{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-490ae8ad1d3b9b1e", "name": "Possibly dead Python function: require_api_key", "shortDescription": {"text": "Possibly dead Python function: require_api_key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4b235b23d32a9add", "name": "Possibly dead Python function: display_message", "shortDescription": {"text": "Possibly dead Python function: display_message"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f0052d3c548a2629", "name": "Possibly dead Python function: clear_message", "shortDescription": {"text": "Possibly dead Python function: clear_message"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c10015ecc3675ae1", "name": "Possibly dead Python function: display_message", "shortDescription": {"text": "Possibly dead Python function: display_message"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3028a482412f1437", "name": "Possibly dead Python function: clear_message", "shortDescription": {"text": "Possibly dead Python function: clear_message"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7dbb65f81d32edec", "name": "Possibly dead Python function: require_api_key", "shortDescription": {"text": "Possibly dead Python function: require_api_key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0a7617d129f83f7f", "name": "Possibly dead Python function: require_admin_key", "shortDescription": {"text": "Possibly dead Python function: require_admin_key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3eb16a0e9e134452", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 claude-design-mockups/ui_kits/railnet_portal/PortalWelcome.jsx:135", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 claude-design-mockups/ui_kits/railnet_portal/PortalWelcome.jsx:135"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a00eb596656ccd43", "name": "Stray `console.log` in TS/JS \u2014 _bmad-output/implementation-artifacts/generate_timeline_onepager.js:326", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 _bmad-output/implementation-artifacts/generate_timeline_onepager.js:326"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e610b47664526b32", "name": "Stray `console.log` in TS/JS \u2014 _bmad-output/implementation-artifacts/generate_readiness_status.js:380", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 _bmad-output/implementation-artifacts/generate_readiness_status.js:380"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-da02d41c791eaf24", "name": "Stray `console.log` in TS/JS \u2014 _bmad-output/implementation-artifacts/generate_whitepaper.js:691", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 _bmad-output/implementation-artifacts/generate_whitepaper.js:691"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5cd80e27e37afa03", "name": "Privileged port 161 in use", "shortDescription": {"text": "Privileged port 161 in use"}, "fullDescription": {"text": "Port 161 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ae0b0d4106ee0962", "name": "Privileged port 12 in use", "shortDescription": {"text": "Privileged port 12 in use"}, "fullDescription": {"text": "Port 12 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-33966385aac31bd8", "name": "Privileged port 10 in use", "shortDescription": {"text": "Privileged port 10 in use"}, "fullDescription": {"text": "Port 10 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-28b32855d713248f", "name": "Dockerfile runs as root: vlan-pollers/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: vlan-pollers/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-601c97fe1c03a47d", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim-bookworm", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim-bookworm"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-69f71f0ac68e9f40", "name": "Dockerfile runs as root: cloud-sync/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: cloud-sync/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-78a17495ee7bc5ef", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim-bookworm", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim-bookworm"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-36c2b5ee4afc3e99", "name": "Dockerfile runs as root: event-store/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: event-store/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4a9757d46e760dcd", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27b29b3176c22e3b", "name": "Dockerfile runs as root: cloud-backend/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: cloud-backend/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eeceef746d069522", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c379875bf9ad1ebd", "name": "Dockerfile runs as root: fusion/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: fusion/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-34751b23e52d1fb2", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim-bookworm", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim-bookworm"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e81a0878c5a272cb", "name": "Insecure pattern 'dangerous_innerhtml' in claude-design-mockups/ui_kits/railnet_portal/PortalWelcome.jsx:135", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in claude-design-mockups/ui_kits/railnet_portal/PortalWelcome.jsx:135"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c5a654b894bf2c98", "name": "Insecure pattern 'direct_innerhtml_assignment' in mockups/passenger-portal-v1.html:688", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in mockups/passenger-portal-v1.html:688"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-975306842befe451", "name": "Insecure