{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-058199a40a7f335d", "name": "`truncate` class without `title=` for hover reveal \u2014 ux-design/heuresys_uxix_brand_identity_bundle_v1/code_examples/src/", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 ux-design/heuresys_uxix_brand_identity_bundle_v1/code_examples/src/components/dashboard/Sidebar.tsx:72"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-68dec585bb66d7b4", "name": "`truncate` class without `title=` for hover reveal \u2014 ux-design/heuresys_uxix_brand_identity_bundle_v1/code_examples/src/", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 ux-design/heuresys_uxix_brand_identity_bundle_v1/code_examples/src/components/dashboard/DBSupervisorSidebar.tsx:46"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-db455a272417d72f", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/showcase/src/app/layout.tsx:21", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/showcase/src/app/layout.tsx:21"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-62c536edc6b71734", "name": "Stray `console.log` in TS/JS \u2014 apps/api/src/modules/insights/recompute-cli.ts:19", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/modules/insights/recompute-cli.ts:19"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-453afaa6a1aae7eb", "name": "Stray `console.log` in TS/JS \u2014 apps/api/src/modules/semantic-matching/backfill.ts:48", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/modules/semantic-matching/backfill.ts:48"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8f07ef8e4501f2d4", "name": "Stray `console.log` in TS/JS \u2014 apps/api/src/modules/reference-sync/sync-cli.ts:18", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/modules/reference-sync/sync-cli.ts:18"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eaec05515d245641", "name": "Stray `console.log` in TS/JS \u2014 apps/web/tests/e2e/global-teardown.ts:49", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/web/tests/e2e/global-teardown.ts:49"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4ed44ce8c00fe6f6", "name": "Stray `console.log` in TS/JS \u2014 apps/web/scripts/check-i18n-parity.ts:73", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/web/scripts/check-i18n-parity.ts:73"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-81c0bda4cc81d56a", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/components/ContentMediaPanel.tsx:139", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/components/ContentMediaPanel.tsx:139"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-018982112d373dac", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/src/app/layout.tsx:35", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/src/app/layout.tsx:35"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-054181325e7a4596", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/app/showcase/palettes/page.tsx:163", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/app/showcase/palettes/page.tsx:163"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-17558fee64b19812", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/app/(authenticated)/layout.tsx:238", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/app/(authenticated)/layout.tsx:238"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b491dd94c0bb6f91", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/app/(authenticated)/dashboard/page.tsx:156", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/app/(authenticated)/dashboard/page.tsx:156"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a28aeac89349d7c3", "name": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/app/(authenticated)/me/handbook/[id]/page.tsx:116", "shortDescription": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/app/(authenticated)/me/handbook/[id]/page.tsx:116"}, "fullDescription": {"text": "A truncated value should reveal the full text on hover. Pass the full string via `title={...}` so the user can read it.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c884c6d69dbf7282", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/src/app/(authenticated)/content/page.tsx:56", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/src/app/(authenticated)/content/page.tsx:56"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e2bafa513b8f3c99", "name": "Stray `console.log` in TS/JS \u2014 apps/agent-gateway/scripts/live-skills-acceptance.ts:119", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/agent-gateway/scripts/live-skills-acceptance.ts:119"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5a77f500651fb547", "name": "Stray `console.log` in TS/JS \u2014 apps/agent-gateway/scripts/live-read-acceptance.ts:67", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/agent-gateway/scripts/live-read-acceptance.ts:67"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3691dc41fe47f462", "name": "Stray `console.log` in TS/JS \u2014 apps/agent-gateway/scripts/smoke-sdk-auth.ts:21", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/agent-gateway/scripts/smoke-sdk-auth.ts:21"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-69e3dd173e418841", "name": "Stray `console.log` in TS/JS \u2014 apps/agent-gateway/scripts/live-write-acceptance.ts:88", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/agent-gateway/scripts/live-write-acceptance.ts:88"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b13705d45bb1df71", "name": "Stray `console.log` in TS/JS \u2014 apps/agent-gateway/src/server.ts:170", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/agent-gateway/src/server.ts:170"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5de5ef5cc07b98fb", "name": "Stray `console.log` in TS/JS \u2014 db/scripts/seed-service-user.ts:74", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 db/scripts/seed-service-user.ts:74"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-676fb81c3123ef9b", "name": "Stray `console.log` in TS/JS \u2014 db/scripts/seed-reference-bank.ts:187", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 db/scripts/seed-reference-bank.ts:187"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-26cc11ecc9f8f93a", "name": "Stray `console.log` in TS/JS \u2014 db/scripts/seed-r2-personas.ts:143", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 db/scripts/seed-r2-personas.ts:143"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5b45edb0717e333f", "name": "Stray `console.log` in TS/JS \u2014 db/scripts/seed-test-admin.ts:190", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 db/scripts/seed-test-admin.ts:190"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8ead6cb1682d09a6", "name": "Stray `console.log` in TS/JS \u2014 db/scripts/seed-r1b-personas.ts:135", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 db/scripts/seed-r1b-personas.ts:135"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6aad62a629d99730", "name": "Privileged port 38 in use", "shortDescription": {"text": "Privileged port 38 in use"}, "fullDescription": {"text": "Port 38 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-74c104e9320e311f", "name": "Insecure