{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-ec5310e679456748", "name": "Stray `console.log` in TS/JS \u2014 internal/module_scripts/prepare.js:21", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 internal/module_scripts/prepare.js:21"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d00b0f8d9b057d9f", "name": "TODO/FIXME marker in shipping code \u2014 internal/module_scripts/open-android.js:60", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 internal/module_scripts/open-android.js:60"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fe0962a99eed073e", "name": "Stray `console.log` in TS/JS \u2014 internal/module_scripts/build.js:14", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 internal/module_scripts/build.js:14"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2cd4c4d91f68a10e", "name": "React Flow <MiniMap> without dark background \u2014 example/App.tsx:279", "shortDescription": {"text": "React Flow <MiniMap> without dark background \u2014 example/App.tsx:279"}, "fullDescription": {"text": "A bare <MiniMap> renders with the vendor's white default in dark themes. Wrap the canvas in a class that overrides `.react-flow__minimap` background, or pass an explicit `style`/`maskColor`/`bgColor`.\n\nWhy: P1 in CHECKLIST.md \u2014 vendor defaults bleed light through.\nRule id: fq.minimap.no-bg"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-37442976471475ab", "name": "Stray `console.log` in TS/JS \u2014 src/GeoPulse.ts:45", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 src/GeoPulse.ts:45"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-303ffe0c518f5f99", "name": "Insecure pattern 'node_child_process' in internal/module_scripts/util.js:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in internal/module_scripts/util.js:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e6c07431c4e4bd54", "name": "Insecure pattern 'node_child_process' in internal/module_scripts/open-android.js:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in internal/module_scripts/open-android.js:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d591974d2cbfdeec", "name": "Insecure pattern 'node_child_process' in internal/module_scripts/open-ios.js:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in internal/module_scripts/open-ios.js:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d2ba9ea2cd5f3fe", "name": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/src/MapView.tsx:203", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/src/MapView.tsx:203"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-51665ad8bf6d1c04", "name": "Insecure pattern 'cors_wildcard' in server/main.py:33", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in server/main.py:33"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cb639d9a10a47b23", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "4 tests / 37 src (ratio 0.11)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 8 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6e3775939ae15caa", "name": "Commented-code block (5 lines) in dashboard/src/config.ts:15", "shortDescription": {"text": "Commented-code block (5 lines) in dashboard/src/config.ts:15"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a4a3b1b627d75f2c", "name": "Network/subprocess call without timeout or try/except \u2014 server/simulate.py:27", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 server/simulate.py:27"}, "fullDescription": {"text": "`urllib.request.urlopen(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2da969de7ad04edd", "name": "Commented-code block (6 lines) in server/main.py:155", "shortDescription": {"text": "Commented-code block (6 lines) in server/main.py:155"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-83b93afd952b2263", "name": "Commented-code block (6 lines) in example/index.ts:6", "shortDescription": {"text": "Commented-code block (6 lines) in example/index.ts:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3482f7e5dd70cd1a", "name": "6 env vars used in code but missing from .env.example", "shortDescription": {"text": "6 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `ANDROID_STUDIO`, `CI`, `EXPO_NONINTERACTIVE`, `GEOPULSE_DB`, `VITE_MAPBOX_TOKEN`, `VITE_WS_URL`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nserver/db.py:insert_locations, server/db.py:insert_location\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de426ea0b05912d5", "name": "FastAPI POST `ingest_locations` without auth dependency \u2014 server/main.py:126", "shortDescription": {"text": "FastAPI POST `ingest_locations` without auth dependency \u2014 server/main.py:126"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-363e2917fb12388f", "name": "FastAPI POST `ingest_event` without auth dependency \u2014 server/main.py:168", "shortDescription": {"text": "FastAPI POST `ingest_event` without auth dependency \u2014 server/main.py:168"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7015b6f40852f5b0", "name": "Dangling fetch: POST https://api.me/loc (src/GeoPulse.ts:338)", "shortDescription": {"text": "Dangling fetch: POST https://api.me/loc (src/GeoPulse.ts:338)"}, "fullDescription": {"text": "`src/GeoPulse.ts:338` calls `POST https://api.me/loc` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.me/loc`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9a1e4385e8139c8d", "name": "Unused