{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-259f9678ccee44f8", "name": "Stray `console.log` in TS/JS \u2014 generate-infographic.js:41", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 generate-infographic.js:41"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b41b2766e5441932", "name": "Stray `console.log` in TS/JS \u2014 tools/run-migration.js:39", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 tools/run-migration.js:39"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-56d0cafc100db78b", "name": "Stray `console.log` in TS/JS \u2014 tools/setup-demo-db.js:21", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 tools/setup-demo-db.js:21"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1478c87988adc136", "name": "Stray `console.log` in TS/JS \u2014 conformance/conformance.test.js:52", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 conformance/conformance.test.js:52"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-efa96552e0d587bb", "name": "Stray `console.log` in TS/JS \u2014 conformance/north-star.test.js:78", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 conformance/north-star.test.js:78"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e212d0c5ea49c8ca", "name": "Stray `console.log` in TS/JS \u2014 docs/reference/generate-test-vectors.js:84", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 docs/reference/generate-test-vectors.js:84"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1274bc74908470d5", "name": "Stray `console.log` in TS/JS \u2014 docs/reference/gen-keypair.js:8", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 docs/reference/gen-keypair.js:8"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-28c18de4b20c653a", "name": "Stray `console.log` in TS/JS \u2014 docs/reference/test-basic.js:11", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 docs/reference/test-basic.js:11"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aadb56eb7c4ea339", "name": "Stray `console.log` in TS/JS \u2014 twitter-bot/post.js:30", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 twitter-bot/post.js:30"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7d4f96e72a4a44a2", "name": "Stray `console.log` in TS/JS \u2014 twitter-bot/oauth-setup.js:36", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 twitter-bot/oauth-setup.js:36"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5eb2902ccc784f4a", "name": "Stray `console.log` in TS/JS \u2014 twitter-bot/thread.js:36", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 twitter-bot/thread.js:36"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7d6e10f2317897a1", "name": "Stray `console.log` in TS/JS \u2014 test/conformance.js:273", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 test/conformance.js:273"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-09efd940923a9cd3", "name": "Dockerfile runs as root: tools/ambassador/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: tools/ambassador/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0e52bda18f07086a", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-08ec6144ce40e670", "name": "Insecure pattern 'direct_innerhtml_assignment' in conformance.html:192", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in conformance.html:192"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b816764f2949a97e", "name": "Insecure pattern 'direct_innerhtml_assignment' in spec.html:235", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in spec.html:235"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4bb5e786fa9b7bca", "name": "Insecure pattern 'direct_innerhtml_assignment' in index.html:1680", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in index.html:1680"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c13fffca5d9d520d", "name": "Insecure pattern 'direct_innerhtml_assignment' in security.html:192", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in security.html:192"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f3da801c424aaa89", "name": "Insecure pattern 'direct_innerhtml_assignment' in widget.js:106", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in widget.js:106"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-37f52b23587cebc1", "name": "Insecure pattern 'direct_innerhtml_assignment' in validate.html:797", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in validate.html:797"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dcf95d953c2df073", "name": "Insecure pattern 'direct_innerhtml_assignment' in federation.html:192", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in federation.html:192"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea84c81bd4796293", "name": "Insecure pattern 'cors_wildcard' in api/well-known-airc.js:13", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in api/well-known-airc.js:13"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-73956acdaa5531a0", "name": "Insecure pattern 'cors_wildcard' in api/health.js:14", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in api/health.js:14"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1eb306051d5d0028", "name": "Insecure pattern 'cors_wildcard' in api/register.js:5", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in api/register.