{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-4a210ac3b4b59ff4", "name": "Dockerfile runs as root: .devcontainer/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: .devcontainer/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c4f1fc6b8fc31104", "name": "Docker base image is tag-pinned but not digest-pinned: ghcr.io/rails/devcontainer/images/ruby:$RUBY_VERSION", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: ghcr.io/rails/devcontainer/images/ruby:$RUBY_VERSION"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0abff0d8991f67eb", "name": "Possible secret in AGENTS.md", "shortDescription": {"text": "Possible secret in AGENTS.md"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-54b9b9d66c3ce5b8", "name": "Possible secret in spec/models/standard_id/credential_spec.rb", "shortDescription": {"text": "Possible secret in spec/models/standard_id/credential_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-817f98584bfe6351", "name": "Possible secret in spec/models/standard_id/password_credential_spec.rb", "shortDescription": {"text": "Possible secret in spec/models/standard_id/password_credential_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-6f0ff99b3b512771", "name": "Possible secret in spec/requests/standard_id/web/lifecycle_hooks_spec.rb", "shortDescription": {"text": "Possible secret in spec/requests/standard_id/web/lifecycle_hooks_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-1f1bb89782571079", "name": "Possible secret in spec/requests/standard_id/web/reset_password_start_spec.rb", "shortDescription": {"text": "Possible secret in spec/requests/standard_id/web/reset_password_start_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-9faf30e1ea969835", "name": "Possible secret in spec/requests/standard_id/web/reset_password_confirm_spec.rb", "shortDescription": {"text": "Possible secret in spec/requests/standard_id/web/reset_password_confirm_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-9bee8df060f2aa26", "name": "Possible secret in spec/requests/standard_id/web/login_verify_spec.rb", "shortDescription": {"text": "Possible secret in spec/requests/standard_id/web/login_verify_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-9f4435f7e2f08cd5", "name": "Possible secret in spec/requests/standard_id/web/signup_spec.rb", "shortDescription": {"text": "Possible secret in spec/requests/standard_id/web/signup_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-761a95bd538308e6", "name": "Possible secret in spec/requests/standard_id/web/web_mechanism_gate_spec.rb", "shortDescription": {"text": "Possible secret in spec/requests/standard_id/web/web_mechanism_gate_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-b90779630a57a44c", "name": "Possible secret in spec/jobs/standard_id/password_reset_delivery_job_spec.rb", "shortDescription": {"text": "Possible secret in spec/jobs/standard_id/password_reset_delivery_job_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-3652b7dca27fc799", "name": "Possible secret in spec/forms/standard_id/web/signup_form_spec.rb", "shortDescription": {"text": "Possible secret in spec/forms/standard_id/web/signup_form_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-b6dc761c3f5a8506", "name": "Possible secret in spec/forms/standard_id/web/reset_password_start_form_spec.rb", "shortDescription": {"text": "Possible secret in spec/forms/standard_id/web/reset_password_start_form_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-ed5478c3981419b0", "name": "Possible secret in spec/forms/standard_id/web/reset_password_confirm_form_spec.rb", "shortDescription": {"text": "Possible secret in spec/forms/standard_id/web/reset_password_confirm_form_spec.rb"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-42c74bcac175d775", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "rarebit-one/.github/.github/workflows/claude-code-review.yml@main can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-77166cbd46fcd8e4", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7a6d07fb81ec16dd", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "rarebit-one/.github/.github/workflows/reusable-weekly-maintenance.yml@v2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ccbf348b210aff5c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27924aa79fa4a517", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-61479e872727971f", "name": "GitHub Action tracks a moving branch", "shortDescription": {"text": "GitHub Action tracks a moving branch"}, "fullDescription": {"text": "rarebit-one/.github/.github/workflows/claude-agent.yml@main can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "high", "confidence": 1.0}}, {"id": "scanner-37716d9c0a33ad5c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "rarebit-one/.github/.github/workflows/reusable-gem-release.yml@v2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 1 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bea357a6497a2d5d", "name": "Agent authority lacks a verifier contract: CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4e90f7375bf064b9", "name": "Commented-code