{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-ff34b4b86dd8d27d", "name": "Stray `console.log` in TS/JS \u2014 electron-app/main.js:3916", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 electron-app/main.js:3916"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-346ee8f108bd2a64", "name": "Icon-only button without accessible name \u2014 electron-app/renderer/app.js:2153", "shortDescription": {"text": "Icon-only button without accessible name \u2014 electron-app/renderer/app.js:2153"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11baecc512b243d2", "name": "Stray `console.log` in TS/JS \u2014 auditor/auditor.js:177", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 auditor/auditor.js:177"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-acb89ff69cc4acda", "name": "Stray `console.log` in TS/JS \u2014 api/test-bamboohr-webhook.js:119", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 api/test-bamboohr-webhook.js:119"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d72cc8626aed32a6", "name": "Stray `console.log` in TS/JS \u2014 worker/src/worker.js:63", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 worker/src/worker.js:63"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b1fdd41db2f35492", "name": "Stray `console.log` in TS/JS \u2014 approver/approver.js:152", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 approver/approver.js:152"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7cd69e942449ab55", "name": "Insecure pattern 'node_child_process' in electron-app/main.js:4", "shortDescription": {"text": "Insecure pattern 'node_child_process' in electron-app/main.js:4"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c524f54e5cc1368c", "name": "Insecure pattern 'direct_innerhtml_assignment' in electron-app/main.js:3734", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in electron-app/main.js:3734"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a0e3d6bb8a8b40fb", "name": "Insecure pattern 'direct_innerhtml_assignment' in electron-app/renderer/operator-select.html:270", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in electron-app/renderer/operator-select.html:270"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0bc0b914b13ca048", "name": "Insecure pattern 'direct_innerhtml_assignment' in electron-app/renderer/glass-screen.js:237", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in electron-app/renderer/glass-screen.js:237"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-53b353aa8e0ded96", "name": "Insecure pattern 'direct_innerhtml_assignment' in electron-app/renderer/palette.js:48", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in electron-app/renderer/palette.js:48"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-299d2a0e48870cb4", "name": "Insecure pattern 'direct_innerhtml_assignment' in electron-app/renderer/docked.js:491", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in electron-app/renderer/docked.js:491"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fcc77af94f59bc79", "name": "Insecure pattern 'direct_innerhtml_assignment' in electron-app/renderer/app.js:286", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in electron-app/renderer/app.js:286"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e6291d33f33ff5c8", "name": "Insecure pattern 'direct_outerhtml_assignment' in electron-app/renderer/app.js:1005", "shortDescription": {"text": "Insecure pattern 'direct_outerhtml_assignment' in electron-app/renderer/app.js:1005"}, "fullDescription": {"text": "Found a known-risky pattern (direct_outerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2ce87a881e50f3a8", "name": "Insecure pattern 'insert_adjacent_html' in electron-app/renderer/app.js:149", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in electron-app/renderer/app.js:149"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-95b323878ef03a1c", "name": "Insecure pattern 'direct_innerhtml_assignment' in electron-app/renderer/overlay.js:156", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in electron-app/renderer/overlay.js:156"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-24c0678d21985abc", "name": "Insecure pattern 'node_child_process' in electron-app/lib/graph-ps-session.js:18", "shortDescription": {"text": "Insecure pattern 'node_child_process' in electron-app/lib/graph-ps-session.js:18"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fe62c2252a826980", "name": "Insecure pattern 'node_child_process' in electron-app/.claude/skills/run-jml-console/driver.mjs:3", "shortDescription": {"text": "Insecure pattern 'node_child_process' in electron-app/.claude/skills/run-jml-console/driver.mjs:3"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b32ac6a6b89d5c6d", "name": "Insecure pattern 'node_child_process' in auditor/auditor.js:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in auditor/auditor.