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ac5a09cd62e42fbe", "name": "Insecure pattern 'cors_wildcard' in api/lib/utils.js:88", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in api/lib/utils.js:88"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f4d0d27176e95379", "name": "Insecure pattern 'direct_innerhtml_assignment' in tools/ambassador/server.py:399", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in tools/ambassador/server.py:399"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f0df75737aa1514a", "name": "Insecure pattern 'cors_wildcard' in tools/ambassador/server.py:62", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in tools/ambassador/server.py:62"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c3cfda7ccf3e23e8", "name": "Insecure pattern 'direct_innerhtml_assignment' in tools/ambassador/widget.html:377", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in tools/ambassador/widget.html:377"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "5 tests / 33 src (ratio 0.15)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 148 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1ab96ddc57c362a1", "name": "Agent authority lacks a verifier contract: openclaw/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: openclaw/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5f033056518995a6", "name": "Agent authority lacks a verifier contract: airc-channel/.mcp.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: airc-channel/.mcp.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ecb0d2c55ed6875d", "name": "Agent authority lacks a verifier contract: .claude/settings.local.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.local.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5bd0b54f00427d1b", "name": "`fetch()` without try/.catch or AbortSignal \u2014 generate-infographic.js:43", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 generate-infographic.js:43"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b49ed34fda813e96", "name": "`fetch()` without try/.catch or AbortSignal \u2014 widget.js:229", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 widget.js:229"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e74130ac47dd33b8", "name": "`fetch()` without try/.catch or AbortSignal \u2014 conformance/conformance.test.js:23", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 conformance/conformance.test.js:23"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c53e82b9293bf36e", "name": "`fetch()` without try/.catch or AbortSignal \u2014 airc-channel/server.ts:216", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 airc-channel/server.ts:216"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d29d335520749b48", "name": "FastAPI POST `chat` without auth dependency \u2014 tools/ambassador/server.py:97", "shortDescription": {"text": "FastAPI POST `chat` without auth dependency \u2014 tools/ambassador/server.py:97"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e9726044491791e6", "name": "Dangling fetch: POST https://generativelanguage.googleapis.com/v1beta/models/${MODEL}:generateImages?key=${API_KEY} (gen", "shortDescription": {"text": "Dangling fetch: POST https://generativelanguage.googleapis.com/v1beta/models/${MODEL}:generateImages?key=${API_KEY} (generate-infographic.js:43)"}, "fullDescription": {"text": "`generate-infographic.js:43` calls `POST https://generativelanguage.googleapis.com/v1beta/models/${MODEL}:generateImages?key=${API_KEY}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/generativelanguage.googleapis.com/v1beta/models/<p>/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9d2517f9eafc5297", "name": "Unused endpoint: POST /api/chat", "shortDescription": {"text": "Unused endpoint: POST /api/chat"}, "fullDescription": {"text": "`tools/ambassador/server.py` declares `POST /api/chat` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-05d46f103a343922", "name": "Unused endpoint: GET /api/feed", "shortDescription": {"text": "Unused endpoint: GET /api/feed"}, "fullDescription": {"text": "`tools/ambassador/server.py` declares `GET /api/feed` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`tools/ambassador/server.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-314ec2b8e925e4eb", "name": "Unused endpoint: GET /embed", "shortDescription": {"text": "Unused endpoint: GET /embed"}, "fullDescription": {"text": "`tools/ambassador/server.py` declares `GET /embed` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49b9e3c80d293cfb", "name": "Unused endpoint: GET /embed.js", "shortDescription": {"text": "Unused endpoint: GET /embed.js"}, "fullDescription": {"text": "`tools/ambassador/server.py` declares `GET /embed.js` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/24719"}, "properties": {"repository": "brightseth/airc", "repoUrl": "https://github.com/brightseth/airc", "branch": "main"}, "results": [{"ruleId": "scanner-259f9678ccee44f8", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 generate-infographic.js:41"}, "properties": {"repobilityId": "93df1bafd66ceff0", "scanner": "scanner-primary", "fingerprint": "259f9678ccee44f8", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b41b2766e5441932", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 tools/run-migration.js:39"}, "properties": {"repobilityId": "342197e30c294a76", "scanner": "scanner-primary", "fingerprint": "b41b2766e5441932", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-56d0cafc100db78b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 tools/setup-demo-db.js:21"}, "properties": {"repobilityId": "64b6a355afe24e12", "scanner": "scanner-primary", "fingerprint": "56d0cafc100db78b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1478c87988adc136", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 conformance/conformance.test.js:52"}, "properties": {"repobilityId": "01a010496bf8a83b", "scanner": "scanner-primary", "fingerprint": "1478c87988adc136", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-efa96552e0d587bb", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 