pattern 'subprocess_shell_true' in .claude/skills/bmad-security-sentinel/SKILL.md:95", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in .claude/skills/bmad-security-sentinel/SKILL.md:95"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 7 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 33 placeholder/mock markers across 25 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f6308978aa2939ea", "name": "Agent authority lacks a verifier contract: claude-design-mockups/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: claude-design-mockups/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3e3497e7a098a8e0", "name": "Agent authority lacks a verifier contract: shared/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: shared/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3bb2e539c4fee50e", "name": "Agent authority lacks a verifier contract: control-centre/CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: control-centre/CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-122f91b7f2906dc4", "name": "Agent authority lacks a verifier contract: .claude/settings.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1e21c1fc41932961", "name": "Agent authority lacks a verifier contract: .claude/skills/bmad-security-sentinel/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/skills/bmad-security-sentinel/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-eb2c651da9cd35a3", "name": "Agent authority lacks a verifier contract: .claude/projects/C--Users-AbbasRizvi-Documents-oebb-agent/memory/project_cont", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/projects/C--Users-AbbasRizvi-Documents-oebb-agent/memory/project_container_map.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-32bb62dde94f3b2f", "name": "Commented-code block (6 lines) in inference/src/inference/pipeline.py:34", "shortDescription": {"text": "Commented-code block (6 lines) in inference/src/inference/pipeline.py:34"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3d2931d8a5792663", "name": "Commented-code block (5 lines) in inference/src/inference/zone_counter.py:175", "shortDescription": {"text": "Commented-code block (5 lines) in inference/src/inference/zone_counter.py:175"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-dd932ca40bc3bd4e", "name": "Commented-code block (6 lines) in claude-design-mockups/ui_kits/railnet_passenger/scenarios.js:1", "shortDescription": {"text": "Commented-code block (6 lines) in claude-design-mockups/ui_kits/railnet_passenger/scenarios.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-aeac75687cadc961", "name": "Commented-code block (6 lines) in cloud-sync/tests/integration/test_ordered_flush.py:162", "shortDescription": {"text": "Commented-code block (6 lines) in cloud-sync/tests/integration/test_ordered_flush.py:162"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5d5766541958fe07", "name": "Commented-code block (5 lines) in cloud-sync/src/cloud_sync/main.py:70", "shortDescription": {"text": "Commented-code block (5 lines) in cloud-sync/src/cloud_sync/main.py:70"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6100dec1da18960e", "name": "Commented-code block (6 lines) in event-store/tests/integration/test_event_store_concurrent_writes.py:95", "shortDescription": {"text": "Commented-code block (6 lines) in event-store/tests/integration/test_event_store_concurrent_writes.py:95"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0e683e2755825341", "name": "Commented-code block (5 lines) in shared/src/oebb_shared/events/payloads.py:382", "shortDescription": {"text": "Commented-code block (5 lines) in shared/src/oebb_shared/events/payloads.py:382"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-12a0ff628d54aea6", "name": "`fetch()` without try/.catch or AbortSignal \u2014 control-centre/src/api/maintenance.js:14", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 control-centre/src/api/maintenance.js:14"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-82b0fca984cd8459", "name": "`fetch()` without try/.catch or AbortSignal \u2014 control-centre/src/api/aiPipeline.js:5", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 control-centre/src/api/aiPipeline.js:5"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6c6e11f19a8b4ace", "name": "`fetch()` without try/.catch or AbortSignal \u2014 control-centre/src/api/escalations.js:34", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 control-centre/src/api/escalations.js:34"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a3bcde61eccbe430", "name": "`fetch()` without try/.catch or AbortSignal \u2014 control-centre/src/api/analytics.js:28", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 control-centre/src/api/analytics.js:28"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7718683dd654aaf5", "name": "`fetch()` without try/.catch or AbortSignal \u2014 control-centre/src/api/health.js:10", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 control-centre/src/api/health.js:10"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e1d2b7537b60d54c", "name": "`fetch()` without try/.catch or AbortSignal \u2014 control-centre/src/api/preferences.js:28", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 control-centre/src/api/preferences.js:28"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f7e58eaec9d416d1", "name": "Legacy-named symbol `banner__copy` in control-centre/src/components/alerts/DegradedBanner.jsx:34", "shortDescription": {"text": "Legacy-named symbol `banner__copy` in control-centre/src/components/alerts/DegradedBanner.jsx:34"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fef4d142d0e0fa55", "name": "Commented-code