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-355140bf6792f48d", "name": "Insecure pattern 'node_child_process' in api/src/functions/ueba-cron.js:14", "shortDescription": {"text": "Insecure pattern 'node_child_process' in api/src/functions/ueba-cron.js:14"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-05d79960e2de3826", "name": "Insecure pattern 'node_child_process' in api/src/functions/risky-user-cron.js:14", "shortDescription": {"text": "Insecure pattern 'node_child_process' in api/src/functions/risky-user-cron.js:14"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fd61a5f4f88833b2", "name": "Insecure pattern 'node_child_process' in api/src/functions/drift-cron.js:14", "shortDescription": {"text": "Insecure pattern 'node_child_process' in api/src/functions/drift-cron.js:14"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8d4234d09e2a391f", "name": "Insecure pattern 'node_child_process' in api/src/functions/certifications.js:19", "shortDescription": {"text": "Insecure pattern 'node_child_process' in api/src/functions/certifications.js:19"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aba8f735167f35d4", "name": "Insecure pattern 'node_child_process' in api/src/functions/ueba-analysis.js:17", "shortDescription": {"text": "Insecure pattern 'node_child_process' in api/src/functions/ueba-analysis.js:17"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e1429ba8af11866c", "name": "Insecure pattern 'node_child_process' in api/src/functions/certification-cron.js:14", "shortDescription": {"text": "Insecure pattern 'node_child_process' in api/src/functions/certification-cron.js:14"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b64f1045c794987d", "name": "Insecure pattern 'node_child_process' in api/src/functions/drift-detection.js:17", "shortDescription": {"text": "Insecure pattern 'node_child_process' in api/src/functions/drift-detection.js:17"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2131d0e7a4bfc801", "name": "Insecure pattern 'node_child_process' in api/src/functions/risky-user-scan.js:14", "shortDescription": {"text": "Insecure pattern 'node_child_process' in api/src/functions/risky-user-scan.js:14"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-592a248d872525fc", "name": "Insecure pattern 'node_child_process' in worker/src/agent-dispatcher.js:18", "shortDescription": {"text": "Insecure pattern 'node_child_process' in worker/src/agent-dispatcher.js:18"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c95cd8e6612065af", "name": "Insecure pattern 'node_child_process' in approver/approver.js:5", "shortDescription": {"text": "Insecure pattern 'node_child_process' in approver/approver.js:5"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-934839dd013e8a7b", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7ad38863e913fa96", "name": "Very large file: electron-app/main.js (5217 lines)", "shortDescription": {"text": "Very large file: electron-app/main.js (5217 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-73da429fd698b70f", "name": "Very large file: electron-app/renderer/docked.js (1416 lines)", "shortDescription": {"text": "Very large file: electron-app/renderer/docked.js (1416 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a1de3c594d431f24", "name": "Very large file: electron-app/renderer/app.js (7762 lines)", "shortDescription": {"text": "Very large file: electron-app/renderer/app.js (7762 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 68 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 34 placeholder/mock markers across 5 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-31040dadca340576", "name": "Commented-code block (5 lines) in electron-app/main.js:36", "shortDescription": {"text": "Commented-code block (5 lines) in electron-app/main.js:36"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3e48f923a1035f1f", "name": "`fetch()` without try/.catch or AbortSignal \u2014 electron-app/main.js:2764", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 electron-app/main.js:2764"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-303d92b4b549b287", "name": "Commented-code block (6 lines) in electron-app/renderer/glass-screen-model.js:102", "shortDescription": {"text": "Commented-code block (6 lines) in electron-app/renderer/glass-screen-model.js:102"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-46bd8622a8791ac0", "name": "Commented-code block (6 lines) in electron-app/renderer/app.js:3051", "shortDescription": {"text": "Commented-code block (6 lines) in electron-app/renderer/app.js:3051"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/21638"}, "properties": {"repository": "TrickyDanceMoves/jml-agent-fleet", "repoUrl": "https://github.com/TrickyDanceMoves/jml-agent-fleet", "branch": "main"}, "results": [{"ruleId": "scanner-ff34b4b86dd8d27d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 electron-app/main.js:3916"}, "properties": {"repobilityId": "96d3bcc728fc4458", "scanner": "scanner-primary", "fingerprint": "ff34b4b86dd8d27d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-346ee8f108bd2a64", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 electron-app/renderer/app.js:2153"}, "properties": {"repobilityId": "f7e8cf449e392726", "scanner": "scanner-primary", "fingerprint": "346ee8f108bd2a64", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-11baecc512b243d2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 auditor/auditor.js:177"}, "properties": {"repobilityId": "55331494613d4150", "scanner": "scanner-primary", "fingerprint": "11baecc512b243d2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-acb89ff69cc4acda", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 api/test-bamboohr-webhook.js:119"}, "properties": {"repobilityId": "bf37f1f941a930d3", "scanner": "scanner-primary", "fingerprint": "acb89ff69cc4acda", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d72cc8626aed32a6", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 worker/src/worker.js:63"}, "properties": {"repobilityId": "b9ca3b68a13c022a", "scanner": "scanner-primary", "fingerprint": "d72cc8626aed32a6", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b1fdd41db2f35492", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 approver/approver.js:152"}, "properties": {"repobilityId": "8e89ee7c4b094dee", "scanner": "scanner-primary", "fingerprint": "b1fdd41db2f35492", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-7cd69e942449ab55", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in