v5/auth/login.html:145"}, "properties": {"repobilityId": "f8c5eba73e4a9217", "scanner": "scanner-primary", "fingerprint": "af3685ee1148facf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v5/auth/login.html"}, "region": {"startLine": 145}}}]}, {"ruleId": "scanner-fc22c0d82f4238d0", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v5/assets/menu.js:65"}, "properties": {"repobilityId": "ef27c169d7b51c7f", "scanner": "scanner-primary", "fingerprint": "fc22c0d82f4238d0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v5/assets/menu.js"}, "region": {"startLine": 65}}}]}, {"ruleId": "scanner-0677e6a34b71b250", "level": "error", "message": {"text": "Possible secret in engine/test/smoke.ts"}, "properties": {"repobilityId": "01b93920a672dc68", "scanner": "scanner-primary", "fingerprint": "0677e6a34b71b250", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "engine/test/smoke.ts"}, "region": {"startLine": 273}}}]}, {"ruleId": "scanner-0677e6a34b71b250", "level": "error", "message": {"text": "Possible secret in engine/test/smoke.ts"}, "properties": {"repobilityId": "01b93920a672dc68", "scanner": "scanner-primary", "fingerprint": "0677e6a34b71b250", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "engine/test/smoke.ts"}, "region": {"startLine": 311}}}]}, {"ruleId": "scanner-0677e6a34b71b250", "level": "error", "message": {"text": "Possible secret in engine/test/smoke.ts"}, "properties": {"repobilityId": "01b93920a672dc68", "scanner": "scanner-primary", "fingerprint": "0677e6a34b71b250", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "engine/test/smoke.ts"}, "region": {"startLine": 312}}}]}, {"ruleId": "scanner-0677e6a34b71b250", "level": "error", "message": {"text": "Possible secret in engine/test/smoke.ts"}, "properties": {"repobilityId": "01b93920a672dc68", "scanner": "scanner-primary", "fingerprint": "0677e6a34b71b250", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "engine/test/smoke.ts"}, "region": {"startLine": 318}}}]}, {"ruleId": "scanner-ce13386fde233595", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v4/06-hiccup-handler.html:234"}, "properties": {"repobilityId": "79bca62b44ae066b", "scanner": "scanner-primary", "fingerprint": "ce13386fde233595", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v4/06-hiccup-handler.html"}, "region": {"startLine": 234}}}]}, {"ruleId": "scanner-2e933b8a1835d1c2", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v4/08-concierge.html:126"}, "properties": {"repobilityId": "3caa76780369e752", "scanner": "scanner-primary", "fingerprint": "2e933b8a1835d1c2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v4/08-concierge.html"}, "region": {"startLine": 126}}}]}, {"ruleId": "scanner-fdf11d750244fc0e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in v4/02-taste-engine.html:210"}, "properties": {"repobilityId": "65f82a9182f742e6", "scanner": "scanner-primary", "fingerprint": "fdf11d750244fc0e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v4/02-taste-engine.html"}, "region": {"startLine": 210}}}]}, {"ruleId": "scanner-2e76c74405edb727", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in v4/02-taste-engine.html:194"}, "properties": {"repobilityId": "b889b6845fcaf05a", "scanner": "scanner-primary", "fingerprint": "2e76c74405edb727", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "v4/02-taste-engine.html"}, "region": {"startLine": 194}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "1808ebc10596697e", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "3bc9285c7c08f932", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "cb87b934f4d51dda", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "bad7e153cc6f80fa", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "e5ad33ae091de393", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "dc8f37b430b76abb", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "bbcd75c10a45422f", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-c4a8765c85872b70", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 v6/assets/engine.js:34"}, "properties": {"repobilityId": "374a5a87c3f296af", "scanner": "scanner-primary", "fingerprint": "c4a8765c85872b70", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-995fd9963cf1ce9c", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 v8/assets/engine.js:34"}, "properties": {"repobilityId": "f954883629741237", "scanner": "scanner-primary", "fingerprint": "995fd9963cf1ce9c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-98b354234f88b9d8", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 