{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-bead75b0f9233e05", "name": "No API endpoints detected", "shortDescription": {"text": "No API endpoints detected"}, "fullDescription": {"text": "The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e8e037c35567f687", "name": "Icon-only button without accessible name \u2014 docs/otonami-redesign.jsx:260", "shortDescription": {"text": "Icon-only button without accessible name \u2014 docs/otonami-redesign.jsx:260"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5ebb0ef781e8a822", "name": "Stray `console.log` in TS/JS \u2014 scripts/take-screenshots.js:29", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/take-screenshots.js:29"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-25a61970c4339786", "name": "Stray `console.log` in TS/JS \u2014 scripts/epk-brutalist-measure.js:83", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/epk-brutalist-measure.js:83"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-297439cce29f0dc4", "name": "Stray `console.log` in TS/JS \u2014 scripts/generate-og-image.js:94", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/generate-og-image.js:94"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7923131eb53d2f47", "name": "Stray `console.log` in TS/JS \u2014 scripts/recovery/resend-notifications.js:102", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 scripts/recovery/resend-notifications.js:102"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c2f615710df89d77", "name": "Icon-only button without accessible name \u2014 components/OtonamiApp.jsx:3499", "shortDescription": {"text": "Icon-only button without accessible name \u2014 components/OtonamiApp.jsx:3499"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-603286693ac187d0", "name": "TODO/FIXME marker in shipping code \u2014 components/OtonamiApp.jsx:199", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 components/OtonamiApp.jsx:199"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c5d753a09acf1349", "name": "Stray `console.log` in TS/JS \u2014 components/OtonamiApp.jsx:339", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 components/OtonamiApp.jsx:339"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46440731f7a39c29", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 components/LegalPageLayout.jsx:14", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 components/LegalPageLayout.jsx:14"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9edbb34e5560a0e8", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 components/epk/themes/EditorialDark.jsx:134", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 components/epk/themes/EditorialDark.jsx:134"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-41af284b8f087f74", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 components/epk/themes/Brutalist.jsx:235", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 components/epk/themes/Brutalist.jsx:235"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-66239d1fb104d686", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 components/epk/themes/SunsetCitypop.jsx:195", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 components/epk/themes/SunsetCitypop.jsx:195"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-deb67b2bb14b14e9", "name": "Stray `console.log` in TS/JS \u2014 app/api/lyric-video/transcribe/route.js:298", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 app/api/lyric-video/transcribe/route.js:298"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ad95e6e2c734d661", "name": "Stray `console.log` in TS/JS \u2014 app/api/curators/login/route.js:240", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 app/api/curators/login/route.js:240"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-235a32a203eb9da9", "name": "Stray `console.log` in TS/JS \u2014 app/api/curators/set-password/route.js:65", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 app/api/curators/set-password/route.js:65"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a702544e98aa0386", "name": "Stray `console.log` in TS/JS \u2014 app/api/curator/route.js:194", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 app/api/curator/route.js:194"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-17260aa936b0754d", "name": "Stray `console.log` in TS/JS \u2014 app/api/curator/earnings/route.js:47", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 app/api/curator/earnings/route.js:47"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce1fcf78f7bc7e95", "name": "Stray `console.log` in TS/JS \u2014 app/api/curator/dashboard/route.js:70", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 app/api/curator/dashboard/route.js:70"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5372023a32f6e73f", "name": "Stray `console.log` in TS/JS \u2014 app/api/curator/pitch/[id]/route.js:33", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 app/api/curator/pitch/[id]/route.js:33"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e6ab1f68894f5d79", "name": "Stray `console.log` in TS/JS \u2014 app/api/pitches/route.js:137", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 app/api/pitches/route.js:137"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-826da557417e46d9", "name": "Stray `console.log` in TS/JS \u2014 app/api/cron/check-expired-pitches/route.js:95", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 app/api/cron/check-expired-pitches/route.js:95"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5abd23f2af4d7a25", "name": "Stray `console.log` in TS/JS \u2014 app/api/track/analyze/route.js:95", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 