{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-ffc7e4593b8d1cae", "name": "Possibly dead Python function: redirect_request", "shortDescription": {"text": "Possibly dead Python function: redirect_request"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d63d0309feb08dba", "name": "Truncated text has no discoverable full-value affordance \u2014 graph-ui/src/App.tsx:108", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 graph-ui/src/App.tsx:108"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-bb269bd23d833411", "name": "Truncated text has no discoverable full-value affordance \u2014 graph-ui/src/components/NodeTooltip.tsx:29", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 graph-ui/src/components/NodeTooltip.tsx:29"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-10731e396afee4eb", "name": "Icon-only button without accessible name \u2014 graph-ui/src/components/NodeDetailPanel.tsx:131", "shortDescription": {"text": "Icon-only button without accessible name \u2014 graph-ui/src/components/NodeDetailPanel.tsx:131"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-1c0b527d354183bb", "name": "Truncated text has no discoverable full-value affordance \u2014 graph-ui/src/components/NodeDetailPanel.tsx:122", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 graph-ui/src/components/NodeDetailPanel.tsx:122"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-dafa1cd7706b356d", "name": "Truncated text has no discoverable full-value affordance \u2014 graph-ui/src/components/ControlTab.tsx:71", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 graph-ui/src/components/ControlTab.tsx:71"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-9f90b2f36db758f2", "name": "Truncated text has no discoverable full-value affordance \u2014 graph-ui/src/components/ProjectCard.tsx:23", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 graph-ui/src/components/ProjectCard.tsx:23"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-2ceee333f9b2086d", "name": "Truncated text has no discoverable full-value affordance \u2014 graph-ui/src/components/StatsTab.tsx:394", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 graph-ui/src/components/StatsTab.tsx:394"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-1568a6de31a45ef2", "name": "Truncated text has no discoverable full-value affordance \u2014 graph-ui/src/components/Sidebar.tsx:84", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 graph-ui/src/components/Sidebar.tsx:84"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-1b66908967610976", "name": "insecure use strcat fn \u2014 internal/cbm/iris_export_xml.c:158", "shortDescription": {"text": "insecure use strcat fn \u2014 internal/cbm/iris_export_xml.c:158"}, "fullDescription": {"text": "Finding triggers whenever there is a strcat or strncat used. This is an issue because strcat or strncat can lead to buffer overflow vulns. Fix this by using strcat_s instead.\n\nRule: c.lang.security.insecure-use-strcat-fn.insecure-use-strcat-fn\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-676: Use of Potentially Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-4052b59218dd29ef", "name": "insecure use string copy fn \u2014 internal/cbm/iris_export_xml.c:233", "shortDescription": {"text": "insecure use string copy fn \u2014 internal/cbm/iris_export_xml.c:233"}, "fullDescription": {"text": "Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm the size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer overflows, which can cause program crashes and potentially let an attacker inject code in the program. Fix this by using strcpy_s instead (although note that strcpy_s is an optional part of the C11 standard, and so may not be available).\n\nRule: c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-676: Use of Potentially Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-ceedef7116d2df65", "name": "insecure use string copy fn \u2014 internal/cbm/lsp/kotlin_lsp.c:1541", "shortDescription": {"text": "insecure use string copy fn \u2014 internal/cbm/lsp/kotlin_lsp.c:1541"}, "fullDescription": {"text": "Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm the size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer overflows, which can cause program crashes and potentially let an attacker inject code in the program. Fix this by using strcpy_s instead (although note that strcpy_s is an optional part of the C11 standard, and so may not be available).\n\nRule: c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-676: Use of Potentially Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-b475e4b0c8675d60", "name": "insecure use strcat fn \u2014 internal/cbm/lsp/kotlin_lsp.c:1542", "shortDescription": {"text": "insecure use strcat fn \u2014 internal/cbm/lsp/kotlin_lsp.c:1542"}, "fullDescription": {"text": "Finding triggers whenever there is a strcat or strncat used. This is an issue because strcat or strncat can lead to buffer overflow vulns. Fix this by using strcat_s instead.\n\nRule: c.lang.security.insecure-use-strcat-fn.insecure-use-strcat-fn\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-676: Use of Potentially Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-82bf6dc5a70dad68", "name": "insecure use string copy fn \u2014 internal/cbm/lsp/py_lsp.c:2078", "shortDescription": {"text": "insecure use string copy fn \u2014 internal/cbm/lsp/py_lsp.c:2078"}, "fullDescription": {"text": "Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm the size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer overflows, which can cause program crashes and potentially let an attacker inject code in the program. Fix this by using strcpy_s instead (although note that strcpy_s is an optional part of the C11 standard, and so may not be available).\n\nRule: c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-676: Use of Potentially Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-221bfb19bcac277d", "name": "insecure use string copy fn \u2014 internal/cbm/vendored/grammars/astro/scanner.c:57", "shortDescription": {"text": "insecure use string copy fn \u2014 internal/cbm/vendored/grammars/astro/scanner.c:57"}, "fullDescription": {"text": "Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm the size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer overflows, which can cause program crashes and potentially let an attacker inject code in the program. Fix this by using strcpy_s instead (although note that strcpy_s is an optional part of the C11 standard, and so may not be available).\n\nRule: c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-676: Use of Potentially Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-b1fb9d4553776940", "name": "insecure use string copy fn \u2014 internal/cbm/vendored/grammars/blade/scanner.c:53", "shortDescription": {"text": "insecure use string copy fn \u2014 internal/cbm/vendored/grammars/blade/scanner.c:53"}, "fullDescription": {"text": "Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm the size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer overflows, which can cause program crashes and potentially let an attacker inject code in the program. Fix this by using strcpy_s instead (although note that strcpy_s is an optional part of the C11 standard, and so may not be available).