block (5 lines) in fusion/tests/unit/test_health.py:395", "shortDescription": {"text": "Commented-code block (5 lines) in fusion/tests/unit/test_health.py:395"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bf5a5638c4df46ce", "name": "Commented-code block (7 lines) in fusion/src/fusion/health.py:303", "shortDescription": {"text": "Commented-code block (7 lines) in fusion/src/fusion/health.py:303"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d0b17c8c07a7421d", "name": "8 env vars used in code but missing from .env.example", "shortDescription": {"text": "8 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `APPDATA`, `VITE_API_KEY`, `VITE_API_URL`, `VITE_CONDUCTOR_APP_URL`, `VITE_MAINTENANCE_APP_ENABLED`, `VITE_MOCK_API`, `VITE_MOCK_WS_DELAY_MS`, `VITE_OPERATOR_ID`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\ninference/src/inference/zone_counter.py:update_journey_id, inference/src/inference/zone_counter.py:update\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e2fb25acee16fadf", "name": "Frontend route `/dashboard` has no Link/navigate to it \u2014 control-centre/src/App.jsx", "shortDescription": {"text": "Frontend route `/dashboard` has no Link/navigate to it \u2014 control-centre/src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fbc5cd8327a27627", "name": "Frontend route `occupancy` has no Link/navigate to it \u2014 control-centre/src/App.jsx", "shortDescription": {"text": "Frontend route `occupancy` has no Link/navigate to it \u2014 control-centre/src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-abf35d8b90944dc9", "name": "Frontend route `luggage` has no Link/navigate to it \u2014 control-centre/src/App.jsx", "shortDescription": {"text": "Frontend route `luggage` has no Link/navigate to it \u2014 control-centre/src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-324423f2a5431170", "name": "Frontend route `health` has no Link/navigate to it \u2014 control-centre/src/App.jsx", "shortDescription": {"text": "Frontend route `health` has no Link/navigate to it \u2014 control-centre/src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-acb60a008bb83911", "name": "Frontend route `analytics` has no Link/navigate to it \u2014 control-centre/src/App.jsx", "shortDescription": {"text": "Frontend route `analytics` has no Link/navigate to it \u2014 control-centre/src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c351f62fd6ff75ec", "name": "Frontend route `escalations` has no Link/navigate to it \u2014 control-centre/src/App.jsx", "shortDescription": {"text": "Frontend route `escalations` has no Link/navigate to it \u2014 control-centre/src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6cfaeb51cb413742", "name": "FastAPI POST `context_push` without auth dependency \u2014 inference/src/inference/health.py:85", "shortDescription": {"text": "FastAPI POST `context_push` without auth dependency \u2014 inference/src/inference/health.py:85"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ac8b25bf265a786a", "name": "FastAPI POST `ingest_event` without auth dependency \u2014 event-store/src/event_store/routes/events.py:42", "shortDescription": {"text": "FastAPI POST `ingest_event` without auth dependency \u2014 event-store/src/event_store/routes/events.py:42"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fabae4992ba402a1", "name": "FastAPI POST `advance_sync_cursor_endpoint` without auth dependency \u2014 event-store/src/event_store/routes/sync.py:49", "shortDescription": {"text": "FastAPI POST `advance_sync_cursor_endpoint` without auth dependency \u2014 event-store/src/event_store/routes/sync.py:49"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7ba4a54cc720672d", "name": "FastAPI POST `context_push` without auth dependency \u2014 rtsp-ingest/src/rtsp_ingest/health.py:30", "shortDescription": {"text": "FastAPI POST `context_push` without auth dependency \u2014 rtsp-ingest/src/rtsp_ingest/health.py:30"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-37b866d4da0104ec", "name": "FastAPI POST `ingest_events` without auth dependency \u2014 cloud-backend/src/cloud_backend/routes/ingest.py:34", "shortDescription": {"text": "FastAPI POST `ingest_events` without auth dependency \u2014 cloud-backend/src/cloud_backend/routes/ingest.py:34"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1dbf522d6737bf69", "name": "FastAPI POST `raise_ticket` without auth dependency \u2014 cloud-backend/src/cloud_backend/routes/maintenance.py:32", "shortDescription": {"text": "FastAPI POST `raise_ticket` without auth dependency \u2014 cloud-backend/src/cloud_backend/routes/maintenance.py:32"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-15105eb9bd5219f2", "name": "FastAPI POST `disable_alert_class` without auth dependency \u2014 cloud-backend/src/cloud_backend/routes/admin_alert_classes.", "shortDescription": {"text": "FastAPI POST `disable_alert_class` without auth dependency \u2014 cloud-backend/src/cloud_backend/routes/admin_alert_classes.py:117"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d328bed45c6ea9c8", "name": "FastAPI POST `enable_alert_class` without auth dependency \u2014 cloud-backend/src/cloud_backend/routes/admin_alert_classes.p", "shortDescription": {"text": "FastAPI POST `enable_alert_class` without auth dependency \u2014 cloud-backend/src/cloud_backend/routes/admin_alert_classes.py:152"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ed28a732e81dd605", "name": "FastAPI PATCH `patch_preferences` without auth dependency \u2014 cloud-backend/src/cloud_backend/routes/preferences.py:82", "shortDescription": {"text": "FastAPI PATCH `patch_preferences` without