block (7 lines) in spec/dummy/app/views/pwa/service-worker.js:8", "shortDescription": {"text": "Commented-code block (7 lines) in spec/dummy/app/views/pwa/service-worker.js:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/17841"}, "properties": {"repository": "rarebit-one/standard_id", "repoUrl": "https://github.com/rarebit-one/standard_id", "branch": "main"}, "results": [{"ruleId": "scanner-4a210ac3b4b59ff4", "level": "warning", "message": {"text": "Dockerfile runs as root: .devcontainer/Dockerfile"}, "properties": {"repobilityId": "7855b1f55d0800cf", "scanner": "scanner-primary", "fingerprint": "4a210ac3b4b59ff4", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-c4f1fc6b8fc31104", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: ghcr.io/rails/devcontainer/images/ruby:$RUBY_VERSION"}, "properties": {"repobilityId": "bff768c6479ad9a3", "scanner": "scanner-primary", "fingerprint": "c4f1fc6b8fc31104", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".devcontainer/Dockerfile"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-0abff0d8991f67eb", "level": "error", "message": {"text": "Possible secret in AGENTS.md"}, "properties": {"repobilityId": "7c4d40211b20c3c1", "scanner": "scanner-primary", "fingerprint": "0abff0d8991f67eb", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AGENTS.md"}, "region": {"startLine": 167}}}]}, {"ruleId": "scanner-54b9b9d66c3ce5b8", "level": "error", "message": {"text": "Possible secret in spec/models/standard_id/credential_spec.rb"}, "properties": {"repobilityId": "6a0d499eb486b24d", "scanner": "scanner-primary", "fingerprint": "54b9b9d66c3ce5b8", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/models/standard_id/credential_spec.rb"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-817f98584bfe6351", "level": "error", "message": {"text": "Possible secret in spec/models/standard_id/password_credential_spec.rb"}, "properties": {"repobilityId": "e6233bc332e9dd2a", "scanner": "scanner-primary", "fingerprint": "817f98584bfe6351", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/models/standard_id/password_credential_spec.rb"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-817f98584bfe6351", "level": "error", "message": {"text": "Possible secret in spec/models/standard_id/password_credential_spec.rb"}, "properties": {"repobilityId": "e6233bc332e9dd2a", "scanner": "scanner-primary", "fingerprint": "817f98584bfe6351", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/models/standard_id/password_credential_spec.rb"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-817f98584bfe6351", "level": "error", "message": {"text": "Possible secret in spec/models/standard_id/password_credential_spec.rb"}, "properties": {"repobilityId": "e6233bc332e9dd2a", "scanner": "scanner-primary", "fingerprint": "817f98584bfe6351", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/models/standard_id/password_credential_spec.rb"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-817f98584bfe6351", "level": "error", "message": {"text": "Possible secret in spec/models/standard_id/password_credential_spec.rb"}, "properties": {"repobilityId": "e6233bc332e9dd2a", "scanner": "scanner-primary", "fingerprint": "817f98584bfe6351", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/models/standard_id/password_credential_spec.rb"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-817f98584bfe6351", "level": "error", "message": {"text": "Possible secret in spec/models/standard_id/password_credential_spec.rb"}, "properties": {"repobilityId": "e6233bc332e9dd2a", "scanner": "scanner-primary", "fingerprint": "817f98584bfe6351", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/models/standard_id/password_credential_spec.rb"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-817f98584bfe6351", "level": "error", "message": {"text": "Possible secret in spec/models/standard_id/password_credential_spec.rb"}, "properties": {"repobilityId": "e6233bc332e9dd2a", "scanner": "scanner-primary", "fingerprint": "817f98584bfe6351", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/models/standard_id/password_credential_spec.rb"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-817f98584bfe6351", "level": "error", "message": {"text": "Possible secret in spec/models/standard_id/password_credential_spec.rb"}, "properties": {"repobilityId": "e6233bc332e9dd2a", "scanner": "scanner-primary", "fingerprint": "817f98584bfe6351", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/models/standard_id/password_credential_spec.rb"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-817f98584bfe6351", "level": "error", "message": {"text": "Possible secret in spec/models/standard_id/password_credential_spec.rb"}, "properties": {"repobilityId": "e6233bc332e9dd2a", "scanner": "scanner-primary", "fingerprint": "817f98584bfe6351", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/models/standard_id/password_credential_spec.rb"}, "region": {"startLine": 70}}}]}, {"ruleId": "scanner-817f98584bfe6351", "level": "error", "message": {"text": "Possible