v7/assets/engine.js:34"}, "properties": {"repobilityId": "f92c6caee9e5e2d8", "scanner": "scanner-primary", "fingerprint": "98b354234f88b9d8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-87f4d6b7eb7d566c", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 v5/assets/engine.js:34"}, "properties": {"repobilityId": "df8ae0d4153fcd59", "scanner": "scanner-primary", "fingerprint": "87f4d6b7eb7d566c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e0e146767f8f0a2b", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 engine/src/vault/secretstore.ts:44"}, "properties": {"repobilityId": "4048c91ed08dceaf", "scanner": "scanner-primary", "fingerprint": "e0e146767f8f0a2b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6b0748ac8a13ee14", "level": "none", "message": {"text": "Commented-code block (5 lines) in engine/src/agent/context.ts:1"}, "properties": {"repobilityId": "51a586623e2ab88e", "scanner": "scanner-primary", "fingerprint": "6b0748ac8a13ee14", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-31e62e9365fca816", "level": "none", "message": {"text": "Commented-code block (5 lines) in engine/src/agent/orchestrator.ts:3"}, "properties": {"repobilityId": "ad33327a00350062", "scanner": "scanner-primary", "fingerprint": "31e62e9365fca816", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-05991f50c5997af5", "level": "none", "message": {"text": "Commented-code block (5 lines) in engine/src/wallet/cards.ts:3"}, "properties": {"repobilityId": "0cd932440f7fa5ed", "scanner": "scanner-primary", "fingerprint": "05991f50c5997af5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-319e66a630e14977", "level": "none", "message": {"text": "2 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "d838d1fc5d8231c9", "scanner": "scanner-primary", "fingerprint": "319e66a630e14977", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-b322fd49d9a578c1", "level": "error", "message": {"text": "Dangling fetch: POST https://api.deepgram.com/v1/listen?smart_format=true&model=nova-2&punctuate=true (engine/src/routes/voice.ts:23)"}, "properties": {"repobilityId": "f50f372140a26f80", "scanner": "scanner-primary", "fingerprint": "b322fd49d9a578c1", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-7548cb474042deeb", "level": "error", "message": {"text": "Dangling fetch: POST https://api.deepgram.com/v1/speak?model=aura-asteria-en&encoding=mp3 (engine/src/routes/voice.ts:50)"}, "properties": {"repobilityId": "8ad19dd9ea4317b7", "scanner": "scanner-primary", "fingerprint": "7548cb474042deeb", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-4a12d5ed34c864c6", "level": "note", "message": {"text": "Unused endpoint: POST /auth/signup"}, "properties": {"repobilityId": "29c65dd5a2f19a89", "scanner": "scanner-primary", "fingerprint": "4a12d5ed34c864c6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8fdbacfe9430a6ed", "level": "note", "message": {"text": "Unused endpoint: POST /auth/login"}, "properties": {"repobilityId": "2701b849fb5aa7c6", "scanner": "scanner-primary", "fingerprint": "8fdbacfe9430a6ed", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ac42422b23e45104", "level": "note", "message": {"text": "Unused endpoint: GET /auth/me"}, "properties": {"repobilityId": "d2420aa4fd7893c2", "scanner": "scanner-primary", "fingerprint": "ac42422b23e45104", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-747d120f647f5364", "level": "note", "message": {"text": "Unused endpoint: POST /billing/checkout"}, "properties": {"repobilityId": "559e9f4be8857a1a", "scanner": "scanner-primary", "fingerprint": "747d120f647f5364", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8dc4583dbbf5b2f3", "level": "note", "message": {"text": "Unused endpoint: POST /billing/setup-intent"}, "properties": {"repobilityId": "a24b3276ab30a5ab", "scanner": "scanner-primary", "fingerprint": "8dc4583dbbf5b2f3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-012feadf0245766b", "level": "note", "message": {"text": "Unused endpoint: POST /billing/save-card"}, "properties": {"repobilityId": "60f24a4e8a9aaf2a", "scanner": "scanner-primary", "fingerprint": "012feadf0245766b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2b171ab6084f5670", "level": "note", "message": {"text": "Unused endpoint: POST /billing/webhook"}, "properties": {"repobilityId": "8f45f9bb2963ab4f", "scanner": "scanner-primary", "fingerprint": "2b171ab6084f5670", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a517e9a8d0292145", "level": "note", "message": {"text": "Unused endpoint: POST /waitlist"}, "properties": {"repobilityId": "e59481944020bb87", "scanner": "scanner-primary", "fingerprint": "a517e9a8d0292145", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f1dae9b4a127db0b", "level": "note", "message": {"text": "Unused