app/api/track/analyze/route.js:95"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f2d558bfcbbf55c8", "name": "Icon-only button without accessible name \u2014 app/artist/dashboard/page.js:1837", "shortDescription": {"text": "Icon-only button without accessible name \u2014 app/artist/dashboard/page.js:1837"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8f4d79ec9f1462bf", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 app/dashboard/epk/page.js:494", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 app/dashboard/epk/page.js:494"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-19b78e65146fb368", "name": "Icon-only button without accessible name \u2014 app/curators/page.js:311", "shortDescription": {"text": "Icon-only button without accessible name \u2014 app/curators/page.js:311"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0428af222f1481", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 app/preview/pitch-email/page.js:40", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 app/preview/pitch-email/page.js:40"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6971018a27410a58", "name": "Insecure pattern 'dangerous_innerhtml' in components/LegalPageLayout.jsx:14", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in components/LegalPageLayout.jsx:14"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ccae3bd7d1e03ca3", "name": "Insecure pattern 'dangerous_innerhtml' in components/epk/themes/EditorialDark.jsx:134", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in components/epk/themes/EditorialDark.jsx:134"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e1da6d4a39382035", "name": "Insecure pattern 'dangerous_innerhtml' in components/epk/themes/Brutalist.jsx:235", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in components/epk/themes/Brutalist.jsx:235"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bd4ccec27c15eb8c", "name": "Insecure pattern 'dangerous_innerhtml' in components/epk/themes/SunsetCitypop.jsx:195", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in components/epk/themes/SunsetCitypop.jsx:195"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5b0f793b9737439a", "name": "Insecure pattern 'local_storage_auth_token' in app/artist/login/page.js:154", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in app/artist/login/page.js:154"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5468a8ab148e980f", "name": "Insecure pattern 'dangerous_innerhtml' in app/dashboard/epk/page.js:494", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in app/dashboard/epk/page.js:494"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-936bb749a9c1b6ee", "name": "Insecure pattern 'dangerous_innerhtml' in app/preview/pitch-email/page.js:40", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in app/preview/pitch-email/page.js:40"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-02b63c2eb8b0cfa4", "name": "Possible secret in app/curator/page.js", "shortDescription": {"text": "Possible secret in app/curator/page.js"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-94af0576a551acad", "name": "Insecure pattern 'local_storage_auth_token' in app/curator/page.js:246", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in app/curator/page.js:246"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1af35dc251cdda45", "name": "Insecure pattern 'local_storage_auth_token' in app/curator/login/page.js:159", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in app/curator/login/page.js:159"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5fdb83d11269129c", "name": "Insecure pattern 'local_storage_auth_token' in app/curator/pitch/[id]/page.js:56", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in app/curator/pitch/[id]/page.js:56"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aab8c310d5399c94", "name": "Very large file: components/OtonamiApp.jsx (4266 lines)", "shortDescription": {"text": "Very large file: components/OtonamiApp.jsx (4266 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e06bebae839b22d3", "name": "Very large file: app/page.js (2821 lines)", "shortDescription": {"text": "Very large file: app/page.js (2821 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3819a2046e39c725", "name": "Very large file: app/artist/dashboard/page.js (2670 lines)", "shortDescription": {"text": "Very large file: app/artist/dashboard/page.js (2670 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf167ae95c85e5d7", "name": "Very large file: app/curator/page.js (1231 lines)", "shortDescription": {"text": "Very large file: app/curator/page.js (1231 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf8377bc0b89af01", "name": "Very large file: app/curator/dashboard/page.js (1313 lines)", "shortDescription": {"text": "Very large file: app/curator/dashboard/page.js (1313 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "2 test file(s) for 124 source file(s) (ratio 0.02). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-01f96f71d9907a8c", "name": "README lacks setup or run instructions", "shortDescription": {"text": "README lacks setup or run instructions"}, "fullDescription": {"text": "A README exists, but it does not contain common install/setup/run markers. This matches a frequent generated-code pattern: UI is present, operational handoff is thin."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 53 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 158 placeholder/mock markers across 37 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d79c4077342a7d0", "name": "Runtime service client appears to use placeholder configuration", "shortDescription": {"text": "Runtime service client appears to use placeholder configuration"}, "fullDescription": {"text": "A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, operator-readme. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci, operator-readme. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a92920c6533b200e", "name": "Agent authority lacks a verifier contract: .claude/commands/aidesigner.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/commands/aidesigner.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9635f93bf6c3c7d8", "name": "Agent instruction contains unpinned remote install: .claude/commands/aidesigner.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/commands/aidesigner.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7cb59bfcbef1f7e0", "name": "Agent instruction contains unpinned remote install: .claude/agents/aidesigner-frontend.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/agents/aidesigner-frontend.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a33d612472fbbbd7", "name": "Agent instruction contains unpinned remote install: .claude/skills/aidesigner-frontend/SKILL.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: .claude/skills/aidesigner-frontend/SKILL.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-98de7253ab967c83", "name": "Commented-code block (9 lines) in scripts/recovery/resend-notifications.js:4", "shortDescription": {"text": "Commented-code block (9 lines) in scripts/recovery/resend-notifications.js:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8f04160f9b9ec047", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/recovery/resend-notifications.js:76", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/recovery/resend-notifications.js:76"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-539d8c7618f699ce", "name": "Commented-code block (8 lines) in components/OtonamiApp.jsx:432", "shortDescription": {"text": "Commented-code block (8 lines) in components/OtonamiApp.jsx:432"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f8e711f18afd6c6c", "name": "Commented-code block (5 lines) in components/epk/themes/editorialDarkCss.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in components/epk/themes/editorialDarkCss.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0cab3fd833942fa8", "name": "Commented-code block (5 lines) in components/epk/themes/brutalistCss.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in components/epk/themes/brutalistCss.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7a8698975cf20adf", "name": "Commented-code block (5 lines) in components/epk/themes/sunsetCitypopCss.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in components/epk/themes/sunsetCitypopCss.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8984e36929d31d56", "name": "Commented-code block (5 lines) in components/epk/themes/brutalistSections.jsx:1", "shortDescription": {"text": "Commented-code block (5 lines) in components/epk/themes/brutalistSections.jsx:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c7d4477172a6c82b", "name": "Commented-code block (5 lines) in app/api/lyric-video/upload/route.js:28", "shortDescription": {"text": "Commented-code block (5 lines) in app/api/lyric-video/upload/route.js:28"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-95702f2c09aecce1", "name": "Commented-code block (9 lines) in app/api/lyric-video/transcribe/route.js:32", "shortDescription": {"text": "Commented-code block (9 lines) in app/api/lyric-video/transcribe/route.js:32"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cd6db3e6ac7d824a", "name": "`fetch()` without try/.catch or AbortSignal \u2014 app/api/lyric-video/transcribe/route.js:25", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/api/lyric-video/transcribe/route.js:25"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5ebb988bdb0fb815", "name": "`fetch()` without try/.catch or AbortSignal \u2014 app/api/lyric-video/generate-background/route.js:70", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/api/lyric-video/generate-background/route.js:70"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0aa83d74ee6ca887", "name": "Commented-code block (6 lines) in app/api/epk/translate/route.js:9", "shortDescription": {"text": "Commented-code block (6 lines) in app/api/epk/translate/route.js:9"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b332c75bfbf2c72c", "name": "Commented-code block (7 lines) in app/api/translate/route.js:13", "shortDescription": {"text": "Commented-code block (7 lines) in app/api/translate/route.js:13"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-23d90e8e860ecb9e", "name": "Commented-code block (6 lines) in app/api/pitch/route.js:35", "shortDescription": {"text": "Commented-code block (6 lines) in app/api/pitch/route.js:35"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-557065a86c7bec23", "name": "`fetch()` without try/.catch or AbortSignal \u2014 app/api/curator/route.js:24", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/api/curator/route.js:24"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b7c86e0022cf26eb", "name": "`fetch()` without try/.catch or AbortSignal \u2014 app/api/social/route.js:20", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/api/social/route.js:20"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e4236ffc8541e6d7", "name": "`fetch()` without try/.catch or AbortSignal \u2014 app/api/og/launch/route.js:51", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/api/og/launch/route.js:51"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e1da866e34d51416", "name": "Commented-code block (5 lines) in app/api/artists/route.js:20", "shortDescription": {"text": "Commented-code block (5 lines) in app/api/artists/route.js:20"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-402b5b555bb726ec", "name": "`fetch()` without