auth dependency \u2014 cloud-backend/src/cloud_backend/routes/preferences.py:82"}, "fullDescription": {"text": "`@router.patch` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a5a6d58006372bf5", "name": "FastAPI POST `context_push` without auth dependency \u2014 fusion/src/fusion/health.py:98", "shortDescription": {"text": "FastAPI POST `context_push` without auth dependency \u2014 fusion/src/fusion/health.py:98"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e2f5ac00f7fca669", "name": "FastAPI POST `candidate_door_obstruction` without auth dependency \u2014 fusion/src/fusion/health.py:177", "shortDescription": {"text": "FastAPI POST `candidate_door_obstruction` without auth dependency \u2014 fusion/src/fusion/health.py:177"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f7e46376a53695f8", "name": "FastAPI POST `candidate_alert_raised` without auth dependency \u2014 fusion/src/fusion/health.py:192", "shortDescription": {"text": "FastAPI POST `candidate_alert_raised` without auth dependency \u2014 fusion/src/fusion/health.py:192"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d1fca371d6544044", "name": "FastAPI POST `candidate_accessibility` without auth dependency \u2014 fusion/src/fusion/health.py:224", "shortDescription": {"text": "FastAPI POST `candidate_accessibility` without auth dependency \u2014 fusion/src/fusion/health.py:224"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-346ddcb776cde543", "name": "FastAPI POST `candidate_wagon_exit` without auth dependency \u2014 fusion/src/fusion/health.py:238", "shortDescription": {"text": "FastAPI POST `candidate_wagon_exit` without auth dependency \u2014 fusion/src/fusion/health.py:238"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-76905733d0db5746", "name": "FastAPI POST `candidate_wagon_entry` without auth dependency \u2014 fusion/src/fusion/health.py:251", "shortDescription": {"text": "FastAPI POST `candidate_wagon_entry` without auth dependency \u2014 fusion/src/fusion/health.py:251"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-50a09487bca89011", "name": "FastAPI POST `candidate_occupancy_update` without auth dependency \u2014 fusion/src/fusion/health.py:264", "shortDescription": {"text": "FastAPI POST `candidate_occupancy_update` without auth dependency \u2014 fusion/src/fusion/health.py:264"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23872"}, "properties": {"repository": "absrzvi/vison", "repoUrl": "https://github.com/absrzvi/vison", "branch": "main"}, "results": [{"ruleId": "scanner-490ae8ad1d3b9b1e", "level": "note", "message": {"text": "Possibly dead Python function: require_api_key"}, "properties": {"repobilityId": "44e8e9840fc57179", "scanner": "scanner-primary", "fingerprint": "490ae8ad1d3b9b1e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "event-store/src/event_store/auth.py:23"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4b235b23d32a9add", "level": "note", "message": {"text": "Possibly dead Python function: display_message"}, "properties": {"repobilityId": "d7e80d321e6c0144", "scanner": "scanner-primary", "fingerprint": "4b235b23d32a9add", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/src/oebb_shared/adapters/pis/base.py:15"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f0052d3c548a2629", "level": "note", "message": {"text": "Possibly dead Python function: clear_message"}, "properties": {"repobilityId": "8779291e124ac17d", "scanner": "scanner-primary", "fingerprint": "f0052d3c548a2629", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/src/oebb_shared/adapters/pis/base.py:17"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c10015ecc3675ae1", "level": "note", "message": {"text": "Possibly dead Python function: display_message"}, "properties": {"repobilityId": "d7e80d321e6c0144", "scanner": "scanner-primary", "fingerprint": "c10015ecc3675ae1", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/src/oebb_shared/adapters/pis/mock.py:11"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3028a482412f1437", "level": "note", "message": {"text": "Possibly dead Python function: clear_message"}, "properties": {"repobilityId": "8779291e124ac17d", "scanner": "scanner-primary", "fingerprint": "3028a482412f1437", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/src/oebb_shared/adapters/pis/mock.py:14"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7dbb65f81d32edec", "level": "note", "message": {"text": "Possibly dead Python function: require_api_key"}, "properties": {"repobilityId": "44e8e9840fc57179", "scanner": "scanner-primary", "fingerprint": "7dbb65f81d32edec", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud-backend/src/cloud_backend/api/auth.py:11"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0a7617d129f83f7f", "level": "note", "message": {"text": "Possibly dead Python function: require_admin_key"}, "properties": {"repobilityId": "fe46359a3cecc233", "scanner": "scanner-primary", "fingerprint": "0a7617d129f83f7f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud-backend/src/cloud_backend/routes/admin_alert_classes.py:32"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3eb16a0e9e134452", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 claude-design-mockups/ui_kits/railnet_portal/PortalWelcome.jsx:135"}, "properties": {"repobilityId": "a6d6c7431b071aa4", "scanner": "scanner-primary", "fingerprint": "3eb16a0e9e134452", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-a00eb596656ccd43", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 _bmad-output/implementation-artifacts/generate_timeline_onepager.js:326"}, "properties": {"repobilityId": "6ebb56ec9877c758", "scanner": "scanner-primary", "fingerprint": "a00eb596656ccd43", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e610b47664526b32", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 _bmad-output/implementation-artifacts/generate_readiness_status.js:380"}, "properties": {"repobilityId": "bc9be51c51e608af", "scanner": "scanner-primary", "fingerprint": "e610b47664526b32", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-da02d41c791eaf24", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 _bmad-output/implementation-artifacts/generate_whitepaper.js:691"}, "properties": {"repobilityId": "a391977bfcd25c86", "scanner": "scanner-primary", "fingerprint": "da02d41c791eaf24", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5cd80e27e37afa03", "level": "warning", "message": {"text": "Privileged port 161 in use"}, "properties": {"repobilityId": "fef0e3b0b4a09943", "scanner": "scanner-primary", "fingerprint": "5cd80e27e37afa03", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docker-compose.dev.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ae0b0d4106ee0962", "level": "warning", "message": {"text": "Privileged port 12 in use"}, "properties": {"repobilityId": "65e7eefa33f2def4", "scanner": "scanner-primary", "fingerprint": "ae0b0d4106ee0962", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "_bmad-output/implementation-artifacts/sprint-status.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-33966385aac31bd8", "level": "warning", "message": {"text": "Privileged port 10 in use"}, "properties": {"repobilityId": "735372d6b5594915", "scanner": "scanner-primary", "fingerprint": "33966385aac31bd8", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "_bmad-output/implementation-artifacts/sprint-status.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-28b32855d713248f", "level": "warning", "message": {"text": "Dockerfile runs as root: vlan-pollers/Dockerfile"}, "properties": {"repobilityId": "3019090ac3ad63c8", "scanner": "scanner-primary", "fingerprint": "28b32855d713248f", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-601c97fe1c03a47d", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim-bookworm"}, "properties": {"repobilityId": "fce4a13a5fec8026", "scanner": "scanner-primary", "fingerprint": "601c97fe1c03a47d", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "vlan-pollers/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-69f71f0ac68e9f40", "level": "warning", "message": {"text": "Dockerfile runs as root: cloud-sync/Dockerfile"}, "properties": {"repobilityId": "4c96edb5e9490b64", "scanner": "scanner-primary", "fingerprint": "69f71f0ac68e9f40", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-78a17495ee7bc5ef", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim-bookworm"}, "properties": {"repobilityId": "3c2d545c9559a5ca", "scanner": "scanner-primary", "fingerprint": "78a17495ee7bc5ef", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud-sync/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-36c2b5ee4afc3e99", "level": "warning", "message": {"text": "Dockerfile runs as root: event-store/Dockerfile"}, "properties": {"repobilityId": "301854bcb9eb13de", "scanner": "scanner-primary", "fingerprint": "36c2b5ee4afc3e99", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-4a9757d46e760dcd", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "4a677e606951e3c3", "scanner": "scanner-primary", "fingerprint": "4a9757d46e760dcd", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "event-store/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-27b29b3176c22e3b", "level": "warning", "message": {"text": "Dockerfile runs as root: cloud-backend/Dockerfile"}, "properties": {"repobilityId": "daeeee4990520b48", "scanner": "scanner-primary", "fingerprint": "27b29b3176c22e3b", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-eeceef746d069522", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "566acbbb3574de82", "scanner": "scanner-primary", "fingerprint": "eeceef746d069522", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud-backend/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c379875bf9ad1ebd", "level": "warning", "message": {"text": "Dockerfile runs as root: fusion/Dockerfile"}, "properties": {"repobilityId": "8caa52b7074be336", "scanner": "scanner-primary", "fingerprint": "c379875bf9ad1ebd", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-34751b23e52d1fb2", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim-bookworm"}, "properties": {"repobilityId": "f2db01a9e5c0ec11", "scanner": "scanner-primary", "fingerprint": "34751b23e52d1fb2", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fusion/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e81a0878c5a272cb", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in claude-design-mockups/ui_kits/railnet_portal/PortalWelcome.jsx:135"}, "properties": {"repobilityId": "abf0ca4855d59994", "scanner": "scanner-primary", "fingerprint": "e81a0878c5a272cb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "claude-design-mockups/ui_kits/railnet_portal/PortalWelcome.jsx"}, "region": {"startLine": 135}}}]}, {"ruleId": "scanner-c5a654b894bf2c98", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in mockups/passenger-portal-v1.html:688"}, "properties": {"repobilityId": "975b2b5d7fb43ce3", "scanner": "scanner-primary", "fingerprint": "c5a654b894bf2c98", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "mockups/passenger-portal-v1.html"}, "region": {"startLine": 688}}}]}, {"ruleId": "scanner-975306842befe451", "level": "error", "message": {"text": "Insecure pattern 'subprocess_shell_true' in .claude/skills/bmad-security-sentinel/SKILL.md:95"}, "properties": {"repobilityId": "b4b058d8cf180425", "scanner": "scanner-primary", "fingerprint": "975306842befe451", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/bmad-security-sentinel/SKILL.md"}, "region": {"startLine": 95}}}]}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "e7d16978c468e877", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "532b0565e64c73ac", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "d41cb251af0a610b", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "af163fcc21fd6bdb", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "78b1b1ba82daf965", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-f6308978aa2939ea", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: claude-design-mockups/SKILL.md"}, "properties": {"repobilityId": "fd9136211471469d", "scanner": "scanner-primary", "fingerprint": "f6308978aa2939ea", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "claude-design-mockups/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3e3497e7a098a8e0", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: shared/CLAUDE.md"}, "properties": {"repobilityId": "8cf38538aefe3103", "scanner": "scanner-primary", "fingerprint": "3e3497e7a098a8e0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "shared/CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3bb2e539c4fee50e", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: control-centre/CLAUDE.md"}, "properties": {"repobilityId": "6d44341536c6eaba", "scanner": "scanner-primary", "fingerprint": "3bb2e539c4fee50e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "control-centre/CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-122f91b7f2906dc4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "properties": {"repobilityId": "a2967269048b6a9d", "scanner": "scanner-primary", "fingerprint": "122f91b7f2906dc4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1e21c1fc41932961", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/skills/bmad-security-sentinel/SKILL.md"}, "properties": {"repobilityId": "99dbc7da2c6364b2", "scanner": "scanner-primary", "fingerprint": "1e21c1fc41932961", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/bmad-security-sentinel/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-eb2c651da9cd35a3", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/projects/C--Users-AbbasRizvi-Documents-oebb-agent/memory/project_container_map.md"}, "properties": {"repobilityId": "e69ec0c8df8244a2", "scanner": "scanner-primary", "fingerprint": "eb2c651da9cd35a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/projects/C--Users-AbbasRizvi-Documents-oebb-agent/memory/project_container_map.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-32bb62dde94f3b2f", "level": "none", "message": {"text": "Commented-code block (6 lines) in inference/src/inference/pipeline.py:34"}, "properties": {"repobilityId": "729516876506705f", "scanner": "scanner-primary", "fingerprint": "32bb62dde94f3b2f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3d2931d8a5792663", "level": "none", "message": {"text": "Commented-code block (5 lines) in inference/src/inference/zone_counter.py:175"}, "properties": {"repobilityId": "f1d6d78f444c5f98", "scanner": "scanner-primary", "fingerprint": "3d2931d8a5792663", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-dd932ca40bc3bd4e", "level": "none", "message": {"text": "Commented-code block (6 lines) in claude-design-mockups/ui_kits/railnet_passenger/scenarios.js:1"}, "properties": {"repobilityId": "2682050d52a95436", "scanner": "scanner-primary", "fingerprint": "dd932ca40bc3bd4e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-aeac75687cadc961", "level": "none", "message": {"text": "Commented-code block (6 lines) in cloud-sync/tests/integration/test_ordered_flush.py:162"}, "properties": {"repobilityId": "151d5f67b0865035", "scanner": "scanner-primary", "fingerprint": "aeac75687cadc961", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5d5766541958fe07", "level": "none", "message": {"text": "Commented-code block (5 lines) in cloud-sync/src/cloud_sync/main.py:70"}, "properties": {"repobilityId": "a08ae938438ed01d", "scanner": "scanner-primary", "fingerprint": "5d5766541958fe07", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6100dec1da18960e", "level": "none", "message": {"text": "Commented-code block (6 lines) in event-store/tests/integration/test_event_store_concurrent_writes.py:95"}, "properties": {"repobilityId": "05d63745d6b7d305", "scanner": "scanner-primary", "fingerprint": "6100dec1da18960e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0e683e2755825341", "level": "none", "message": {"text": "Commented-code block (5 lines) in shared/src/oebb_shared/events/payloads.py:382"}, "properties": {"repobilityId": "4f752f59600e8876", "scanner": "scanner-primary", "fingerprint": "0e683e2755825341", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-12a0ff628d54aea6", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 control-centre/src/api/maintenance.js:14"}, "properties": {"repobilityId": "255a99033e9b2f0f", "scanner": "scanner-primary", "fingerprint": "12a0ff628d54aea6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-82b0fca984cd8459", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 control-centre/src/api/aiPipeline.js:5"}, "properties": {"repobilityId": "7a24b5053a2a02ba", "scanner": "scanner-primary", "fingerprint": "82b0fca984cd8459", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6c6e11f19a8b4ace", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 