endpoint: GET /app.apk", "shortDescription": {"text": "Unused endpoint: GET /app.apk"}, "fullDescription": {"text": "`server/main.py` declares `GET /app.apk` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f338a686474ff259", "name": "Unused endpoint: GET /install", "shortDescription": {"text": "Unused endpoint: GET /install"}, "fullDescription": {"text": "`server/main.py` declares `GET /install` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0a59a9b06457ac4f", "name": "Unused endpoint: POST /locations", "shortDescription": {"text": "Unused endpoint: POST /locations"}, "fullDescription": {"text": "`server/main.py` declares `POST /locations` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-55dfb7da7cd7cfe6", "name": "Unused endpoint: POST /events/{kind}", "shortDescription": {"text": "Unused endpoint: POST /events/{kind}"}, "fullDescription": {"text": "`server/main.py` declares `POST /events/{kind}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e8ebe817d16c5e42", "name": "Unused endpoint: GET /devices", "shortDescription": {"text": "Unused endpoint: GET /devices"}, "fullDescription": {"text": "`server/main.py` declares `GET /devices` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-358cf9a24089f496", "name": "Unused endpoint: GET /locations/{device}", "shortDescription": {"text": "Unused endpoint: GET /locations/{device}"}, "fullDescription": {"text": "`server/main.py` declares `GET /locations/{device}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4bd59f2a9b183650", "name": "Unused endpoint: GET /sessions/{device}", "shortDescription": {"text": "Unused endpoint: GET /sessions/{device}"}, "fullDescription": {"text": "`server/main.py` declares `GET /sessions/{device}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cdba2cc59edde9db", "name": "Unused endpoint: GET /events/{device}", "shortDescription": {"text": "Unused endpoint: GET /events/{device}"}, "fullDescription": {"text": "`server/main.py` declares `GET /events/{device}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/17789"}, "properties": {"repository": "ramon3198/expo-geopulse", "repoUrl": "https://github.com/ramon3198/expo-geopulse", "branch": "main"}, "results": [{"ruleId": "scanner-ec5310e679456748", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 internal/module_scripts/prepare.js:21"}, "properties": {"repobilityId": "32299142e8fc02eb", "scanner": "scanner-primary", "fingerprint": "ec5310e679456748", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d00b0f8d9b057d9f", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 internal/module_scripts/open-android.js:60"}, "properties": {"repobilityId": "10acd52a802d1bd9", "scanner": "scanner-primary", "fingerprint": "d00b0f8d9b057d9f", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-fe0962a99eed073e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 internal/module_scripts/build.js:14"}, "properties": {"repobilityId": "f1d5884d4877d5f2", "scanner": "scanner-primary", "fingerprint": "fe0962a99eed073e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2cd4c4d91f68a10e", "level": "note", "message": {"text": "React Flow <MiniMap> without dark background \u2014 example/App.tsx:279"}, "properties": {"repobilityId": "36fba555a9a1c284", "scanner": "scanner-primary", "fingerprint": "2cd4c4d91f68a10e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.minimap.no-bg"]}}, {"ruleId": "scanner-37442976471475ab", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 src/GeoPulse.ts:45"}, "properties": {"repobilityId": "d2dea16aec15f1fe", "scanner": "scanner-primary", "fingerprint": "37442976471475ab", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-303ffe0c518f5f99", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in internal/module_scripts/util.js:1"}, "properties": {"repobilityId": "e6b11096249dd4fe", "scanner": "scanner-primary", "fingerprint": "303ffe0c518f5f99", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "internal/module_scripts/util.js"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e6c07431c4e4bd54", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in internal/module_scripts/open-android.js:2"}, "properties": {"repobilityId": "a93ff3cee89356ba", "scanner": "scanner-primary", "fingerprint": "e6c07431c4e4bd54", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "internal/module_scripts/open-android.js"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-d591974d2cbfdeec", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in internal/module_scripts/open-ios.js:2"}, "properties": {"repobilityId": "5c8fbaa5344d7af0", "scanner": "scanner-primary", "fingerprint": "d591974d2cbfdeec", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "internal/module_scripts/open-ios.js"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-2d2ba9ea2cd5f3fe", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in dashboard/src/MapView.tsx:203"}, "properties": {"repobilityId": "be77607f20c5aaa3", "scanner": "scanner-primary", "fingerprint": "2d2ba9ea2cd5f3fe", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "dashboard/src/MapView.tsx"}, "region": {"startLine": 203}}}]}, {"ruleId": "scanner-51665ad8bf6d1c04", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in