\n\nRule: c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-676: Use of Potentially Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-db0d27d180e4ac2c", "name": "use after free \u2014 internal/cbm/vendored/grammars/dockerfile/scanner.c:253", "shortDescription": {"text": "use after free \u2014 internal/cbm/vendored/grammars/dockerfile/scanner.c:253"}, "fullDescription": {"text": "Variable 'state->heredocs[0]' was used after being freed. This can lead to undefined behavior.\n\nRule: c.lang.security.use-after-free.use-after-free\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-416: Use After Free\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-cdd0e3196f96c8df", "name": "insecure use string copy fn \u2014 internal/cbm/vendored/grammars/html/scanner.c:48", "shortDescription": {"text": "insecure use string copy fn \u2014 internal/cbm/vendored/grammars/html/scanner.c:48"}, "fullDescription": {"text": "Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm the size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer overflows, which can cause program crashes and potentially let an attacker inject code in the program. Fix this by using strcpy_s instead (although note that strcpy_s is an optional part of the C11 standard, and so may not be available).\n\nRule: c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-676: Use of Potentially Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-c37b587c2feb0c7b", "name": "insecure use string copy fn \u2014 internal/cbm/vendored/grammars/objectscript_routine/objectscript_common.h:97", "shortDescription": {"text": "insecure use string copy fn \u2014 internal/cbm/vendored/grammars/objectscript_routine/objectscript_common.h:97"}, "fullDescription": {"text": "Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm the size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer overflows, which can cause program crashes and potentially let an attacker inject code in the program. Fix this by using strcpy_s instead (although note that strcpy_s is an optional part of the C11 standard, and so may not be available).\n\nRule: c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-676: Use of Potentially Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-be9f36b0e21d728e", "name": "insecure use string copy fn \u2014 internal/cbm/vendored/grammars/objectscript_udl/objectscript_common.h:97", "shortDescription": {"text": "insecure use string copy fn \u2014 internal/cbm/vendored/grammars/objectscript_udl/objectscript_common.h:97"}, "fullDescription": {"text": "Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm the size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer overflows, which can cause program crashes and potentially let an attacker inject code in the program. Fix this by using strcpy_s instead (although note that strcpy_s is an optional part of the C11 standard, and so may not be available).\n\nRule: c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-676: Use of Potentially Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-1b37326117a9ae16", "name": "insecure use strcat fn \u2014 internal/cbm/vendored/grammars/scala/scanner.c:251", "shortDescription": {"text": "insecure use strcat fn \u2014 internal/cbm/vendored/grammars/scala/scanner.c:251"}, "fullDescription": {"text": "Finding triggers whenever there is a strcat or strncat used. This is an issue because strcat or strncat can lead to buffer overflow vulns. Fix this by using strcat_s instead.\n\nRule: c.lang.security.insecure-use-strcat-fn.insecure-use-strcat-fn\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-676: Use of Potentially Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-37522a3d08bca25a", "name": "insecure use string copy fn \u2014 internal/cbm/vendored/grammars/sql/scanner.c:43", "shortDescription": {"text": "insecure use string copy fn \u2014 internal/cbm/vendored/grammars/sql/scanner.c:43"}, "fullDescription": {"text": "Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm the size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer overflows, which can cause program crashes and potentially let an attacker inject code in the program. Fix this by using strcpy_s instead (although note that strcpy_s is an optional part of the C11 standard, and so may not be available).\n\nRule: c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-676: Use of Potentially Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-c7fd71637dbf7216", "name": "insecure use string copy fn \u2014 internal/cbm/vendored/grammars/svelte/scanner.c:55", "shortDescription": {"text": "insecure use string copy fn \u2014 internal/cbm/vendored/grammars/svelte/scanner.c:55"}, "fullDescription": {"text": "Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm the size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer overflows, which can cause program crashes and potentially let an attacker inject code in the program. Fix this by using strcpy_s instead (although note that strcpy_s is an optional part of the C11 standard, and so may not be available).\n\nRule: c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-676: Use of Potentially Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-1f9f56d6c80ada59", "name": "insecure use string copy fn \u2014 internal/cbm/vendored/grammars/vim/scanner.c:89", "shortDescription": {"text": "insecure use string copy fn \u2014 internal/cbm/vendored/grammars/vim/scanner.c:89"}, "fullDescription": {"text": "Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm the size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer overflows, which can cause program crashes and potentially let an attacker inject code in the program. Fix this by using strcpy_s instead (although note that strcpy_s is an optional part of the C11 standard, and so may not be available).\n\nRule: c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-676: Use of Potentially Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-9e9802b80e0c485a", "name": "insecure use string copy fn \u2014 internal/cbm/vendored/grammars/vue/scanner.c:63", "shortDescription": {"text": "insecure use string copy fn \u2014 internal/cbm/vendored/grammars/vue/scanner.c:63"}, "fullDescription": {"text": "Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm the size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer overflows, which can cause program crashes and potentially let an attacker inject code in the program. Fix this by using strcpy_s instead (although note that strcpy_s is an optional part of the C11 standard, and so may not be available).\n\nRule: c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-676: Use of Potentially Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-5a8d787c1935b316", "name": "potential dos via decompression bomb \u2014 pkg/go/cmd/codebase-memory-mcp/main.go:454", "shortDescription": {"text": "potential dos via decompression bomb \u2014 pkg/go/cmd/codebase-memory-mcp/main.go:454"}, "fullDescription": {"text": "Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size.\n\nRule: go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-400: Uncontrolled Resource Consumption\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-c97fb3ff96225bd4", "name": "double free \u2014 src/cli/config_json_like.c:1650", "shortDescription": {"text": "double free \u2014 src/cli/config_json_like.c:1650"}, "fullDescription": {"text": "Variable 'temp_path' was freed twice. This can lead to undefined behavior.\n\nRule: c.lang.security.double-free.double-free\nSeverity: ERROR\nOWASP: A03:2021 - Injection, A01:2017 - Injection, A05:2025 - Injection\nCWE: CWE-415: Double Free\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.55}}, {"id": "scanner-d32d61ddef383d49", "name": "double free \u2014 src/cli/config_text_edit.c:662", "shortDescription": {"text": "double free \u2014 src/cli/config_text_edit.c:662"}, "fullDescription": {"text": "Variable 'temp_path' was freed twice. This can lead to undefined behavior.