try/.catch or AbortSignal \u2014 app/api/promo/card/route.js:77", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/api/promo/card/route.js:77"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f4689fe5f838bb71", "name": "`fetch()` without try/.catch or AbortSignal \u2014 app/api/track/analyze/route.js:44", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/api/track/analyze/route.js:44"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e021859ba6877322", "name": "`fetch()` without try/.catch or AbortSignal \u2014 app/artist/page.js:172", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/artist/page.js:172"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-771341ffddcbe592", "name": "Commented-code block (5 lines) in app/artist/dashboard/page.js:239", "shortDescription": {"text": "Commented-code block (5 lines) in app/artist/dashboard/page.js:239"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6ad457a3d4391869", "name": "`fetch()` without try/.catch or AbortSignal \u2014 app/artist/dashboard/page.js:2184", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/artist/dashboard/page.js:2184"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d8df4cf57d284370", "name": "Legacy-named symbol `otonami_curator_reg_draft_v1` in app/curator/page.js:8", "shortDescription": {"text": "Legacy-named symbol `otonami_curator_reg_draft_v1` in app/curator/page.js:8"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d72cf1712c804e1", "name": "`fetch()` without try/.catch or AbortSignal \u2014 app/curator/page.js:384", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/curator/page.js:384"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-26e78d32ec92dd46", "name": "`fetch()` without try/.catch or AbortSignal \u2014 app/curator/dashboard/page.js:234", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/curator/dashboard/page.js:234"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1163a8aca7eba1ad", "name": "`fetch()` without try/.catch or AbortSignal \u2014 app/curator/pitch/[id]/page.js:191", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/curator/pitch/[id]/page.js:191"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-87108f8767cf730b", "name": "Commented-code block (6 lines) in app/studio/page.js:7", "shortDescription": {"text": "Commented-code block (6 lines) in app/studio/page.js:7"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5c2bb3ef7432c6b5", "name": "`fetch()` without try/.catch or AbortSignal \u2014 lib/supabase.js:6", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 lib/supabase.js:6"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8ea900d5e972294c", "name": "Commented-code block (5 lines) in lib/match-score.js:1", "shortDescription": {"text": "Commented-code block (5 lines) in lib/match-score.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2fdf27fb23a89a61", "name": "Commented-code block (6 lines) in lib/epk.js:1", "shortDescription": {"text": "Commented-code block (6 lines) in lib/epk.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-787947d4fd2cb393", "name": "Commented-code block (5 lines) in lib/api-track.js:20", "shortDescription": {"text": "Commented-code block (5 lines) in lib/api-track.js:20"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ee539fb958c5603c", "name": "`fetch()` without try/.catch or AbortSignal \u2014 lib/api-client.js:10", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 lib/api-client.js:10"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/18989"}, "properties": {"repository": "satoshi-otonami/otonami", "repoUrl": "https://github.com/satoshi-otonami/otonami", "branch": "main"}, "results": [{"ruleId": "scanner-bead75b0f9233e05", "level": "none", "message": {"text": "No API endpoints detected"}, "properties": {"repobilityId": "0f8bb852027c38f8", "scanner": "scanner-primary", "fingerprint": "bead75b0f9233e05", "layer": "api", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-e8e037c35567f687", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 docs/otonami-redesign.jsx:260"}, "properties": {"repobilityId": "3ca29f7e8c6557fe", "scanner": "scanner-primary", "fingerprint": "e8e037c35567f687", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-5ebb0ef781e8a822", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/take-screenshots.js:29"}, "properties": {"repobilityId": "9341ba2683924fde", "scanner": "scanner-primary", "fingerprint": "5ebb0ef781e8a822", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-25a61970c4339786", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/epk-brutalist-measure.js:83"}, "properties": {"repobilityId": "73a08825783b0569", "scanner": "scanner-primary", "fingerprint": "25a61970c4339786", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-297439cce29f0dc4", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/generate-og-image.js:94"}, "properties": {"repobilityId": "ebc2babdeec6d659", "scanner": "scanner-primary", "fingerprint": "297439cce29f0dc4", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7923131eb53d2f47", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 scripts/recovery/resend-notifications.js:102"}, "properties": {"repobilityId": "0233e056fba4a03d", "scanner": "scanner-primary", "fingerprint": "7923131eb53d2f47", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c2f615710df89d77", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 components/OtonamiApp.jsx:3499"}, "properties": {"repobilityId": "e121a30302ad3176", "scanner": "scanner-primary", "fingerprint": "c2f615710df89d77", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-603286693ac187d0", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 