control-centre/src/api/escalations.js:34"}, "properties": {"repobilityId": "7dd397c4fb6a5510", "scanner": "scanner-primary", "fingerprint": "6c6e11f19a8b4ace", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-a3bcde61eccbe430", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 control-centre/src/api/analytics.js:28"}, "properties": {"repobilityId": "e9c8799e3849648e", "scanner": "scanner-primary", "fingerprint": "a3bcde61eccbe430", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-7718683dd654aaf5", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 control-centre/src/api/health.js:10"}, "properties": {"repobilityId": "3887a43c210fb7de", "scanner": "scanner-primary", "fingerprint": "7718683dd654aaf5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e1d2b7537b60d54c", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 control-centre/src/api/preferences.js:28"}, "properties": {"repobilityId": "ba0d387f2e39828f", "scanner": "scanner-primary", "fingerprint": "e1d2b7537b60d54c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f7e58eaec9d416d1", "level": "note", "message": {"text": "Legacy-named symbol `banner__copy` in control-centre/src/components/alerts/DegradedBanner.jsx:34"}, "properties": {"repobilityId": "978c2816413c5656", "scanner": "scanner-primary", "fingerprint": "f7e58eaec9d416d1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-fef4d142d0e0fa55", "level": "none", "message": {"text": "Commented-code block (5 lines) in fusion/tests/unit/test_health.py:395"}, "properties": {"repobilityId": "7153bc8195c16831", "scanner": "scanner-primary", "fingerprint": "fef4d142d0e0fa55", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bf5a5638c4df46ce", "level": "none", "message": {"text": "Commented-code block (7 lines) in fusion/src/fusion/health.py:303"}, "properties": {"repobilityId": "f049579d3bb01166", "scanner": "scanner-primary", "fingerprint": "bf5a5638c4df46ce", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-d0b17c8c07a7421d", "level": "note", "message": {"text": "8 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "17fe720e8247f9df", "scanner": "scanner-primary", "fingerprint": "d0b17c8c07a7421d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "bc7de9b39ea47ad1", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "db9c8208105892ec", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "128f408ac7e99b64", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "9c138bae8ad25d16", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "3169caddea356285", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-e2fb25acee16fadf", "level": "warning", "message": {"text": "Frontend route `/dashboard` has no Link/navigate to it \u2014 control-centre/src/App.jsx"}, "properties": {"repobilityId": "eace3e2da3bda854", "scanner": "scanner-primary", "fingerprint": "e2fb25acee16fadf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-fbc5cd8327a27627", "level": "warning", "message": {"text": "Frontend route `occupancy` has no Link/navigate to it \u2014 control-centre/src/App.jsx"}, "properties": {"repobilityId": "26f4bb53d324d1ec", "scanner": "scanner-primary", "fingerprint": "fbc5cd8327a27627", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-abf35d8b90944dc9", "level": "warning", "message": {"text": "Frontend route `luggage` has no Link/navigate to it \u2014 control-centre/src/App.jsx"}, "properties": {"repobilityId": "017cc2f3912536cf", "scanner": "scanner-primary", "fingerprint": "abf35d8b90944dc9", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-324423f2a5431170", "level": "warning", "message": {"text": "Frontend route `health` has no Link/navigate to it \u2014 control-centre/src/App.jsx"}, "properties": {"repobilityId": "3ca5e3ec33958a1a", "scanner": "scanner-primary", "fingerprint": "324423f2a5431170", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-acb60a008bb83911", "level": "warning", "message": {"text": "Frontend route `analytics` has no Link/navigate to it \u2014 control-centre/src/App.jsx"}, "properties": {"repobilityId": "e5f5bb95460c44db", "scanner": "scanner-primary", "fingerprint": "acb60a008bb83911", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-c351f62fd6ff75ec", "level": "warning", "message": {"text": "Frontend route `escalations` has no Link/navigate to it \u2014 control-centre/src/App.jsx"}, "properties": {"repobilityId": "e6abe0a1e98f4195", "scanner": "scanner-primary", "fingerprint": "c351f62fd6ff75ec", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-6cfaeb51cb413742", "level": "error", "message": {"text": "FastAPI POST `context_push` without auth dependency \u2014 inference/src/inference/health.py:85"}, "properties": {"repobilityId": "9b83ba73b78f4ae6", "scanner": "scanner-primary", "fingerprint": "6cfaeb51cb413742", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "inference/src/inference/health.py"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-ac8b25bf265a786a", "level": "error", "message": {"text": "FastAPI POST `ingest_event` without auth dependency \u2014 event-store/src/event_store/routes/events.py:42"}, "properties": {"repobilityId": "b6d1858be46858dc", "scanner": "scanner-primary", "fingerprint": "ac8b25bf265a786a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "event-store/src/event_store/routes/events.py"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-fabae4992ba402a1", "level": "error", "message": {"text": "FastAPI POST `advance_sync_cursor_endpoint` without auth dependency \u2014 event-store/src/event_store/routes/sync.py:49"}, "properties": {"repobilityId": "545601878782cdcf", "scanner": "scanner-primary", "fingerprint": "fabae4992ba402a1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "event-store/src/event_store/routes/sync.py"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-7ba4a54cc720672d", "level": "error", "message": {"text": "FastAPI