\n\nRule: c.lang.security.double-free.double-free\nSeverity: ERROR\nOWASP: A03:2021 - Injection, A01:2017 - Injection, A05:2025 - Injection\nCWE: CWE-415: Double Free\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.55}}, {"id": "scanner-dc15a535a889d08c", "name": "double free \u2014 src/daemon/ipc.c:4364", "shortDescription": {"text": "double free \u2014 src/daemon/ipc.c:4364"}, "fullDescription": {"text": "Variable 'parent_utf8' was freed twice. This can lead to undefined behavior.\n\nRule: c.lang.security.double-free.double-free\nSeverity: ERROR\nOWASP: A03:2021 - Injection, A01:2017 - Injection, A05:2025 - Injection\nCWE: CWE-415: Double Free\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.55}}, {"id": "scanner-f053a9ee9343d755", "name": "insecure use string copy fn \u2014 src/foundation/compat.c:143", "shortDescription": {"text": "insecure use string copy fn \u2014 src/foundation/compat.c:143"}, "fullDescription": {"text": "Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm the size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer overflows, which can cause program crashes and potentially let an attacker inject code in the program. Fix this by using strcpy_s instead (although note that strcpy_s is an optional part of the C11 standard, and so may not be available).\n\nRule: c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-676: Use of Potentially Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-b0c3a26657a9f78b", "name": "insecure use strcat fn \u2014 src/mcp/mcp.c:3188", "shortDescription": {"text": "insecure use strcat fn \u2014 src/mcp/mcp.c:3188"}, "fullDescription": {"text": "Finding triggers whenever there is a strcat or strncat used. This is an issue because strcat or strncat can lead to buffer overflow vulns. Fix this by using strcat_s instead.\n\nRule: c.lang.security.insecure-use-strcat-fn.insecure-use-strcat-fn\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-676: Use of Potentially Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-d0daa7d273ade76f", "name": "double free \u2014 src/mcp/mcp.c:10835", "shortDescription": {"text": "double free \u2014 src/mcp/mcp.c:10835"}, "fullDescription": {"text": "Variable 'srv->active_request_id_str' was freed twice. This can lead to undefined behavior.\n\nRule: c.lang.security.double-free.double-free\nSeverity: ERROR\nOWASP: A03:2021 - Injection, A01:2017 - Injection, A05:2025 - Injection\nCWE: CWE-415: Double Free\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.55}}, {"id": "scanner-bc811533e40e3bb3", "name": "use after free \u2014 src/pipeline/fqn.c:486", "shortDescription": {"text": "use after free \u2014 src/pipeline/fqn.c:486"}, "fullDescription": {"text": "Variable 'path' was used after being freed. This can lead to undefined behavior.\n\nRule: c.lang.security.use-after-free.use-after-free\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-416: Use After Free\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-c5c4658dfbc9a2ca", "name": "double free \u2014 src/pipeline/fqn.c:507", "shortDescription": {"text": "double free \u2014 src/pipeline/fqn.c:507"}, "fullDescription": {"text": "Variable 'path' was freed twice. This can lead to undefined behavior.\n\nRule: c.lang.security.double-free.double-free\nSeverity: ERROR\nOWASP: A03:2021 - Injection, A01:2017 - Injection, A05:2025 - Injection\nCWE: CWE-415: Double Free\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.55}}, {"id": "scanner-9f0757bdbc755246", "name": "insecure use string copy fn \u2014 src/pipeline/pass_envscan.c:262", "shortDescription": {"text": "insecure use string copy fn \u2014 src/pipeline/pass_envscan.c:262"}, "fullDescription": {"text": "Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm the size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer overflows, which can cause program crashes and potentially let an attacker inject code in the program. Fix this by using strcpy_s instead (although note that strcpy_s is an optional part of the C11 standard, and so may not be available).\n\nRule: c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-676: Use of Potentially Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-f141b4ba3e51d23f", "name": "insecure use strcat fn \u2014 src/store/store.c:3713", "shortDescription": {"text": "insecure use strcat fn \u2014 src/store/store.c:3713"}, "fullDescription": {"text": "Finding triggers whenever there is a strcat or strncat used. This is an issue because strcat or strncat can lead to buffer overflow vulns. Fix this by using strcat_s instead.\n\nRule: c.lang.security.insecure-use-strcat-fn.insecure-use-strcat-fn\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-676: Use of Potentially Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-544fbe9141c79771", "name": "insecure use string copy fn \u2014 src/store/store.c:4340", "shortDescription": {"text": "insecure use string copy fn \u2014 src/store/store.c:4340"}, "fullDescription": {"text": "Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm the size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer overflows, which can cause program crashes and potentially let an attacker inject code in the program. Fix this by using strcpy_s instead (although note that strcpy_s is an optional part of the C11 standard, and so may not be available).\n\nRule: c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-676: Use of Potentially Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-8e94493bc7976675", "name": "insecure use string copy fn \u2014 vendored/tre/regerror.c:75", "shortDescription": {"text": "insecure use string copy fn \u2014 vendored/tre/regerror.c:75"}, "fullDescription": {"text": "Finding triggers whenever there is a strcpy or strncpy used. This is an issue because strcpy does not affirm the size of the destination array and strncpy will not automatically NULL-terminate strings. This can lead to buffer overflows, which can cause program crashes and potentially let an attacker inject code in the program. Fix this by using strcpy_s instead (although note that strcpy_s is an optional part of the C11 standard, and so may not be available).\n\nRule: c.lang.security.insecure-use-string-copy-fn.insecure-use-string-copy-fn\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-676: Use of Potentially Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-f6cd08fa8d1eb4b0", "name": "Analyzer timeout: security.gitleaks", "shortDescription": {"text": "Analyzer timeout: security.gitleaks"}, "fullDescription": {"text": "analyzer exceeded 60.0s wall-clock (thread mode \u2014 daemon abandoned). Bump REPOBILITY_ANALYZER_TIMEOUT_S if expected."