conformance/north-star.test.js:78"}, "properties": {"repobilityId": "72dd1684994ae2d3", "scanner": "scanner-primary", "fingerprint": "efa96552e0d587bb", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e212d0c5ea49c8ca", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 docs/reference/generate-test-vectors.js:84"}, "properties": {"repobilityId": "afd8a925b68e97f9", "scanner": "scanner-primary", "fingerprint": "e212d0c5ea49c8ca", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1274bc74908470d5", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 docs/reference/gen-keypair.js:8"}, "properties": {"repobilityId": "16583216db4d44f4", "scanner": "scanner-primary", "fingerprint": "1274bc74908470d5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-28c18de4b20c653a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 docs/reference/test-basic.js:11"}, "properties": {"repobilityId": "c806267624009fe7", "scanner": "scanner-primary", "fingerprint": "28c18de4b20c653a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-aadb56eb7c4ea339", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 twitter-bot/post.js:30"}, "properties": {"repobilityId": "04844e3679da990b", "scanner": "scanner-primary", "fingerprint": "aadb56eb7c4ea339", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7d4f96e72a4a44a2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 twitter-bot/oauth-setup.js:36"}, "properties": {"repobilityId": "7ec2b4282dd96634", "scanner": "scanner-primary", "fingerprint": "7d4f96e72a4a44a2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5eb2902ccc784f4a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 twitter-bot/thread.js:36"}, "properties": {"repobilityId": "a15185c068035e7e", "scanner": "scanner-primary", "fingerprint": "5eb2902ccc784f4a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7d6e10f2317897a1", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 test/conformance.js:273"}, "properties": {"repobilityId": "f1de6dd947018103", "scanner": "scanner-primary", "fingerprint": "7d6e10f2317897a1", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-09efd940923a9cd3", "level": "warning", "message": {"text": "Dockerfile runs as root: tools/ambassador/Dockerfile"}, "properties": {"repobilityId": "7c9308a9326bfef9", "scanner": "scanner-primary", "fingerprint": "09efd940923a9cd3", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-0e52bda18f07086a", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "85ee26b827152fac", "scanner": "scanner-primary", "fingerprint": "0e52bda18f07086a", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/ambassador/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-08ec6144ce40e670", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in conformance.html:192"}, "properties": {"repobilityId": "d38b1adfb3f4b1d0", "scanner": "scanner-primary", "fingerprint": "08ec6144ce40e670", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "conformance.html"}, "region": {"startLine": 192}}}]}, {"ruleId": "scanner-b816764f2949a97e", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in spec.html:235"}, "properties": {"repobilityId": "03ffe78df87f075e", "scanner": "scanner-primary", "fingerprint": "b816764f2949a97e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "spec.html"}, "region": {"startLine": 235}}}]}, {"ruleId": "scanner-4bb5e786fa9b7bca", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in index.html:1680"}, "properties": {"repobilityId": "f91708437a3a5445", "scanner": "scanner-primary", "fingerprint": "4bb5e786fa9b7bca", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "index.html"}, "region": {"startLine": 1680}}}]}, {"ruleId": "scanner-c13fffca5d9d520d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in security.html:192"}, "properties": {"repobilityId": "3537b3bbaa19d879", "scanner": "scanner-primary", "fingerprint": "c13fffca5d9d520d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "security.html"}, "region": {"startLine": 192}}}]}, {"ruleId": "scanner-f3da801c424aaa89", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in widget.js:106"}, "properties": {"repobilityId": "8134ed963c042a3e", "scanner": "scanner-primary", "fingerprint": "f3da801c424aaa89", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "widget.js"}, "region": {"startLine": 106}}}]}, {"ruleId": "scanner-37f52b23587cebc1", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in validate.html:797"}, "properties": {"repobilityId": "f4204fe0887ea67a", "scanner": "scanner-primary", "fingerprint": "37f52b23587cebc1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "validate.html"}, "region": {"startLine": 797}}}]}, {"ruleId": "scanner-dcf95d953c2df073", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in federation.html:192"}, "properties": {"repobilityId": "536f2abbf4d0e2c4", "scanner": "scanner-primary", "fingerprint": "dcf95d953c2df073", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "federation.html"}, "region": {"startLine": 192}}}]}, {"ruleId": "scanner-ea84c81bd4796293", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in api/well-known-airc.js:13"}, "properties": {"repobilityId": "728524c86735dcbf", "scanner": "scanner-primary", "fingerprint": "ea84c81bd4796293", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/well-known-airc.js"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-73956acdaa5531a0", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in api/health.js:14"}, "properties": {"repobilityId": "0f32033d51d457e0", "scanner": "scanner-primary", "fingerprint": "73956acdaa5531a0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/health.js"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-1eb306051d5d0028", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in api/register.js:5"}, "properties": {"repobilityId": "01e5b417b33679c1", "scanner": "scanner-primary", "fingerprint": "1eb306051d5d0028", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/register.