POST `context_push` without auth dependency \u2014 rtsp-ingest/src/rtsp_ingest/health.py:30"}, "properties": {"repobilityId": "189fd96fc3e0f5a9", "scanner": "scanner-primary", "fingerprint": "7ba4a54cc720672d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rtsp-ingest/src/rtsp_ingest/health.py"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-37b866d4da0104ec", "level": "error", "message": {"text": "FastAPI POST `ingest_events` without auth dependency \u2014 cloud-backend/src/cloud_backend/routes/ingest.py:34"}, "properties": {"repobilityId": "63e8c646e1586689", "scanner": "scanner-primary", "fingerprint": "37b866d4da0104ec", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud-backend/src/cloud_backend/routes/ingest.py"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-1dbf522d6737bf69", "level": "error", "message": {"text": "FastAPI POST `raise_ticket` without auth dependency \u2014 cloud-backend/src/cloud_backend/routes/maintenance.py:32"}, "properties": {"repobilityId": "0b809c7e34686aec", "scanner": "scanner-primary", "fingerprint": "1dbf522d6737bf69", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud-backend/src/cloud_backend/routes/maintenance.py"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-15105eb9bd5219f2", "level": "error", "message": {"text": "FastAPI POST `disable_alert_class` without auth dependency \u2014 cloud-backend/src/cloud_backend/routes/admin_alert_classes.py:117"}, "properties": {"repobilityId": "2d49c6d9caadca9c", "scanner": "scanner-primary", "fingerprint": "15105eb9bd5219f2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud-backend/src/cloud_backend/routes/admin_alert_classes.py"}, "region": {"startLine": 117}}}]}, {"ruleId": "scanner-d328bed45c6ea9c8", "level": "error", "message": {"text": "FastAPI POST `enable_alert_class` without auth dependency \u2014 cloud-backend/src/cloud_backend/routes/admin_alert_classes.py:152"}, "properties": {"repobilityId": "d0e51f4fa282f975", "scanner": "scanner-primary", "fingerprint": "d328bed45c6ea9c8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud-backend/src/cloud_backend/routes/admin_alert_classes.py"}, "region": {"startLine": 152}}}]}, {"ruleId": "scanner-ed28a732e81dd605", "level": "error", "message": {"text": "FastAPI PATCH `patch_preferences` without auth dependency \u2014 cloud-backend/src/cloud_backend/routes/preferences.py:82"}, "properties": {"repobilityId": "99d1b827d5e3785b", "scanner": "scanner-primary", "fingerprint": "ed28a732e81dd605", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud-backend/src/cloud_backend/routes/preferences.py"}, "region": {"startLine": 82}}}]}, {"ruleId": "scanner-a5a6d58006372bf5", "level": "error", "message": {"text": "FastAPI POST `context_push` without auth dependency \u2014 fusion/src/fusion/health.py:98"}, "properties": {"repobilityId": "28c67f675f69b915", "scanner": "scanner-primary", "fingerprint": "a5a6d58006372bf5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fusion/src/fusion/health.py"}, "region": {"startLine": 98}}}]}, {"ruleId": "scanner-e2f5ac00f7fca669", "level": "error", "message": {"text": "FastAPI POST `candidate_door_obstruction` without auth dependency \u2014 fusion/src/fusion/health.py:177"}, "properties": {"repobilityId": "86481e62616f4260", "scanner": "scanner-primary", "fingerprint": "e2f5ac00f7fca669", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fusion/src/fusion/health.py"}, "region": {"startLine": 177}}}]}, {"ruleId": "scanner-f7e46376a53695f8", "level": "error", "message": {"text": "FastAPI POST `candidate_alert_raised` without auth dependency \u2014 fusion/src/fusion/health.py:192"}, "properties": {"repobilityId": "74716a12e516e926", "scanner": "scanner-primary", "fingerprint": "f7e46376a53695f8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fusion/src/fusion/health.py"}, "region": {"startLine": 192}}}]}, {"ruleId": "scanner-d1fca371d6544044", "level": "error", "message": {"text": "FastAPI POST `candidate_accessibility` without auth dependency \u2014 fusion/src/fusion/health.py:224"}, "properties": {"repobilityId": "fc5328db8c583789", "scanner": "scanner-primary", "fingerprint": "d1fca371d6544044", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fusion/src/fusion/health.py"}, "region": {"startLine": 224}}}]}, {"ruleId": "scanner-346ddcb776cde543", "level": "error", "message": {"text": "FastAPI POST `candidate_wagon_exit` without auth dependency \u2014 fusion/src/fusion/health.py:238"}, "properties": {"repobilityId": "93e79c07b72561b0", "scanner": "scanner-primary", "fingerprint": "346ddcb776cde543", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fusion/src/fusion/health.py"}, "region": {"startLine": 238}}}]}, {"ruleId": "scanner-76905733d0db5746", "level": "error", "message": {"text": "FastAPI POST `candidate_wagon_entry` without auth dependency \u2014 fusion/src/fusion/health.py:251"}, "properties": {"repobilityId": "a302f6c1ec003fd6", "scanner": "scanner-primary", "fingerprint": "76905733d0db5746", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fusion/src/fusion/health.py"}, "region": {"startLine": 251}}}]}, {"ruleId": "scanner-50a09487bca89011", "level": "error", "message": {"text": "FastAPI POST `candidate_occupancy_update` without auth dependency \u2014 fusion/src/fusion/health.py:264"}, "properties": {"repobilityId": "20fa675f6a47706f", "scanner": "scanner-primary", "fingerprint": "50a09487bca89011", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "fusion/src/fusion/health.py"}, "region": {"startLine": 264}}}]}]}]}