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b0803b104940210d", "name": "DS-0002: Image user should not be 'root' \u2014 pkg/glama/Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 pkg/glama/Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: pkg/glama/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-51de7e3b7b59e1d4", "name": "DS-0026: No HEALTHCHECK defined \u2014 pkg/glama/Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 pkg/glama/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: pkg/glama/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4ae2bf99fdea4e55", "name": "DS-0002: Image user should not be 'root' \u2014 test-infrastructure/Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 test-infrastructure/Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: test-infrastructure/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7658192422b6e591", "name": "DS-0026: No HEALTHCHECK defined \u2014 test-infrastructure/Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 test-infrastructure/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: test-infrastructure/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8dbf44434cd7a171", "name": "DS-0002: Image user should not be 'root' \u2014 test-infrastructure/Dockerfile.alpine", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 test-infrastructure/Dockerfile.alpine"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: test-infrastructure/Dockerfile.alpine"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0204a370aedfd2d0", "name": "DS-0026: No HEALTHCHECK defined \u2014 test-infrastructure/Dockerfile.alpine", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 test-infrastructure/Dockerfile.alpine"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: test-infrastructure/Dockerfile.alpine"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9ccd47821b905f0d", "name": "DS-0002: Image user should not be 'root' \u2014 test-infrastructure/Dockerfile.lint", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 test-infrastructure/Dockerfile.lint"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: test-infrastructure/Dockerfile.lint"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0f3b0f71724c5059", "name": "DS-0026: No HEALTHCHECK defined \u2014 test-infrastructure/Dockerfile.lint", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 test-infrastructure/Dockerfile.lint"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: test-infrastructure/Dockerfile.lint"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d157cad68f058ad0", "name": "DS-0002: Image user should not be 'root' \u2014 test-infrastructure/Dockerfile.mingw", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 test-infrastructure/Dockerfile.mingw"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: test-infrastructure/Dockerfile.mingw"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9ed5f236202cbdae", "name": "DS-0026: No HEALTHCHECK defined \u2014 test-infrastructure/Dockerfile.mingw", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 test-infrastructure/Dockerfile.mingw"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: test-infrastructure/Dockerfile.mingw"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4017c9d17c645b6a", "name": "Privileged port 17 in use", "shortDescription": {"text": "Privileged port 17 in use"}, "fullDescription": {"text": "Port 17 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f6c4fe4711e3c1ac", "name": "Privileged port 64 in use", "shortDescription": {"text": "Privileged port 64 in use"}, "fullDescription": {"text": "Port 64 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d412e984f8cf97cd", "name": "Dockerfile runs as root: pkg/glama/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: pkg/glama/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ae819cebb4ce38cf", "name": "Docker base image is tag-pinned but not digest-pinned: debian:bookworm-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: debian:bookworm-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-29eb12ced537e9e1", "name": "Dockerfile runs as root: test-infrastructure/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: test-infrastructure/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-151238137f3d72df", "name": "Insecure pattern 'subprocess_shell_true' in scripts/license-gate-check-npm.py:74", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in scripts/license-gate-check-npm.py:74"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-04cc7a0c9fa9c18b", "name": "Insecure pattern 'subprocess_shell_true' in scripts/gen-ui-licenses.py:72", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in scripts/gen-ui-licenses.py:72"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1c6a714bab53f24b", "name": "Insecure pattern 'cors_wildcard' in scripts/security-ui.sh:190", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in scripts/security-ui.sh:190"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5bbef6bba93cda5f", "name": "Insecure pattern 'eval_used' in scripts/security-install.sh:132", "shortDescription": {"text": "Insecure pattern 'eval_used' in scripts/security-install.sh:132"}, "fullDescription": {"text": "Found a known-risky pattern (eval_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b95eb53519243328", "name": "Insecure pattern 'exec_used' in scripts/security-install.sh:132", "shortDescription": {"text": "Insecure pattern 'exec_used' in scripts/security-install.sh:132"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-95eded6cb019fb93", "name": "Insecure pattern 'node_child_process' in pkg/npm/bin.js:8", "shortDescription": {"text": "Insecure pattern 'node_child_process' in pkg/npm/bin.js:8"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-64a4ddfd86556ba2", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-65a716a27d2be993", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3f332c9983e4778f", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-448d8837178ae57a", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1b0ecade8ad54a2b", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-20dea4d804ee2b04", "name": "Very large file: tests/test_daemon_smoke.py (2399 lines)", "shortDescription": {"text": "Very large file: tests/test_daemon_smoke.py (2399 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-37e053bb538d1d82", "name": "Very large file: tests/windows/test_windows_launcher.py (1586 lines)", "shortDescription": {"text": "Very large file: tests/windows/test_windows_launcher.py (1586 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d4f2f5f2033a4cbb", "name": "Very large file: scripts/smoke-test.sh (3361 lines)", "shortDescription": {"text": "Very large file: scripts/smoke-test.sh (3361 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8702b17cf17fe5e6", "name": "Node manifest has dependencies but no lockfile: tools/tree-sitter-form/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: tools/tree-sitter-form/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-edca6e4a1a636c58", "name": "Node manifest has dependencies but no lockfile: tools/tree-sitter-magma/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: tools/tree-sitter-magma/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 137 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 12 placeholder/mock markers across 5 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-04ab51f060a923e1", "name": "Fire-and-forget `fetch()` has no rejection handler \u2014 graph-ui/src/components/StatsTab.tsx:19", "shortDescription": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 graph-ui/src/components/StatsTab.tsx:19"}, "fullDescription": {"text": "This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-aad0c1784b7c16cb", "name": "Fire-and-forget `fetch()` has no rejection handler \u2014 graph-ui/src/components/GraphTab.tsx:249", "shortDescription": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 