components/OtonamiApp.jsx:199"}, "properties": {"repobilityId": "d13b49a3c13a879e", "scanner": "scanner-primary", "fingerprint": "603286693ac187d0", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-c5d753a09acf1349", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 components/OtonamiApp.jsx:339"}, "properties": {"repobilityId": "1f377ea8fd2bc332", "scanner": "scanner-primary", "fingerprint": "c5d753a09acf1349", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-46440731f7a39c29", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 components/LegalPageLayout.jsx:14"}, "properties": {"repobilityId": "4dec8909c09aacd8", "scanner": "scanner-primary", "fingerprint": "46440731f7a39c29", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-9edbb34e5560a0e8", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 components/epk/themes/EditorialDark.jsx:134"}, "properties": {"repobilityId": "8fd0fd4b6e3d5e94", "scanner": "scanner-primary", "fingerprint": "9edbb34e5560a0e8", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-41af284b8f087f74", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 components/epk/themes/Brutalist.jsx:235"}, "properties": {"repobilityId": "3b7a2969e6f9ac7d", "scanner": "scanner-primary", "fingerprint": "41af284b8f087f74", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-66239d1fb104d686", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 components/epk/themes/SunsetCitypop.jsx:195"}, "properties": {"repobilityId": "b02935bc08f05ea2", "scanner": "scanner-primary", "fingerprint": "66239d1fb104d686", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-deb67b2bb14b14e9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 app/api/lyric-video/transcribe/route.js:298"}, "properties": {"repobilityId": "df8edc3ce9c34c5c", "scanner": "scanner-primary", "fingerprint": "deb67b2bb14b14e9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ad95e6e2c734d661", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 app/api/curators/login/route.js:240"}, "properties": {"repobilityId": "9f613138257a3ad5", "scanner": "scanner-primary", "fingerprint": "ad95e6e2c734d661", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-235a32a203eb9da9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 app/api/curators/set-password/route.js:65"}, "properties": {"repobilityId": "428c73f02b109eed", "scanner": "scanner-primary", "fingerprint": "235a32a203eb9da9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a702544e98aa0386", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 app/api/curator/route.js:194"}, "properties": {"repobilityId": "20b26496dc8d4fed", "scanner": "scanner-primary", "fingerprint": "a702544e98aa0386", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-17260aa936b0754d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 app/api/curator/earnings/route.js:47"}, "properties": {"repobilityId": "3dbf9295c839697f", "scanner": "scanner-primary", "fingerprint": "17260aa936b0754d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ce1fcf78f7bc7e95", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 app/api/curator/dashboard/route.js:70"}, "properties": {"repobilityId": "19e98f4b787d6ada", "scanner": "scanner-primary", "fingerprint": "ce1fcf78f7bc7e95", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5372023a32f6e73f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 app/api/curator/pitch/[id]/route.js:33"}, "properties": {"repobilityId": "086cc87c0da4eeb2", "scanner": "scanner-primary", "fingerprint": "5372023a32f6e73f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e6ab1f68894f5d79", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 app/api/pitches/route.js:137"}, "properties": {"repobilityId": "78fafd58b01554c0", "scanner": "scanner-primary", "fingerprint": "e6ab1f68894f5d79", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-826da557417e46d9", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 app/api/cron/check-expired-pitches/route.js:95"}, "properties": {"repobilityId": "32991df160d7a7cf", "scanner": "scanner-primary", "fingerprint": "826da557417e46d9", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5abd23f2af4d7a25", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 app/api/track/analyze/route.js:95"}, "properties": {"repobilityId": "a6333a7f2af70e91", "scanner": "scanner-primary", "fingerprint": "5abd23f2af4d7a25", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-f2d558bfcbbf55c8", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 app/artist/dashboard/page.js:1837"}, "properties": {"repobilityId": "1594ff9774f844de", "scanner": "scanner-primary", "fingerprint": "f2d558bfcbbf55c8", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-8f4d79ec9f1462bf", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 app/dashboard/epk/page.js:494"}, "properties": {"repobilityId": "987a2ebf18ad3b21", "scanner": "scanner-primary", "fingerprint": "8f4d79ec9f1462bf", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-19b78e65146fb368", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 app/curators/page.js:311"}, "properties": {"repobilityId": "76a65c91e9d50546", "scanner": "scanner-primary", "fingerprint": "19b78e65146fb368", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-2d0428af222f1481", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 app/preview/pitch-email/page.js:40"}, "properties": {"repobilityId": "3ed1a4038e801068", "scanner": "scanner-primary", "fingerprint": "2d0428af222f1481", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-6971018a27410a58", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in components/LegalPageLayout.jsx:14"}, "properties": {"repobilityId": "0f8515af54ada902", "scanner": "scanner-primary", "fingerprint": "6971018a27410a58", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "components/LegalPageLayout.jsx"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-ccae3bd7d1e03ca3", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in