secret in spec/models/standard_id/password_credential_spec.rb"}, "properties": {"repobilityId": "e6233bc332e9dd2a", "scanner": "scanner-primary", "fingerprint": "817f98584bfe6351", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/models/standard_id/password_credential_spec.rb"}, "region": {"startLine": 89}}}]}, {"ruleId": "scanner-6f0ff99b3b512771", "level": "error", "message": {"text": "Possible secret in spec/requests/standard_id/web/lifecycle_hooks_spec.rb"}, "properties": {"repobilityId": "94839f5eb7a5029f", "scanner": "scanner-primary", "fingerprint": "6f0ff99b3b512771", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/requests/standard_id/web/lifecycle_hooks_spec.rb"}, "region": {"startLine": 201}}}]}, {"ruleId": "scanner-6f0ff99b3b512771", "level": "error", "message": {"text": "Possible secret in spec/requests/standard_id/web/lifecycle_hooks_spec.rb"}, "properties": {"repobilityId": "94839f5eb7a5029f", "scanner": "scanner-primary", "fingerprint": "6f0ff99b3b512771", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/requests/standard_id/web/lifecycle_hooks_spec.rb"}, "region": {"startLine": 212}}}]}, {"ruleId": "scanner-6f0ff99b3b512771", "level": "error", "message": {"text": "Possible secret in spec/requests/standard_id/web/lifecycle_hooks_spec.rb"}, "properties": {"repobilityId": "94839f5eb7a5029f", "scanner": "scanner-primary", "fingerprint": "6f0ff99b3b512771", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/requests/standard_id/web/lifecycle_hooks_spec.rb"}, "region": {"startLine": 226}}}]}, {"ruleId": "scanner-6f0ff99b3b512771", "level": "error", "message": {"text": "Possible secret in spec/requests/standard_id/web/lifecycle_hooks_spec.rb"}, "properties": {"repobilityId": "94839f5eb7a5029f", "scanner": "scanner-primary", "fingerprint": "6f0ff99b3b512771", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/requests/standard_id/web/lifecycle_hooks_spec.rb"}, "region": {"startLine": 429}}}]}, {"ruleId": "scanner-6f0ff99b3b512771", "level": "error", "message": {"text": "Possible secret in spec/requests/standard_id/web/lifecycle_hooks_spec.rb"}, "properties": {"repobilityId": "94839f5eb7a5029f", "scanner": "scanner-primary", "fingerprint": "6f0ff99b3b512771", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/requests/standard_id/web/lifecycle_hooks_spec.rb"}, "region": {"startLine": 440}}}]}, {"ruleId": "scanner-6f0ff99b3b512771", "level": "error", "message": {"text": "Possible secret in spec/requests/standard_id/web/lifecycle_hooks_spec.rb"}, "properties": {"repobilityId": "94839f5eb7a5029f", "scanner": "scanner-primary", "fingerprint": "6f0ff99b3b512771", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/requests/standard_id/web/lifecycle_hooks_spec.rb"}, "region": {"startLine": 453}}}]}, {"ruleId": "scanner-6f0ff99b3b512771", "level": "error", "message": {"text": "Possible secret in spec/requests/standard_id/web/lifecycle_hooks_spec.rb"}, "properties": {"repobilityId": "94839f5eb7a5029f", "scanner": "scanner-primary", "fingerprint": "6f0ff99b3b512771", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/requests/standard_id/web/lifecycle_hooks_spec.rb"}, "region": {"startLine": 466}}}]}, {"ruleId": "scanner-6f0ff99b3b512771", "level": "error", "message": {"text": "Possible secret in spec/requests/standard_id/web/lifecycle_hooks_spec.rb"}, "properties": {"repobilityId": "94839f5eb7a5029f", "scanner": "scanner-primary", "fingerprint": "6f0ff99b3b512771", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/requests/standard_id/web/lifecycle_hooks_spec.rb"}, "region": {"startLine": 475}}}]}, {"ruleId": "scanner-6f0ff99b3b512771", "level": "error", "message": {"text": "Possible secret in spec/requests/standard_id/web/lifecycle_hooks_spec.rb"}, "properties": {"repobilityId": "94839f5eb7a5029f", "scanner": "scanner-primary", "fingerprint": "6f0ff99b3b512771", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/requests/standard_id/web/lifecycle_hooks_spec.rb"}, "region": {"startLine": 486}}}]}, {"ruleId": "scanner-1f1bb89782571079", "level": "error", "message": {"text": "Possible secret in spec/requests/standard_id/web/reset_password_start_spec.rb"}, "properties": {"repobilityId": "0e0bedc620ed882f", "scanner": "scanner-primary", "fingerprint": "1f1bb89782571079", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/requests/standard_id/web/reset_password_start_spec.rb"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-9faf30e1ea969835", "level": "error", "message": {"text": "Possible secret in spec/requests/standard_id/web/reset_password_confirm_spec.rb"}, "properties": {"repobilityId": "148848cb41e0cf47", "scanner": "scanner-primary", "fingerprint": "9faf30e1ea969835", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/requests/standard_id/web/reset_password_confirm_spec.rb"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-9faf30e1ea969835", "level": "error", "message": {"text": "Possible secret in