graph-ui/src/components/GraphTab.tsx:249"}, "fullDescription": {"text": "This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-6a30d49f9b165f97", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/audit-license-provenance.py:163", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/audit-license-provenance.py:163"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-4d57cf513a668262", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/license-gate-check-npm.py:74", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/license-gate-check-npm.py:74"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-49caf1b45da16b9f", "name": "Network/subprocess call without timeout or try/except \u2014 scripts/gen-ui-licenses.py:72", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/gen-ui-licenses.py:72"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-38751efedc63b043", "name": "Network/subprocess call without timeout or try/except \u2014 pkg/pypi/src/codebase_memory_mcp/_cli.py:529", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 pkg/pypi/src/codebase_memory_mcp/_cli.py:529"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-de10363b9dd11c07", "name": "Stub function `redirect_request` (body is just `pass`/`return`) \u2014 pkg/pypi/src/codebase_memory_mcp/_cli.py:42", "shortDescription": {"text": "Stub function `redirect_request` (body is just `pass`/`return`) \u2014 pkg/pypi/src/codebase_memory_mcp/_cli.py:42"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d365d23b005a6de", "name": "Dependency lucide-react is a major version behind", "shortDescription": {"text": "Dependency lucide-react is a major version behind"}, "fullDescription": {"text": "`lucide-react` is pinned at `0.577.0` in `graph-ui/package.json` while the latest release on the npm registry is `1.26.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `lucide-react` to `1.26.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}]}}, "automationDetails": {"id": "repobility/30776"}, "properties": {"repository": "DeusData/codebase-memory-mcp", "repoUrl": "https://github.com/DeusData/codebase-memory-mcp", "branch": "main"}, "results": [{"ruleId": "scanner-ffc7e4593b8d1cae", "level": "note", "message": {"text": "Possibly dead Python function: redirect_request"}, "properties": {"repobilityId": "95d749ff03fd48ea", "scanner": "scanner-primary", "fingerprint": "ffc7e4593b8d1cae", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/pypi/src/codebase_memory_mcp/_cli.py:42"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d63d0309feb08dba", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 graph-ui/src/App.tsx:108"}, "properties": {"repobilityId": "76a6150390a181ac", "scanner": "scanner-primary", "fingerprint": "d63d0309feb08dba", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "graph-ui/src/App.tsx"}, "region": {"startLine": 108}}}]}, {"ruleId": "scanner-bb269bd23d833411", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 graph-ui/src/components/NodeTooltip.tsx:29"}, "properties": {"repobilityId": "e84f50e55bc4f7b6", "scanner": "scanner-primary", "fingerprint": "bb269bd23d833411", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "graph-ui/src/components/NodeTooltip.tsx"}, "region": {"startLine": 29}}}]}, {"ruleId": "scanner-10731e396afee4eb", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 graph-ui/src/components/NodeDetailPanel.tsx:131"}, "properties": {"repobilityId": "15ad23a5c3756d3f", "scanner": "scanner-primary", "fingerprint": "10731e396afee4eb", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.button.no-label"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "graph-ui/src/components/NodeDetailPanel.tsx"}, "region": {"startLine": 131}}}]}, {"ruleId": "scanner-1c0b527d354183bb", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 graph-ui/src/components/NodeDetailPanel.tsx:122"}, "properties": {"repobilityId": "c5756b8883208c9e", "scanner": "scanner-primary", "fingerprint": "1c0b527d354183bb", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "graph-ui/src/components/NodeDetailPanel.tsx"}, "region": {"startLine": 122}}}]}, {"ruleId": "scanner-dafa1cd7706b356d", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 graph-ui/src/components/ControlTab.tsx:71"}, "properties": {"repobilityId": "52d52bb356230e33", "scanner": "scanner-primary", "fingerprint": "dafa1cd7706b356d", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "graph-ui/src/components/ControlTab.tsx"}, "region": {"startLine": 71}}}]}, {"ruleId": "scanner-9f90b2f36db758f2", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 graph-ui/src/components/ProjectCard.tsx:23"}, "properties": {"repobilityId": "5814dbaba6b06c00", "scanner": "scanner-primary", "fingerprint": "9f90b2f36db758f2", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "graph-ui/src/components/ProjectCard.tsx"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-2ceee333f9b2086d", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 graph-ui/src/components/StatsTab.tsx:394"}, "properties": {"repobilityId": "eb6b335734853aa6", "scanner": "scanner-primary", "fingerprint": "2ceee333f9b2086d", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "graph-ui/src/components/StatsTab.tsx"}, "region": {"startLine": 394}}}]}, {"ruleId": "scanner-1568a6de31a45ef2", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 graph-ui/src/components/Sidebar.tsx:84"}, "properties": {"repobilityId": "6c663e4ea3a8b891", "scanner": "scanner-primary", "fingerprint": "1568a6de31a45ef2", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "graph-ui/src/components/Sidebar.tsx"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-1b66908967610976", "level": "warning", "message": {"text": "insecure use strcat fn \u2014 internal/cbm/iris_export_xml.c:158"}, "properties": {"repobilityId": "4c6415566f1894ed", "scanner": "scanner-primary", "fingerprint": "1b66908967610976", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "internal/cbm/iris_export_xml.c"}, "region": {"startLine": 158}}}]}, {"ruleId": "scanner-4052b59218dd29ef", "level": "warning", "message": {"text": "insecure use string copy fn \u2014 internal/cbm/iris_export_xml.c:233"}, "properties": {"repobilityId": "35bd73a591a35b6d", "scanner": "scanner-primary", "fingerprint": "4052b59218dd29ef", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "internal/cbm/iris_export_xml.c"}, "region": {"startLine": 233}}}]}, {"ruleId": "scanner-ceedef7116d2df65", "level": "warning", "message": {"text": "insecure use string copy fn \u2014 internal/cbm/lsp/kotlin_lsp.c:1541"}, "properties": {"repobilityId": "fd28d2236b23821f", "scanner": "scanner-primary", "fingerprint": "ceedef7116d2df65", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "internal/cbm/lsp/kotlin_lsp.c"}, "region": {"startLine": 1541}}}]}, {"ruleId": "scanner-b475e4b0c8675d60", "level": "warning", "message": {"text": "insecure use strcat fn \u2014 internal/cbm/lsp/kotlin_lsp.c:1542"}, "properties": {"repobilityId": "45ed4874c93dd95f", "scanner": "scanner-primary", "fingerprint": "b475e4b0c8675d60", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "internal/cbm/lsp/kotlin_lsp.c"}, "region": {"startLine": 1542}}}]}, {"ruleId": "scanner-82bf6dc5a70dad68", "level": "warning", "message": {"text": "insecure use string copy fn \u2014 internal/cbm/lsp/py_lsp.c:2078"}, "properties": {"repobilityId": "71f43f5630c131aa", "scanner": "scanner-primary", "fingerprint": "82bf6dc5a70dad68", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "internal/cbm/lsp/py_lsp.c"}, "region": {"startLine": 2078}}}]}, {"ruleId": "scanner-221bfb19bcac277d", "level": "warning", "message": {"text": "insecure use string copy fn \u2014 internal/cbm/vendored/grammars/astro/scanner.c:57"}, "properties": {"repobilityId": "ede74f2c6cd2e9f1", "scanner": "scanner-primary", "fingerprint": "221bfb19bcac277d", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "internal/cbm/vendored/grammars/astro/scanner.c"}, "region": {"startLine": 