components/epk/themes/EditorialDark.jsx:134"}, "properties": {"repobilityId": "2ec887fb7b69ce0d", "scanner": "scanner-primary", "fingerprint": "ccae3bd7d1e03ca3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "components/epk/themes/EditorialDark.jsx"}, "region": {"startLine": 134}}}]}, {"ruleId": "scanner-e1da6d4a39382035", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in components/epk/themes/Brutalist.jsx:235"}, "properties": {"repobilityId": "44125dc96690a41d", "scanner": "scanner-primary", "fingerprint": "e1da6d4a39382035", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "components/epk/themes/Brutalist.jsx"}, "region": {"startLine": 235}}}]}, {"ruleId": "scanner-bd4ccec27c15eb8c", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in components/epk/themes/SunsetCitypop.jsx:195"}, "properties": {"repobilityId": "0bf052db9033a9ec", "scanner": "scanner-primary", "fingerprint": "bd4ccec27c15eb8c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "components/epk/themes/SunsetCitypop.jsx"}, "region": {"startLine": 195}}}]}, {"ruleId": "scanner-5b0f793b9737439a", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in app/artist/login/page.js:154"}, "properties": {"repobilityId": "c87121bdbb2cbce5", "scanner": "scanner-primary", "fingerprint": "5b0f793b9737439a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/artist/login/page.js"}, "region": {"startLine": 154}}}]}, {"ruleId": "scanner-5468a8ab148e980f", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in app/dashboard/epk/page.js:494"}, "properties": {"repobilityId": "6c0d52a0aa77162d", "scanner": "scanner-primary", "fingerprint": "5468a8ab148e980f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/dashboard/epk/page.js"}, "region": {"startLine": 494}}}]}, {"ruleId": "scanner-936bb749a9c1b6ee", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in app/preview/pitch-email/page.js:40"}, "properties": {"repobilityId": "ce16cd0130421cee", "scanner": "scanner-primary", "fingerprint": "936bb749a9c1b6ee", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/preview/pitch-email/page.js"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-02b63c2eb8b0cfa4", "level": "error", "message": {"text": "Possible secret in app/curator/page.js"}, "properties": {"repobilityId": "728c52b1bb9addb0", "scanner": "scanner-primary", "fingerprint": "02b63c2eb8b0cfa4", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/curator/page.js"}, "region": {"startLine": 335}}}]}, {"ruleId": "scanner-94af0576a551acad", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in app/curator/page.js:246"}, "properties": {"repobilityId": "5c10f40ceec50dd4", "scanner": "scanner-primary", "fingerprint": "94af0576a551acad", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/curator/page.js"}, "region": {"startLine": 246}}}]}, {"ruleId": "scanner-1af35dc251cdda45", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in app/curator/login/page.js:159"}, "properties": {"repobilityId": "a625ec460a6b1931", "scanner": "scanner-primary", "fingerprint": "1af35dc251cdda45", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/curator/login/page.js"}, "region": {"startLine": 159}}}]}, {"ruleId": "scanner-5fdb83d11269129c", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in app/curator/pitch/[id]/page.js:56"}, "properties": {"repobilityId": "b97e127ead29ee47", "scanner": "scanner-primary", "fingerprint": "5fdb83d11269129c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/curator/pitch/[id]/page.js"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-aab8c310d5399c94", "level": "note", "message": {"text": "Very large file: components/OtonamiApp.jsx (4266 lines)"}, "properties": {"repobilityId": "fd518eb199350c6f", "scanner": "scanner-primary", "fingerprint": "aab8c310d5399c94", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e06bebae839b22d3", "level": "note", "message": {"text": "Very large file: app/page.js (2821 lines)"}, "properties": {"repobilityId": "2fac579345686647", "scanner": "scanner-primary", "fingerprint": "e06bebae839b22d3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3819a2046e39c725", "level": "note", "message": {"text": "Very large file: app/artist/dashboard/page.js (2670 lines)"}, "properties": {"repobilityId": "4e073564f8896c42", "scanner": "scanner-primary", "fingerprint": "3819a2046e39c725", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-cf167ae95c85e5d7", "level": "note", "message": {"text": "Very large file: app/curator/page.js (1231 lines)"}, "properties": {"repobilityId": "18cff7d67d2de0b6", "scanner": "scanner-primary", "fingerprint": "cf167ae95c85e5d7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-cf8377bc0b89af01", "level": "note", "message": {"text": "Very large file: app/curator/dashboard/page.js (1313 lines)"}, "properties": {"repobilityId": "e20021710acb8bb2", "scanner": "scanner-primary", "fingerprint": "cf8377bc0b89af01", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "613b5b7e288449af", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-01f96f71d9907a8c", "level": "note", "message": {"text": "README lacks setup or run instructions"}, "properties": {"repobilityId": "5db778199df94e01", "scanner": "scanner-primary", "fingerprint": "01f96f71d9907a8c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["docs", "readme", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "c708eb86472b96c0", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "bb286de28f3662ec", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-9d79c4077342a7d0", "level": "warning", "message": {"text": "Runtime