spec/requests/standard_id/web/reset_password_confirm_spec.rb"}, "properties": {"repobilityId": "148848cb41e0cf47", "scanner": "scanner-primary", "fingerprint": "9faf30e1ea969835", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/requests/standard_id/web/reset_password_confirm_spec.rb"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-9faf30e1ea969835", "level": "error", "message": {"text": "Possible secret in spec/requests/standard_id/web/reset_password_confirm_spec.rb"}, "properties": {"repobilityId": "148848cb41e0cf47", "scanner": "scanner-primary", "fingerprint": "9faf30e1ea969835", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/requests/standard_id/web/reset_password_confirm_spec.rb"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-9bee8df060f2aa26", "level": "error", "message": {"text": "Possible secret in spec/requests/standard_id/web/login_verify_spec.rb"}, "properties": {"repobilityId": "60d3a4327c49759b", "scanner": "scanner-primary", "fingerprint": "9bee8df060f2aa26", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/requests/standard_id/web/login_verify_spec.rb"}, "region": {"startLine": 98}}}]}, {"ruleId": "scanner-9bee8df060f2aa26", "level": "error", "message": {"text": "Possible secret in spec/requests/standard_id/web/login_verify_spec.rb"}, "properties": {"repobilityId": "60d3a4327c49759b", "scanner": "scanner-primary", "fingerprint": "9bee8df060f2aa26", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/requests/standard_id/web/login_verify_spec.rb"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-9f4435f7e2f08cd5", "level": "error", "message": {"text": "Possible secret in spec/requests/standard_id/web/signup_spec.rb"}, "properties": {"repobilityId": "035985e56094ee1a", "scanner": "scanner-primary", "fingerprint": "9f4435f7e2f08cd5", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/requests/standard_id/web/signup_spec.rb"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-761a95bd538308e6", "level": "error", "message": {"text": "Possible secret in spec/requests/standard_id/web/web_mechanism_gate_spec.rb"}, "properties": {"repobilityId": "7509b27433484b22", "scanner": "scanner-primary", "fingerprint": "761a95bd538308e6", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/requests/standard_id/web/web_mechanism_gate_spec.rb"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-761a95bd538308e6", "level": "error", "message": {"text": "Possible secret in spec/requests/standard_id/web/web_mechanism_gate_spec.rb"}, "properties": {"repobilityId": "7509b27433484b22", "scanner": "scanner-primary", "fingerprint": "761a95bd538308e6", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/requests/standard_id/web/web_mechanism_gate_spec.rb"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-b90779630a57a44c", "level": "error", "message": {"text": "Possible secret in spec/jobs/standard_id/password_reset_delivery_job_spec.rb"}, "properties": {"repobilityId": "af85dfb0591f65da", "scanner": "scanner-primary", "fingerprint": "b90779630a57a44c", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/jobs/standard_id/password_reset_delivery_job_spec.rb"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-3652b7dca27fc799", "level": "error", "message": {"text": "Possible secret in spec/forms/standard_id/web/signup_form_spec.rb"}, "properties": {"repobilityId": "c1ebe4a050945de9", "scanner": "scanner-primary", "fingerprint": "3652b7dca27fc799", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/forms/standard_id/web/signup_form_spec.rb"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-3652b7dca27fc799", "level": "error", "message": {"text": "Possible secret in spec/forms/standard_id/web/signup_form_spec.rb"}, "properties": {"repobilityId": "c1ebe4a050945de9", "scanner": "scanner-primary", "fingerprint": "3652b7dca27fc799", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/forms/standard_id/web/signup_form_spec.rb"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-3652b7dca27fc799", "level": "error", "message": {"text": "Possible secret in spec/forms/standard_id/web/signup_form_spec.rb"}, "properties": {"repobilityId": "c1ebe4a050945de9", "scanner": "scanner-primary", "fingerprint": "3652b7dca27fc799", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/forms/standard_id/web/signup_form_spec.rb"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-3652b7dca27fc799", "level": "error", "message": {"text": "Possible secret in spec/forms/standard_id/web/signup_form_spec.rb"}, "properties": {"repobilityId": "c1ebe4a050945de9", "scanner": "scanner-primary", "fingerprint": "3652b7dca27fc799", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/forms/standard_id/web/signup_form_spec.rb"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-3652b7dca27fc799", "level": "error", "message": {"text": "Possible secret in spec/forms/standard_id/web/signup_form_spec.rb"}, "properties": {"repobilityId": "c1ebe4a050945de9", "scanner": "scanner-primary", "fingerprint": "3652b7dca27fc799", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/forms/standard_id/web/signup_form_spec.rb"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-b6dc761c3f5a8506", "level": "error", "message": {"text": "Possible