57}}}]}, {"ruleId": "scanner-b1fb9d4553776940", "level": "warning", "message": {"text": "insecure use string copy fn \u2014 internal/cbm/vendored/grammars/blade/scanner.c:53"}, "properties": {"repobilityId": "d5ce87ccbdcb1860", "scanner": "scanner-primary", "fingerprint": "b1fb9d4553776940", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "internal/cbm/vendored/grammars/blade/scanner.c"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-db0d27d180e4ac2c", "level": "warning", "message": {"text": "use after free \u2014 internal/cbm/vendored/grammars/dockerfile/scanner.c:253"}, "properties": {"repobilityId": "013720f57df22ba1", "scanner": "scanner-primary", "fingerprint": "db0d27d180e4ac2c", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "internal/cbm/vendored/grammars/dockerfile/scanner.c"}, "region": {"startLine": 253}}}]}, {"ruleId": "scanner-cdd0e3196f96c8df", "level": "warning", "message": {"text": "insecure use string copy fn \u2014 internal/cbm/vendored/grammars/html/scanner.c:48"}, "properties": {"repobilityId": "73b7465d1cdc0649", "scanner": "scanner-primary", "fingerprint": "cdd0e3196f96c8df", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "internal/cbm/vendored/grammars/html/scanner.c"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-c37b587c2feb0c7b", "level": "warning", "message": {"text": "insecure use string copy fn \u2014 internal/cbm/vendored/grammars/objectscript_routine/objectscript_common.h:97"}, "properties": {"repobilityId": "9d53097d9875b9a3", "scanner": "scanner-primary", "fingerprint": "c37b587c2feb0c7b", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "internal/cbm/vendored/grammars/objectscript_routine/objectscript_common.h"}, "region": {"startLine": 97}}}]}, {"ruleId": "scanner-be9f36b0e21d728e", "level": "warning", "message": {"text": "insecure use string copy fn \u2014 internal/cbm/vendored/grammars/objectscript_udl/objectscript_common.h:97"}, "properties": {"repobilityId": "9830d97afd02d178", "scanner": "scanner-primary", "fingerprint": "be9f36b0e21d728e", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "internal/cbm/vendored/grammars/objectscript_udl/objectscript_common.h"}, "region": {"startLine": 97}}}]}, {"ruleId": "scanner-1b37326117a9ae16", "level": "warning", "message": {"text": "insecure use strcat fn \u2014 internal/cbm/vendored/grammars/scala/scanner.c:251"}, "properties": {"repobilityId": "5cdb33ad38248706", "scanner": "scanner-primary", "fingerprint": "1b37326117a9ae16", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "internal/cbm/vendored/grammars/scala/scanner.c"}, "region": {"startLine": 251}}}]}, {"ruleId": "scanner-37522a3d08bca25a", "level": "warning", "message": {"text": "insecure use string copy fn \u2014 internal/cbm/vendored/grammars/sql/scanner.c:43"}, "properties": {"repobilityId": "3969e657966ec9f6", "scanner": "scanner-primary", "fingerprint": "37522a3d08bca25a", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "internal/cbm/vendored/grammars/sql/scanner.c"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-c7fd71637dbf7216", "level": "warning", "message": {"text": "insecure use string copy fn \u2014 internal/cbm/vendored/grammars/svelte/scanner.c:55"}, "properties": {"repobilityId": "de83cf391234db19", "scanner": "scanner-primary", "fingerprint": "c7fd71637dbf7216", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "internal/cbm/vendored/grammars/svelte/scanner.c"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-1f9f56d6c80ada59", "level": "warning", "message": {"text": "insecure use string copy fn \u2014 internal/cbm/vendored/grammars/vim/scanner.c:89"}, "properties": {"repobilityId": "e88019a01ad20f63", "scanner": "scanner-primary", "fingerprint": "1f9f56d6c80ada59", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "internal/cbm/vendored/grammars/vim/scanner.c"}, "region": {"startLine": 89}}}]}, {"ruleId": "scanner-9e9802b80e0c485a", "level": "warning", "message": {"text": "insecure use string copy fn \u2014 internal/cbm/vendored/grammars/vue/scanner.c:63"}, "properties": {"repobilityId": "5da5f3ce16de3bdd", "scanner": "scanner-primary", "fingerprint": "9e9802b80e0c485a", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "internal/cbm/vendored/grammars/vue/scanner.c"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-5a8d787c1935b316", "level": "warning", "message": {"text": "potential dos via decompression bomb \u2014 pkg/go/cmd/codebase-memory-mcp/main.go:454"}, "properties": {"repobilityId": "9d9b1f44c0a90dbc", "scanner": "scanner-primary", "fingerprint": "5a8d787c1935b316", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/go/cmd/codebase-memory-mcp/main.go"}, "region": {"startLine": 454}}}]}, {"ruleId": "scanner-c97fb3ff96225bd4", "level": "error", "message": {"text": "double free \u2014 src/cli/config_json_like.c:1650"}, "properties": {"repobilityId": "19359a907dc536a3", "scanner": "scanner-primary", "fingerprint": "c97fb3ff96225bd4", "layer": "security", "severity": "high", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/cli/config_json_like.c"}, "region": {"startLine": 1650}}}]}, {"ruleId": "scanner-d32d61ddef383d49", "level": "error", "message": {"text": "double free \u2014 src/cli/config_text_edit.c:662"}, "properties": {"repobilityId": "fe3f98ad0a09d12e", "scanner": "scanner-primary", "fingerprint": "d32d61ddef383d49", "layer": "security", "severity": "high", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/cli/config_text_edit.c"}, "region": {"startLine": 662}}}]}, {"ruleId": "scanner-dc15a535a889d08c", "level": "error", "message": {"text": "double free \u2014 src/daemon/ipc.c:4364"}, "properties": {"repobilityId": "6525e5326d0634bd", "scanner": "scanner-primary", "fingerprint": "dc15a535a889d08c", "layer": "security", "severity": "high", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/daemon/ipc.c"}, "region": {"startLine": 4364}}}]}, {"ruleId": "scanner-f053a9ee9343d755", "level": "warning", "message": {"text": "insecure use string copy fn \u2014 src/foundation/compat.c:143"}, "properties": {"repobilityId": "c98bd9c09bfb0273", "scanner": "scanner-primary", "fingerprint": "f053a9ee9343d755", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/foundation/compat.c"}, "region": {"startLine": 143}}}]}, {"ruleId": "scanner-b0c3a26657a9f78b", "level": "warning", "message": {"text": "insecure use strcat fn \u2014 src/mcp/mcp.c:3188"}, "properties": {"repobilityId": "d261a21f63a071bb", "scanner": "scanner-primary", "fingerprint": "b0c3a26657a9f78b", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/mcp/mcp.c"}, "region": {"startLine": 3188}}}]}, {"ruleId": "scanner-d0daa7d273ade76f", "level": "error", "message": {"text": "double free \u2014 src/mcp/mcp.c:10835"}, "properties": {"repobilityId": "7d38b0225cf89060", "scanner": "scanner-primary", "fingerprint": "d0daa7d273ade76f", "layer": "security", "severity": "high", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/mcp/mcp.c"}, "region": {"startLine": 10835}}}]}, {"ruleId": "scanner-bc811533e40e3bb3", "level": "warning", "message": {"text": "use after free \u2014 src/pipeline/fqn.c:486"}, "properties": {"repobilityId": "d8d4469bdd7b0122", "scanner": "scanner-primary", "fingerprint": "bc811533e40e3bb3", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/pipeline/fqn.c"}, "region": {"startLine": 486}}}]}, {"ruleId": "scanner-c5c4658dfbc9a2ca", "level": "error", "message": {"text": "double