service client appears to use placeholder configuration"}, "properties": {"repobilityId": "ef52682d52d16f2f", "scanner": "scanner-primary", "fingerprint": "9d79c4077342a7d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "runtime-config", "service-client", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "89c9422cf33ff5a4", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "4ec641a28b65e34a", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "5b61b7f122b31333", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "c3b0a7df7a52fbf2", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "01d805105146c01b", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-a92920c6533b200e", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/commands/aidesigner.md"}, "properties": {"repobilityId": "ac85e412691b3739", "scanner": "scanner-primary", "fingerprint": "a92920c6533b200e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/aidesigner.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9635f93bf6c3c7d8", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/commands/aidesigner.md"}, "properties": {"repobilityId": "69ac02262c2ca8e3", "scanner": "scanner-primary", "fingerprint": "9635f93bf6c3c7d8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/commands/aidesigner.md"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-7cb59bfcbef1f7e0", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/agents/aidesigner-frontend.md"}, "properties": {"repobilityId": "d312c1fdd9ab8022", "scanner": "scanner-primary", "fingerprint": "7cb59bfcbef1f7e0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/agents/aidesigner-frontend.md"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-a33d612472fbbbd7", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: .claude/skills/aidesigner-frontend/SKILL.md"}, "properties": {"repobilityId": "8c45f506cd65bcc2", "scanner": "scanner-primary", "fingerprint": "a33d612472fbbbd7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/aidesigner-frontend/SKILL.md"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-98de7253ab967c83", "level": "none", "message": {"text": "Commented-code block (9 lines) in scripts/recovery/resend-notifications.js:4"}, "properties": {"repobilityId": "7c15801ffec7a05c", "scanner": "scanner-primary", "fingerprint": "98de7253ab967c83", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8f04160f9b9ec047", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/recovery/resend-notifications.js:76"}, "properties": {"repobilityId": "6256c7162a311ed1", "scanner": "scanner-primary", "fingerprint": "8f04160f9b9ec047", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-539d8c7618f699ce", "level": "none", "message": {"text": "Commented-code block (8 lines) in components/OtonamiApp.jsx:432"}, "properties": {"repobilityId": "4c4bfb1d646f0f55", "scanner": "scanner-primary", "fingerprint": "539d8c7618f699ce", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f8e711f18afd6c6c", "level": "none", "message": {"text": "Commented-code block (5 lines) in components/epk/themes/editorialDarkCss.js:1"}, "properties": {"repobilityId": "4f9a096ffa75cd1c", "scanner": "scanner-primary", "fingerprint": "f8e711f18afd6c6c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0cab3fd833942fa8", "level": "none", "message": {"text": "Commented-code block (5 lines) in components/epk/themes/brutalistCss.js:1"}, "properties": {"repobilityId": "c9c10234fb587749", "scanner": "scanner-primary", "fingerprint": "0cab3fd833942fa8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7a8698975cf20adf", "level": "none", "message": {"text": "Commented-code block (5 lines) in components/epk/themes/sunsetCitypopCss.js:1"}, "properties": {"repobilityId": "6cda651f28e10e9e", "scanner": "scanner-primary", "fingerprint": "7a8698975cf20adf", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8984e36929d31d56", "level": "none", "message": {"text": "Commented-code block (5 lines) in components/epk/themes/brutalistSections.jsx:1"}, "properties": {"repobilityId": "565a6cdc202c5df6", "scanner": "scanner-primary", "fingerprint": "8984e36929d31d56", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c7d4477172a6c82b", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/api/lyric-video/upload/route.js:28"}, "properties": {"repobilityId": "62f79a707121ced3", "scanner": "scanner-primary", "fingerprint": "c7d4477172a6c82b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-95702f2c09aecce1", "level": "none", "message": {"text": "Commented-code block (9 lines) in app/api/lyric-video/transcribe/route.js:32"}, "properties": {"repobilityId": "1674d5223fc9695a", "scanner": "scanner-primary", "fingerprint": "95702f2c09aecce1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cd6db3e6ac7d824a", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/api/lyric-video/transcribe/route.js:25"}, "properties": {"repobilityId": "69248ace8715e9e8", "scanner": "scanner-primary", "fingerprint": "cd6db3e6ac7d824a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-5ebb988bdb0fb815", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/api/lyric-video/generate-background/route.js:70"}, "properties": {"repobilityId": "b1bf2006b3338195", "scanner": "scanner-primary", "fingerprint": "5ebb988bdb0fb815", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0aa83d74ee6ca887", "level": "none", "message": {"text": "Commented-code block (6 lines) in app/api/epk/translate/route.js:9"}, "properties": {"repobilityId": "0847fc5a79d9790d", "scanner": "scanner-primary", "fingerprint": "0aa83d74ee6ca887", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b332c75bfbf2c72c", "level": "none", "message": {"text": "Commented-code