electron-app/main.js:4"}, "properties": {"repobilityId": "584b018649033644", "scanner": "scanner-primary", "fingerprint": "7cd69e942449ab55", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "electron-app/main.js"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-c524f54e5cc1368c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in electron-app/main.js:3734"}, "properties": {"repobilityId": "2e7f668c4ee73a71", "scanner": "scanner-primary", "fingerprint": "c524f54e5cc1368c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "electron-app/main.js"}, "region": {"startLine": 3734}}}]}, {"ruleId": "scanner-a0e3d6bb8a8b40fb", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in electron-app/renderer/operator-select.html:270"}, "properties": {"repobilityId": "fbfc9bd1fad44178", "scanner": "scanner-primary", "fingerprint": "a0e3d6bb8a8b40fb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "electron-app/renderer/operator-select.html"}, "region": {"startLine": 270}}}]}, {"ruleId": "scanner-0bc0b914b13ca048", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in electron-app/renderer/glass-screen.js:237"}, "properties": {"repobilityId": "1db6e0c72168984a", "scanner": "scanner-primary", "fingerprint": "0bc0b914b13ca048", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "electron-app/renderer/glass-screen.js"}, "region": {"startLine": 237}}}]}, {"ruleId": "scanner-53b353aa8e0ded96", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in electron-app/renderer/palette.js:48"}, "properties": {"repobilityId": "10f36c7bef4d1d57", "scanner": "scanner-primary", "fingerprint": "53b353aa8e0ded96", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "electron-app/renderer/palette.js"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-299d2a0e48870cb4", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in electron-app/renderer/docked.js:491"}, "properties": {"repobilityId": "2b8b7ea026720287", "scanner": "scanner-primary", "fingerprint": "299d2a0e48870cb4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "electron-app/renderer/docked.js"}, "region": {"startLine": 491}}}]}, {"ruleId": "scanner-fcc77af94f59bc79", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in electron-app/renderer/app.js:286"}, "properties": {"repobilityId": "74b50739a40b6b72", "scanner": "scanner-primary", "fingerprint": "fcc77af94f59bc79", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "electron-app/renderer/app.js"}, "region": {"startLine": 286}}}]}, {"ruleId": "scanner-e6291d33f33ff5c8", "level": "warning", "message": {"text": "Insecure pattern 'direct_outerhtml_assignment' in electron-app/renderer/app.js:1005"}, "properties": {"repobilityId": "edc754a67cbf7cc4", "scanner": "scanner-primary", "fingerprint": "e6291d33f33ff5c8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_outerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "electron-app/renderer/app.js"}, "region": {"startLine": 1005}}}]}, {"ruleId": "scanner-2ce87a881e50f3a8", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in electron-app/renderer/app.js:149"}, "properties": {"repobilityId": "e146451f7dade054", "scanner": "scanner-primary", "fingerprint": "2ce87a881e50f3a8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "electron-app/renderer/app.js"}, "region": {"startLine": 149}}}]}, {"ruleId": "scanner-95b323878ef03a1c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in electron-app/renderer/overlay.js:156"}, "properties": {"repobilityId": "b1f3649ccdcb2017", "scanner": "scanner-primary", "fingerprint": "95b323878ef03a1c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "electron-app/renderer/overlay.js"}, "region": {"startLine": 156}}}]}, {"ruleId": "scanner-24c0678d21985abc", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in electron-app/lib/graph-ps-session.js:18"}, "properties": {"repobilityId": "66812004332d5edc", "scanner": "scanner-primary", "fingerprint": "24c0678d21985abc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "electron-app/lib/graph-ps-session.js"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-fe62c2252a826980", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in electron-app/.claude/skills/run-jml-console/driver.mjs:3"}, "properties": {"repobilityId": "19204fec7f36dfd2", "scanner": "scanner-primary", "fingerprint": "fe62c2252a826980", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "electron-app/.claude/skills/run-jml-console/driver.mjs"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-b32ac6a6b89d5c6d", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in auditor/auditor.js:5"}, "properties": {"repobilityId": "1eaa97334506bf6e", "scanner": "scanner-primary", "fingerprint": "b32ac6a6b89d5c6d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "auditor/auditor.