free \u2014 src/pipeline/fqn.c:507"}, "properties": {"repobilityId": "5366976fc3fc4dad", "scanner": "scanner-primary", "fingerprint": "c5c4658dfbc9a2ca", "layer": "security", "severity": "high", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/pipeline/fqn.c"}, "region": {"startLine": 507}}}]}, {"ruleId": "scanner-9f0757bdbc755246", "level": "warning", "message": {"text": "insecure use string copy fn \u2014 src/pipeline/pass_envscan.c:262"}, "properties": {"repobilityId": "74ca4a27577f295f", "scanner": "scanner-primary", "fingerprint": "9f0757bdbc755246", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/pipeline/pass_envscan.c"}, "region": {"startLine": 262}}}]}, {"ruleId": "scanner-f141b4ba3e51d23f", "level": "warning", "message": {"text": "insecure use strcat fn \u2014 src/store/store.c:3713"}, "properties": {"repobilityId": "fc38bff2de7cbf01", "scanner": "scanner-primary", "fingerprint": "f141b4ba3e51d23f", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/store/store.c"}, "region": {"startLine": 3713}}}]}, {"ruleId": "scanner-544fbe9141c79771", "level": "warning", "message": {"text": "insecure use string copy fn \u2014 src/store/store.c:4340"}, "properties": {"repobilityId": "0fb062eb5479d15e", "scanner": "scanner-primary", "fingerprint": "544fbe9141c79771", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/store/store.c"}, "region": {"startLine": 4340}}}]}, {"ruleId": "scanner-8e94493bc7976675", "level": "warning", "message": {"text": "insecure use string copy fn \u2014 vendored/tre/regerror.c:75"}, "properties": {"repobilityId": "863540e31d4d5695", "scanner": "scanner-primary", "fingerprint": "8e94493bc7976675", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "c"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "vendored/tre/regerror.c"}, "region": {"startLine": 75}}}]}, {"ruleId": "scanner-f6cd08fa8d1eb4b0", "level": "warning", "message": {"text": "Analyzer timeout: security.gitleaks"}, "properties": {"repobilityId": "err::timeout::security.gitleaks", "scanner": "scanner-primary", "fingerprint": "f6cd08fa8d1eb4b0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["analyzer-error", "timeout"]}}, {"ruleId": "scanner-b0803b104940210d", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 pkg/glama/Dockerfile"}, "properties": {"repobilityId": "e7dd1f26b8c4ec7f", "scanner": "scanner-primary", "fingerprint": "b0803b104940210d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-51de7e3b7b59e1d4", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 pkg/glama/Dockerfile"}, "properties": {"repobilityId": "5b2c3053a354f96c", "scanner": "scanner-primary", "fingerprint": "51de7e3b7b59e1d4", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-4ae2bf99fdea4e55", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 test-infrastructure/Dockerfile"}, "properties": {"repobilityId": "32c0c2463d93a561", "scanner": "scanner-primary", "fingerprint": "4ae2bf99fdea4e55", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-7658192422b6e591", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 test-infrastructure/Dockerfile"}, "properties": {"repobilityId": "c292c38cefa82000", "scanner": "scanner-primary", "fingerprint": "7658192422b6e591", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-8dbf44434cd7a171", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 test-infrastructure/Dockerfile.alpine"}, "properties": {"repobilityId": "27e67be426c8bd2b", "scanner": "scanner-primary", "fingerprint": "8dbf44434cd7a171", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-0204a370aedfd2d0", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 test-infrastructure/Dockerfile.alpine"}, "properties": {"repobilityId": "2cec9225cb44a8ff", "scanner": "scanner-primary", "fingerprint": "0204a370aedfd2d0", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-9ccd47821b905f0d", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 test-infrastructure/Dockerfile.lint"}, "properties": {"repobilityId": "c6135740cbeb1115", "scanner": "scanner-primary", "fingerprint": "9ccd47821b905f0d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-0f3b0f71724c5059", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 test-infrastructure/Dockerfile.lint"}, "properties": {"repobilityId": "e81e87853275d23f", "scanner": "scanner-primary", "fingerprint": "0f3b0f71724c5059", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-d157cad68f058ad0", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 test-infrastructure/Dockerfile.mingw"}, "properties": {"repobilityId": "c76af114887adef8", "scanner": "scanner-primary", "fingerprint": "d157cad68f058ad0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-9ed5f236202cbdae", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 test-infrastructure/Dockerfile.mingw"}, "properties": {"repobilityId": "1e39e6f6740469e0", "scanner": "scanner-primary", "fingerprint": "9ed5f236202cbdae", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-4017c9d17c645b6a", "level": "warning", "message": {"text": "Privileged port 17 in use"}, "properties": {"repobilityId": "0bf38fb8f89ec589", "scanner": "scanner-primary", "fingerprint": "4017c9d17c645b6a", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/stale.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f6c4fe4711e3c1ac", "level": "warning", "message": {"text": "Privileged port 64 in use"}, "properties": {"repobilityId": "be19cd18e8b66910", "scanner": "scanner-primary", "fingerprint": "f6c4fe4711e3c1ac", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/smoke.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d412e984f8cf97cd", "level": "warning", "message": {"text": "Dockerfile runs as root: pkg/glama/Dockerfile"}, "properties": {"repobilityId": "9a67d44f7f2761a2", "scanner": "scanner-primary", "fingerprint": "d412e984f8cf97cd", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-ae819cebb4ce38cf", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: debian:bookworm-slim"}, "properties": {"repobilityId": "d001ee59d8d4deb0", "scanner": "scanner-primary", "fingerprint": "ae819cebb4ce38cf", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/glama/Dockerfile"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-29eb12ced537e9e1", "level": "warning", "message": {"text": "Dockerfile runs as root: test-infrastructure/Dockerfile"}, "properties": {"repobilityId": "3775e3fcdfb2e2f9", "scanner": "scanner-primary", "fingerprint": "29eb12ced537e9e1", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-151238137f3d72df", "level": "error", "message": {"text": "Insecure pattern 'subprocess_shell_true' in scripts/license-gate-check-npm.py:74"}, "properties": {"repobilityId": "2ed0178a86e02fb5", "scanner": "scanner-primary", "fingerprint": "151238137f3d72df", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/license-gate-check-npm.py"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-04cc7a0c9fa9c18b", "level": "error", "message": {"text": "Insecure pattern 'subprocess_shell_true' in scripts/gen-ui-licenses.py:72"}, "properties": {"repobilityId": "93bcda64d55ed781", "scanner": "scanner-primary", "fingerprint": "04cc7a0c9fa9c18b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/gen-ui-licenses.py"}, "region": {"startLine": 72}}}]}, {"ruleId": "scanner-1c6a714bab53f24b", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in scripts/security-ui.sh:190"}, "properties": {"repobilityId": "46f7467f88d1ca9e", "scanner": "scanner-primary", "fingerprint": "1c6a714bab53f24b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/security-ui.sh"}, "region": {"startLine": 