secret in spec/forms/standard_id/web/reset_password_start_form_spec.rb"}, "properties": {"repobilityId": "f4928177db1ecef5", "scanner": "scanner-primary", "fingerprint": "b6dc761c3f5a8506", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/forms/standard_id/web/reset_password_start_form_spec.rb"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-ed5478c3981419b0", "level": "error", "message": {"text": "Possible secret in spec/forms/standard_id/web/reset_password_confirm_form_spec.rb"}, "properties": {"repobilityId": "a25a20304ca6437e", "scanner": "scanner-primary", "fingerprint": "ed5478c3981419b0", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/forms/standard_id/web/reset_password_confirm_form_spec.rb"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-ed5478c3981419b0", "level": "error", "message": {"text": "Possible secret in spec/forms/standard_id/web/reset_password_confirm_form_spec.rb"}, "properties": {"repobilityId": "a25a20304ca6437e", "scanner": "scanner-primary", "fingerprint": "ed5478c3981419b0", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/forms/standard_id/web/reset_password_confirm_form_spec.rb"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-ed5478c3981419b0", "level": "error", "message": {"text": "Possible secret in spec/forms/standard_id/web/reset_password_confirm_form_spec.rb"}, "properties": {"repobilityId": "a25a20304ca6437e", "scanner": "scanner-primary", "fingerprint": "ed5478c3981419b0", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec/forms/standard_id/web/reset_password_confirm_form_spec.rb"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-42c74bcac175d775", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "aafa30a3a59ac362", "scanner": "scanner-primary", "fingerprint": "42c74bcac175d775", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude-code-review.yml"}, "region": {"startLine": 24}}}]}, {"ruleId": "scanner-77166cbd46fcd8e4", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "50f3b563ffac10e9", "scanner": "scanner-primary", "fingerprint": "77166cbd46fcd8e4", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude-code-review.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7a6d07fb81ec16dd", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "55b7819db1a0efac", "scanner": "scanner-primary", "fingerprint": "7a6d07fb81ec16dd", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/weekly-maintenance.yml"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-ccbf348b210aff5c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "27d03999f5d2b2b8", "scanner": "scanner-primary", "fingerprint": "ccbf348b210aff5c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/weekly-maintenance.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "97a9a5de61d82fcd", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "64978d6af70613bb", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "97a9a5de61d82fcd", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "64978d6af70613bb", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "90dca2b9a9fbfb28", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 78}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "97a9a5de61d82fcd", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 131}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "64978d6af70613bb", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 144}}}]}, {"ruleId": "scanner-27924aa79fa4a517", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "90dca2b9a9fbfb28", "scanner": "scanner-primary", "fingerprint": "27924aa79fa4a517", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/ci.yml"}, "region": {"startLine": 161}}}]}, {"ruleId": "scanner-61479e872727971f", "level": "error", "message": {"text": "GitHub Action tracks a moving branch"}, "properties": {"repobilityId": "3cabc1ad548d5aaf", "scanner": "scanner-primary", "fingerprint": "61479e872727971f", "layer": "cicd", "severity": "high", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-37716d9c0a33ad5c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "abfb5752158cf655", "scanner": "scanner-primary", "fingerprint": "37716d9c0a33ad5c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/claude.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "120ccc750ace359a", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "09b306b5fbfea550", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "cc94b9ac993256aa", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "1713ac84c8cfd824", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-bea357a6497a2d5d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "properties": {"repobilityId": "aae72df3934829ac", "scanner": "scanner-primary", "fingerprint": "bea357a6497a2d5d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-4e90f7375bf064b9", "level": "none", "message": {"text": "Commented-code block (7 lines) in spec/dummy/app/views/pwa/service-worker.js:8"}, "properties": {"repobilityId": "eb5b91fbd66acaa6", "scanner": "scanner-primary", "fingerprint": "4e90f7375bf064b9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}