endpoint: GET /waitlist/count"}, "properties": {"repobilityId": "8265d79eab3eed9d", "scanner": "scanner-primary", "fingerprint": "f1dae9b4a127db0b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d65dc29ce738c625", "level": "note", "message": {"text": "Unused endpoint: POST /travelers"}, "properties": {"repobilityId": "8f697f3d6763125c", "scanner": "scanner-primary", "fingerprint": "d65dc29ce738c625", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5ab064e8ef2c1b2a", "level": "note", "message": {"text": "Unused endpoint: GET /travelers"}, "properties": {"repobilityId": "9fffda6bd7002ef6", "scanner": "scanner-primary", "fingerprint": "5ab064e8ef2c1b2a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2116b8e72c774fd6", "level": "note", "message": {"text": "Unused endpoint: POST /profile"}, "properties": {"repobilityId": "6832d566f0057be7", "scanner": "scanner-primary", "fingerprint": "2116b8e72c774fd6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5ce02cccbbfdf08b", "level": "note", "message": {"text": "Unused endpoint: POST /places"}, "properties": {"repobilityId": "903f337baf8e016b", "scanner": "scanner-primary", "fingerprint": "5ce02cccbbfdf08b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c2c6d4d54cbe22d7", "level": "note", "message": {"text": "Unused endpoint: GET /places"}, "properties": {"repobilityId": "da2a57cf037711cd", "scanner": "scanner-primary", "fingerprint": "c2c6d4d54cbe22d7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-17a164638609b114", "level": "note", "message": {"text": "Unused endpoint: POST /search"}, "properties": {"repobilityId": "d4ae269a51ba8f2a", "scanner": "scanner-primary", "fingerprint": "17a164638609b114", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-dad3ebdb1e49793c", "level": "note", "message": {"text": "Unused endpoint: POST /disruptions"}, "properties": {"repobilityId": "a83378e154649b6f", "scanner": "scanner-primary", "fingerprint": "dad3ebdb1e49793c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ff5506d508a76790", "level": "note", "message": {"text": "Unused endpoint: POST /connections"}, "properties": {"repobilityId": "9b78031f68906faf", "scanner": "scanner-primary", "fingerprint": "ff5506d508a76790", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b5cf2c9cf572523e", "level": "note", "message": {"text": "Unused endpoint: POST /prefs"}, "properties": {"repobilityId": "6047dc9646592523", "scanner": "scanner-primary", "fingerprint": "b5cf2c9cf572523e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-21d4e3431aa9b5dc", "level": "note", "message": {"text": "Unused endpoint: POST /parse"}, "properties": {"repobilityId": "b7473f669ce5f61b", "scanner": "scanner-primary", "fingerprint": "21d4e3431aa9b5dc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c35bdeabdbc78d85", "level": "note", "message": {"text": "Unused endpoint: POST /plan"}, "properties": {"repobilityId": "5be770151185d422", "scanner": "scanner-primary", "fingerprint": "c35bdeabdbc78d85", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e3691adfa4e07c2c", "level": "note", "message": {"text": "Unused endpoint: GET /wallet/catalog"}, "properties": {"repobilityId": "5af30f01ff416b0b", "scanner": "scanner-primary", "fingerprint": "e3691adfa4e07c2c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2533398051665bdf", "level": "note", "message": {"text": "Unused endpoint: POST /book"}, "properties": {"repobilityId": "10f4fe64d9fd3f80", "scanner": "scanner-primary", "fingerprint": "2533398051665bdf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d4c6c482b47953b6", "level": "note", "message": {"text": "Unused endpoint: POST /converse"}, "properties": {"repobilityId": "cf9fe52521aba6b5", "scanner": "scanner-primary", "fingerprint": "d4c6c482b47953b6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e9c13463a99ec9f4", "level": "note", "message": {"text": "Unused endpoint: POST /voice/transcribe"}, "properties": {"repobilityId": "4af92e2441eee331", "scanner": "scanner-primary", "fingerprint": "e9c13463a99ec9f4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1a97e59929e984b7", "level": "note", "message": {"text": "Unused endpoint: POST /voice/speak"}, "properties": {"repobilityId": "aebdfc99dfad680f", "scanner": "scanner-primary", "fingerprint": "1a97e59929e984b7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3458c4f1434c44a9", "level": "note", "message": {"text": "Unused endpoint: POST /air/offer_requests?return_offers=true&supplier_timeout=10000"}, "properties": {"repobilityId": "50787083d7f457a6", "scanner": "scanner-primary", "fingerprint": "3458c4f1434c44a9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}