190}}}]}, {"ruleId": "scanner-5bbef6bba93cda5f", "level": "error", "message": {"text": "Insecure pattern 'eval_used' in scripts/security-install.sh:132"}, "properties": {"repobilityId": "ed3e5c40d31b798e", "scanner": "scanner-primary", "fingerprint": "5bbef6bba93cda5f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "eval_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/security-install.sh"}, "region": {"startLine": 132}}}]}, {"ruleId": "scanner-b95eb53519243328", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in scripts/security-install.sh:132"}, "properties": {"repobilityId": "34351c9e602adab4", "scanner": "scanner-primary", "fingerprint": "b95eb53519243328", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/security-install.sh"}, "region": {"startLine": 132}}}]}, {"ruleId": "scanner-95eded6cb019fb93", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in pkg/npm/bin.js:8"}, "properties": {"repobilityId": "a851734753325a81", "scanner": "scanner-primary", "fingerprint": "95eded6cb019fb93", "layer": "security", "severity": "medium", "confidence": 0.8, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/npm/bin.js"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-64a4ddfd86556ba2", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "09b149451955c342", "scanner": "scanner-primary", "fingerprint": "64a4ddfd86556ba2", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/_build.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-65a716a27d2be993", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "3133a88ce98acc76", "scanner": "scanner-primary", "fingerprint": "65a716a27d2be993", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/scorecard.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3f332c9983e4778f", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "6fcdf988bbb81956", "scanner": "scanner-primary", "fingerprint": "3f332c9983e4778f", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/dry-run.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-448d8837178ae57a", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "13af6451e15656fc", "scanner": "scanner-primary", "fingerprint": "448d8837178ae57a", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pages.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1b0ecade8ad54a2b", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "60b96f826d0b6aaf", "scanner": "scanner-primary", "fingerprint": "1b0ecade8ad54a2b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/npm/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-20dea4d804ee2b04", "level": "note", "message": {"text": "Very large file: tests/test_daemon_smoke.py (2399 lines)"}, "properties": {"repobilityId": "eea8e72078572d90", "scanner": "scanner-primary", "fingerprint": "20dea4d804ee2b04", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-37e053bb538d1d82", "level": "note", "message": {"text": "Very large file: tests/windows/test_windows_launcher.py (1586 lines)"}, "properties": {"repobilityId": "1093367314ea45d1", "scanner": "scanner-primary", "fingerprint": "37e053bb538d1d82", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d4f2f5f2033a4cbb", "level": "note", "message": {"text": "Very large file: scripts/smoke-test.sh (3361 lines)"}, "properties": {"repobilityId": "04a3bfaa5e034d86", "scanner": "scanner-primary", "fingerprint": "d4f2f5f2033a4cbb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8702b17cf17fe5e6", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: tools/tree-sitter-form/package.json"}, "properties": {"repobilityId": "f5d830ec450414d2", "scanner": "scanner-primary", "fingerprint": "8702b17cf17fe5e6", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/tree-sitter-form/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-edca6e4a1a636c58", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: tools/tree-sitter-magma/package.json"}, "properties": {"repobilityId": "59eb4eca3fc4ee83", "scanner": "scanner-primary", "fingerprint": "edca6e4a1a636c58", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/tree-sitter-magma/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "f24131f3f18dc13e", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "9c297a5d4a0bb296", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-04ab51f060a923e1", "level": "warning", "message": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 graph-ui/src/components/StatsTab.tsx:19"}, "properties": {"repobilityId": "0c8b3729d58b3730", "scanner": "scanner-primary", "fingerprint": "04ab51f060a923e1", "layer": "quality", "severity": "medium", "confidence": 0.9, "tags": ["integrity", "fragile-runtime", "robustness", "unhandled-promise"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "graph-ui/src/components/StatsTab.tsx"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-aad0c1784b7c16cb", "level": "warning", "message": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 graph-ui/src/components/GraphTab.tsx:249"}, "properties": {"repobilityId": "007238f606b3896e", "scanner": "scanner-primary", "fingerprint": "aad0c1784b7c16cb", "layer": "quality", "severity": "medium", "confidence": 0.9, "tags": ["integrity", "fragile-runtime", "robustness", "unhandled-promise"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "graph-ui/src/components/GraphTab.tsx"}, "region": {"startLine": 249}}}]}, {"ruleId": "scanner-6a30d49f9b165f97", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/audit-license-provenance.py:163"}, "properties": {"repobilityId": "b515065fe228a1f6", "scanner": "scanner-primary", "fingerprint": "6a30d49f9b165f97", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/audit-license-provenance.py"}, "region": {"startLine": 163}}}]}, {"ruleId": "scanner-4d57cf513a668262", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/license-gate-check-npm.py:74"}, "properties": {"repobilityId": "a59342bad17e401c", "scanner": "scanner-primary", "fingerprint": "4d57cf513a668262", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/license-gate-check-npm.py"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-49caf1b45da16b9f", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 scripts/gen-ui-licenses.py:72"}, "properties": {"repobilityId": "8a4ec8e766b690d0", "scanner": "scanner-primary", "fingerprint": "49caf1b45da16b9f", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/gen-ui-licenses.py"}, "region": {"startLine": 72}}}]}, {"ruleId": "scanner-38751efedc63b043", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 pkg/pypi/src/codebase_memory_mcp/_cli.py:529"}, "properties": {"repobilityId": "cf78b035ea4e36c2", "scanner": "scanner-primary", "fingerprint": "38751efedc63b043", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "pkg/pypi/src/codebase_memory_mcp/_cli.py"}, "region": {"startLine": 529}}}]}, {"ruleId": "scanner-de10363b9dd11c07", "level": "note", "message": {"text": "Stub function `redirect_request` (body is just `pass`/`return`) \u2014 pkg/pypi/src/codebase_memory_mcp/_cli.py:42"}, "properties": {"repobilityId": "4ca32e91495204a4", "scanner": "scanner-primary", "fingerprint": "de10363b9dd11c07", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-2d365d23b005a6de", "level": "note", "message": {"text": "Dependency lucide-react is a major version behind"}, "properties": {"repobilityId": "90298e8a8c8baca1", "scanner": "scanner-primary", "fingerprint": "2d365d23b005a6de", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "graph-ui/package.json"}, "region": {"startLine": 1}}}]}]}]}