server/main.py:33"}, "properties": {"repobilityId": "49e214902837e07e", "scanner": "scanner-primary", "fingerprint": "51665ad8bf6d1c04", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/main.py"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-cb639d9a10a47b23", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "b86179956da3a4a8", "scanner": "scanner-primary", "fingerprint": "cb639d9a10a47b23", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "20feda0ae2590c1c", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "211dacaa9ce6dc84", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "c268422a8615eca6", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "8e5682e049474ec8", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-6e3775939ae15caa", "level": "none", "message": {"text": "Commented-code block (5 lines) in dashboard/src/config.ts:15"}, "properties": {"repobilityId": "88726f1692ae5cae", "scanner": "scanner-primary", "fingerprint": "6e3775939ae15caa", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a4a3b1b627d75f2c", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 server/simulate.py:27"}, "properties": {"repobilityId": "2866e6050e5c319a", "scanner": "scanner-primary", "fingerprint": "a4a3b1b627d75f2c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2da969de7ad04edd", "level": "none", "message": {"text": "Commented-code block (6 lines) in server/main.py:155"}, "properties": {"repobilityId": "680e7d2ad4b36296", "scanner": "scanner-primary", "fingerprint": "2da969de7ad04edd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-83b93afd952b2263", "level": "none", "message": {"text": "Commented-code block (6 lines) in example/index.ts:6"}, "properties": {"repobilityId": "1a0ffc2db9075809", "scanner": "scanner-primary", "fingerprint": "83b93afd952b2263", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3482f7e5dd70cd1a", "level": "note", "message": {"text": "6 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "1da70f25aa46f6e9", "scanner": "scanner-primary", "fingerprint": "3482f7e5dd70cd1a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "a9435c924f9f1067", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "472416d576329b32", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-de426ea0b05912d5", "level": "error", "message": {"text": "FastAPI POST `ingest_locations` without auth dependency \u2014 server/main.py:126"}, "properties": {"repobilityId": "085b040535aae6e0", "scanner": "scanner-primary", "fingerprint": "de426ea0b05912d5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/main.py"}, "region": {"startLine": 126}}}]}, {"ruleId": "scanner-363e2917fb12388f", "level": "error", "message": {"text": "FastAPI POST `ingest_event` without auth dependency \u2014 server/main.py:168"}, "properties": {"repobilityId": "cd9b0339542f43a8", "scanner": "scanner-primary", "fingerprint": "363e2917fb12388f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server/main.py"}, "region": {"startLine": 168}}}]}, {"ruleId": "scanner-7015b6f40852f5b0", "level": "error", "message": {"text": "Dangling fetch: POST https://api.me/loc (src/GeoPulse.ts:338)"}, "properties": {"repobilityId": "0aa1521466e704a6", "scanner": "scanner-primary", "fingerprint": "7015b6f40852f5b0", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-9a1e4385e8139c8d", "level": "note", "message": {"text": "Unused endpoint: GET /app.apk"}, "properties": {"repobilityId": "71cad894e652a011", "scanner": "scanner-primary", "fingerprint": "9a1e4385e8139c8d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f338a686474ff259", "level": "note", "message": {"text": "Unused endpoint: GET /install"}, "properties": {"repobilityId": "6e144271de4a5687", "scanner": "scanner-primary", "fingerprint": "f338a686474ff259", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0a59a9b06457ac4f", "level": "note", "message": {"text": "Unused endpoint: POST /locations"}, "properties": {"repobilityId": "e91357769fca8fa0", "scanner": "scanner-primary", "fingerprint": "0a59a9b06457ac4f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-55dfb7da7cd7cfe6", "level": "note", "message": {"text": "Unused endpoint: POST /events/{kind}"}, "properties": {"repobilityId": "24ccd958e0df54b3", "scanner": "scanner-primary", "fingerprint": "55dfb7da7cd7cfe6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e8ebe817d16c5e42", "level": "note", "message": {"text": "Unused endpoint: GET /devices"}, "properties": {"repobilityId": "17c21e81e521be0f", "scanner": "scanner-primary", "fingerprint": "e8ebe817d16c5e42", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-358cf9a24089f496", "level": "note", "message": {"text": "Unused endpoint: GET /locations/{device}"}, "properties": {"repobilityId": "282ed978ed17dcf3", "scanner": "scanner-primary", "fingerprint": "358cf9a24089f496", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4bd59f2a9b183650", "level": "note", "message": {"text": "Unused endpoint: GET /sessions/{device}"}, "properties": {"repobilityId": "2035b2a1a1435d56", "scanner": "scanner-primary", "fingerprint": "4bd59f2a9b183650", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cdba2cc59edde9db", "level": "note", "message": {"text": "Unused endpoint: GET /events/{device}"}, "properties": {"repobilityId": "cb3039b0e4226ad6", "scanner": "scanner-primary", "fingerprint": "cdba2cc59edde9db", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}