block (7 lines) in app/api/translate/route.js:13"}, "properties": {"repobilityId": "1315c34b1c9b5846", "scanner": "scanner-primary", "fingerprint": "b332c75bfbf2c72c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-23d90e8e860ecb9e", "level": "none", "message": {"text": "Commented-code block (6 lines) in app/api/pitch/route.js:35"}, "properties": {"repobilityId": "bac0a6bb5e1c764c", "scanner": "scanner-primary", "fingerprint": "23d90e8e860ecb9e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-557065a86c7bec23", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/api/curator/route.js:24"}, "properties": {"repobilityId": "04e7fb13f2c398b4", "scanner": "scanner-primary", "fingerprint": "557065a86c7bec23", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b7c86e0022cf26eb", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/api/social/route.js:20"}, "properties": {"repobilityId": "7bb2c4d15024dd61", "scanner": "scanner-primary", "fingerprint": "b7c86e0022cf26eb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e4236ffc8541e6d7", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/api/og/launch/route.js:51"}, "properties": {"repobilityId": "b65d6e87b6e529f6", "scanner": "scanner-primary", "fingerprint": "e4236ffc8541e6d7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e1da866e34d51416", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/api/artists/route.js:20"}, "properties": {"repobilityId": "7c6474fe071cc0cf", "scanner": "scanner-primary", "fingerprint": "e1da866e34d51416", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-402b5b555bb726ec", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/api/promo/card/route.js:77"}, "properties": {"repobilityId": "3869903c53b4566f", "scanner": "scanner-primary", "fingerprint": "402b5b555bb726ec", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f4689fe5f838bb71", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/api/track/analyze/route.js:44"}, "properties": {"repobilityId": "62f29cba1bb33575", "scanner": "scanner-primary", "fingerprint": "f4689fe5f838bb71", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e021859ba6877322", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/artist/page.js:172"}, "properties": {"repobilityId": "59344617c789e065", "scanner": "scanner-primary", "fingerprint": "e021859ba6877322", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-771341ffddcbe592", "level": "none", "message": {"text": "Commented-code block (5 lines) in app/artist/dashboard/page.js:239"}, "properties": {"repobilityId": "faf3da6cb8efc64a", "scanner": "scanner-primary", "fingerprint": "771341ffddcbe592", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6ad457a3d4391869", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/artist/dashboard/page.js:2184"}, "properties": {"repobilityId": "a60f10128dbb812a", "scanner": "scanner-primary", "fingerprint": "6ad457a3d4391869", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d8df4cf57d284370", "level": "note", "message": {"text": "Legacy-named symbol `otonami_curator_reg_draft_v1` in app/curator/page.js:8"}, "properties": {"repobilityId": "24d8edbb551a3290", "scanner": "scanner-primary", "fingerprint": "d8df4cf57d284370", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-1d72cf1712c804e1", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/curator/page.js:384"}, "properties": {"repobilityId": "7a1ee53514a6e824", "scanner": "scanner-primary", "fingerprint": "1d72cf1712c804e1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-26e78d32ec92dd46", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/curator/dashboard/page.js:234"}, "properties": {"repobilityId": "c3c18b4cf0a40e5b", "scanner": "scanner-primary", "fingerprint": "26e78d32ec92dd46", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1163a8aca7eba1ad", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 app/curator/pitch/[id]/page.js:191"}, "properties": {"repobilityId": "9fb7180f915eb59e", "scanner": "scanner-primary", "fingerprint": "1163a8aca7eba1ad", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-87108f8767cf730b", "level": "none", "message": {"text": "Commented-code block (6 lines) in app/studio/page.js:7"}, "properties": {"repobilityId": "b92e69c850428354", "scanner": "scanner-primary", "fingerprint": "87108f8767cf730b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5c2bb3ef7432c6b5", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 lib/supabase.js:6"}, "properties": {"repobilityId": "4e5dda40ac2a537e", "scanner": "scanner-primary", "fingerprint": "5c2bb3ef7432c6b5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-8ea900d5e972294c", "level": "none", "message": {"text": "Commented-code block (5 lines) in lib/match-score.js:1"}, "properties": {"repobilityId": "25749b7b0c216dff", "scanner": "scanner-primary", "fingerprint": "8ea900d5e972294c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2fdf27fb23a89a61", "level": "none", "message": {"text": "Commented-code block (6 lines) in lib/epk.js:1"}, "properties": {"repobilityId": "a46502ccf5b5030f", "scanner": "scanner-primary", "fingerprint": "2fdf27fb23a89a61", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-787947d4fd2cb393", "level": "none", "message": {"text": "Commented-code block (5 lines) in lib/api-track.js:20"}, "properties": {"repobilityId": "5b784a42d860e986", "scanner": "scanner-primary", "fingerprint": "787947d4fd2cb393", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ee539fb958c5603c", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 lib/api-client.js:10"}, "properties": {"repobilityId": "9ef9527532dc7b94", "scanner": "scanner-primary", "fingerprint": "ee539fb958c5603c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}]}]}