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-ac5a09cd62e42fbe", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in api/lib/utils.js:88"}, "properties": {"repobilityId": "89ce7656b4b4ca2d", "scanner": "scanner-primary", "fingerprint": "ac5a09cd62e42fbe", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/lib/utils.js"}, "region": {"startLine": 88}}}]}, {"ruleId": "scanner-f4d0d27176e95379", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in tools/ambassador/server.py:399"}, "properties": {"repobilityId": "fcd1f75fc029ead3", "scanner": "scanner-primary", "fingerprint": "f4d0d27176e95379", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/ambassador/server.py"}, "region": {"startLine": 399}}}]}, {"ruleId": "scanner-f0df75737aa1514a", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in tools/ambassador/server.py:62"}, "properties": {"repobilityId": "b0fad77da3dfcc45", "scanner": "scanner-primary", "fingerprint": "f0df75737aa1514a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/ambassador/server.py"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-c3cfda7ccf3e23e8", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in tools/ambassador/widget.html:377"}, "properties": {"repobilityId": "b965dc06a22fca8f", "scanner": "scanner-primary", "fingerprint": "c3cfda7ccf3e23e8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/ambassador/widget.html"}, "region": {"startLine": 377}}}]}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "ec1eb600941c06b1", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-1ab96ddc57c362a1", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: openclaw/SKILL.md"}, "properties": {"repobilityId": "7396f943ad63d2ce", "scanner": "scanner-primary", "fingerprint": "1ab96ddc57c362a1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "openclaw/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5f033056518995a6", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: airc-channel/.mcp.json"}, "properties": {"repobilityId": "97864590b5de8a8c", "scanner": "scanner-primary", "fingerprint": "5f033056518995a6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "mcp_config"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "airc-channel/.mcp.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ecb0d2c55ed6875d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.local.json"}, "properties": {"repobilityId": "d8bae33a6d517bf0", "scanner": "scanner-primary", "fingerprint": "ecb0d2c55ed6875d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.local.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-5bd0b54f00427d1b", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 generate-infographic.js:43"}, "properties": {"repobilityId": "cf003d6579c81268", "scanner": "scanner-primary", "fingerprint": "5bd0b54f00427d1b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b49ed34fda813e96", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 widget.js:229"}, "properties": {"repobilityId": "1fa06a6fadba7cf4", "scanner": "scanner-primary", "fingerprint": "b49ed34fda813e96", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e74130ac47dd33b8", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 conformance/conformance.test.js:23"}, "properties": {"repobilityId": "61dfef96e6e26d13", "scanner": "scanner-primary", "fingerprint": "e74130ac47dd33b8", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c53e82b9293bf36e", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 airc-channel/server.ts:216"}, "properties": {"repobilityId": "19b2983374614cc2", "scanner": "scanner-primary", "fingerprint": "c53e82b9293bf36e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d29d335520749b48", "level": "error", "message": {"text": "FastAPI POST `chat` without auth dependency \u2014 tools/ambassador/server.py:97"}, "properties": {"repobilityId": "6d8333a4267796a8", "scanner": "scanner-primary", "fingerprint": "d29d335520749b48", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "tools/ambassador/server.py"}, "region": {"startLine": 97}}}]}, {"ruleId": "scanner-e9726044491791e6", "level": "error", "message": {"text": "Dangling fetch: POST https://generativelanguage.googleapis.com/v1beta/models/${MODEL}:generateImages?key=${API_KEY} (generate-infographic.js:43)"}, "properties": {"repobilityId": "839129048b854c42", "scanner": "scanner-primary", "fingerprint": "e9726044491791e6", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-9d2517f9eafc5297", "level": "note", "message": {"text": "Unused endpoint: POST /api/chat"}, "properties": {"repobilityId": "ed17b4b56818b53d", "scanner": "scanner-primary", "fingerprint": "9d2517f9eafc5297", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-05d46f103a343922", "level": "note", "message": {"text": "Unused endpoint: GET /api/feed"}, "properties": {"repobilityId": "4937f5ed5acf4638", "scanner": "scanner-primary", "fingerprint": "05d46f103a343922", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "635dde31e781dec5", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-314ec2b8e925e4eb", "level": "note", "message": {"text": "Unused endpoint: GET /embed"}, "properties": {"repobilityId": "ee8c17f6b6a71e8e", "scanner": "scanner-primary", "fingerprint": "314ec2b8e925e4eb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-49b9e3c80d293cfb", "level": "note", "message": {"text": "Unused endpoint: GET /embed.js"}, "properties": {"repobilityId": "92e37cc3fcabc8df", "scanner": "scanner-primary", "fingerprint": "49b9e3c80d293cfb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}