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-355140bf6792f48d", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in api/src/functions/ueba-cron.js:14"}, "properties": {"repobilityId": "0444dea54540854a", "scanner": "scanner-primary", "fingerprint": "355140bf6792f48d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/src/functions/ueba-cron.js"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-05d79960e2de3826", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in api/src/functions/risky-user-cron.js:14"}, "properties": {"repobilityId": "cb5701b22e253850", "scanner": "scanner-primary", "fingerprint": "05d79960e2de3826", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/src/functions/risky-user-cron.js"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-fd61a5f4f88833b2", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in api/src/functions/drift-cron.js:14"}, "properties": {"repobilityId": "c64c196923dd8dae", "scanner": "scanner-primary", "fingerprint": "fd61a5f4f88833b2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/src/functions/drift-cron.js"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-8d4234d09e2a391f", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in api/src/functions/certifications.js:19"}, "properties": {"repobilityId": "7d32cf8106cf74cb", "scanner": "scanner-primary", "fingerprint": "8d4234d09e2a391f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/src/functions/certifications.js"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-aba8f735167f35d4", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in api/src/functions/ueba-analysis.js:17"}, "properties": {"repobilityId": "ce2f22fc01efa681", "scanner": "scanner-primary", "fingerprint": "aba8f735167f35d4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/src/functions/ueba-analysis.js"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-e1429ba8af11866c", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in api/src/functions/certification-cron.js:14"}, "properties": {"repobilityId": "e4845ada87611f29", "scanner": "scanner-primary", "fingerprint": "e1429ba8af11866c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/src/functions/certification-cron.js"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-b64f1045c794987d", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in api/src/functions/drift-detection.js:17"}, "properties": {"repobilityId": "3f32730ecf21c8d7", "scanner": "scanner-primary", "fingerprint": "b64f1045c794987d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/src/functions/drift-detection.js"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-2131d0e7a4bfc801", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in api/src/functions/risky-user-scan.js:14"}, "properties": {"repobilityId": "81bcf65ff43531e0", "scanner": "scanner-primary", "fingerprint": "2131d0e7a4bfc801", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "api/src/functions/risky-user-scan.js"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-592a248d872525fc", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in worker/src/agent-dispatcher.js:18"}, "properties": {"repobilityId": "0da57e9379ed59cb", "scanner": "scanner-primary", "fingerprint": "592a248d872525fc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "worker/src/agent-dispatcher.js"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-c95cd8e6612065af", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in approver/approver.js:5"}, "properties": {"repobilityId": "e99af3c78228473e", "scanner": "scanner-primary", "fingerprint": "c95cd8e6612065af", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "approver/approver.js"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-934839dd013e8a7b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "be8dcdcafe8bddc8", "scanner": "scanner-primary", "fingerprint": "934839dd013e8a7b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/quality-gate.yml"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-7ad38863e913fa96", "level": "note", "message": {"text": "Very large file: electron-app/main.js (5217 lines)"}, "properties": {"repobilityId": "2fd2e7e74c96c9f1", "scanner": "scanner-primary", "fingerprint": "7ad38863e913fa96", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-73da429fd698b70f", "level": "note", "message": {"text": "Very large file: electron-app/renderer/docked.js (1416 lines)"}, "properties": {"repobilityId": "f6b130163e9a8927", "scanner": "scanner-primary", "fingerprint": "73da429fd698b70f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a1de3c594d431f24", "level": "note", "message": {"text": "Very large file: electron-app/renderer/app.js (7762 lines)"}, "properties": {"repobilityId": "9952389257871369", "scanner": "scanner-primary", "fingerprint": "a1de3c594d431f24", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "35f2fc80cbd08355", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "92925dfa576918b7", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "0da153b498e31130", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "7209590f78e39357", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "fc9ca1a79d343bbc", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-31040dadca340576", "level": "none", "message": {"text": "Commented-code block (5 lines) in electron-app/main.js:36"}, "properties": {"repobilityId": "9d508ea5394a9c89", "scanner": "scanner-primary", "fingerprint": "31040dadca340576", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3e48f923a1035f1f", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 electron-app/main.js:2764"}, "properties": {"repobilityId": "88423dd96116f49e", "scanner": "scanner-primary", "fingerprint": "3e48f923a1035f1f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-303d92b4b549b287", "level": "none", "message": {"text": "Commented-code block (6 lines) in electron-app/renderer/glass-screen-model.js:102"}, "properties": {"repobilityId": "44ce9cd620138fca", "scanner": "scanner-primary", "fingerprint": "303d92b4b549b287", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-46bd8622a8791ac0", "level": "none", "message": {"text": "Commented-code block (6 lines) in electron-app/renderer/app.js:3051"}, "properties": {"repobilityId": "fc93129247e19a02", "scanner": "scanner-primary", "fingerprint": "46bd8622a8791ac0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}