pattern 'dangerous_innerhtml' in apps/showcase/src/app/layout.tsx:21", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/showcase/src/app/layout.tsx:21"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-71376fec9cf74d56", "name": "Insecure pattern 'weak_hash' in apps/api/src/modules/auth/mfa-service.ts:52", "shortDescription": {"text": "Insecure pattern 'weak_hash' in apps/api/src/modules/auth/mfa-service.ts:52"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e38cb3e1481cbba0", "name": "Insecure pattern 'dangerous_innerhtml' in apps/web/src/app/layout.tsx:35", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/src/app/layout.tsx:35"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-78fa74d64f3c295c", "name": "Possible secret in apps/agent-gateway/scripts/live-skills-acceptance.ts", "shortDescription": {"text": "Possible secret in apps/agent-gateway/scripts/live-skills-acceptance.ts"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-cbc13016c9399897", "name": "Possible secret in apps/agent-gateway/scripts/live-read-acceptance.ts", "shortDescription": {"text": "Possible secret in apps/agent-gateway/scripts/live-read-acceptance.ts"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-28b5e08eec3c03cf", "name": "Possible secret in apps/agent-gateway/scripts/live-write-acceptance.ts", "shortDescription": {"text": "Possible secret in apps/agent-gateway/scripts/live-write-acceptance.ts"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-d1a6975dde599064", "name": "Possible secret in scripts/generate_wave1_column_mappings.mjs", "shortDescription": {"text": "Possible secret in scripts/generate_wave1_column_mappings.mjs"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-d5d29a4717cb00de", "name": "Insecure pattern 'node_child_process' in scripts/generate_wave1_column_mappings.mjs:31", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/generate_wave1_column_mappings.mjs:31"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e05a07cd541989d8", "name": "Insecure pattern 'node_child_process' in scripts/cowork-exchange/session-end.mjs:39", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/cowork-exchange/session-end.mjs:39"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-33bab82b4f114e49", "name": "Insecure pattern 'node_child_process' in scripts/cowork-exchange/apply-pending.mjs:30", "shortDescription": {"text": "Insecure pattern 'node_child_process' in scripts/cowork-exchange/apply-pending.mjs:30"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fecb1a0dba6d6293", "name": "Possible secret in db/scripts/setup_oci_vm_database.sh", "shortDescription": {"text": "Possible secret in db/scripts/setup_oci_vm_database.sh"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-047c4153cce5d6d6", "name": "Possible secret in db/scripts/seed-r2-personas.ts", "shortDescription": {"text": "Possible secret in db/scripts/seed-r2-personas.ts"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-370141cf96b5f35d", "name": "Possible secret in db/scripts/seed-test-admin.ts", "shortDescription": {"text": "Possible secret in db/scripts/seed-test-admin.ts"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-25609fc757eed186", "name": "Possible secret in db/scripts/seed-r1b-personas.ts", "shortDescription": {"text": "Possible secret in db/scripts/seed-r1b-personas.ts"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-7ddb4d2552bb8311", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-47019809066cf7f6", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-266162aa2c525a31", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c74b19f238850ddf", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ddbf78496f8bae16", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fe63deed1f1ef0e1", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e3905f4b1efcc980", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6357f23e4bed2efe", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v6 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0eef382a99b27134", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-51b5cf11a5e7bd6c", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-00413acf0f6becdc", "name": "Very large file: apps/api/src/modules/brownfield-wave-executor/engine.ts (1387 lines)", "shortDescription": {"text": "Very large file: apps/api/src/modules/brownfield-wave-executor/engine.ts (1387 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd20eb24efc0de46", "name": "Node manifest has dependencies but no lockfile: apps/showcase/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/showcase/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b06b8d86f24c77f9", "name": "Node manifest has dependencies but no lockfile: apps/api/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/api/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4a9eb7dc7c6e3880", "name": "Node manifest has dependencies but no lockfile: apps/web/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/web/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-63bc8083df8fafe7", "name": "Node manifest has dependencies but no lockfile: apps/agent-gateway/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/agent-gateway/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2699d5f16ae11282", "name": "Node manifest has dependencies but no lockfile: packages/shared/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/shared/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 274 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 57 placeholder/mock markers across 30 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c646c8f5a772ae8a", "name": "Commented-code block (12 lines) in eslint.config.mjs:50", "shortDescription": {"text": "Commented-code block (12 lines) in eslint.config.mjs:50"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1d1178b5b96fa9dc", "name": "Commented-code block (10 lines) in apps/showcase/src/components/status-pill.tsx:14", "shortDescription": {"text": "Commented-code block (10 lines) in apps/showcase/src/components/status-pill.tsx:14"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1fba8bed400f34e8", "name": "Commented-code block (6 lines) in apps/showcase/src/components/SystemHealthDashboard.tsx:4", "shortDescription": {"text": "Commented-code block (6 lines) in apps/showcase/src/components/SystemHealthDashboard.tsx:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6beade0b4ab4ad4c", "name": "Commented-code block (5 lines) in apps/api/tsup.config.ts:28", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/tsup.config.ts:28"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a3c63879811f6921", "name": "Commented-code block (6 lines) in apps/api/test/reference-sync-esco-skill-hierarchy.integration.test.ts:12", "shortDescription": {"text": "Commented-code block (6 lines) in apps/api/test/reference-sync-esco-skill-hierarchy.integration.test.ts:12"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0ce9ba1af805dc07", "name": "Commented-code block (5 lines) in apps/api/test/semantic-matching.integration.test.ts:11", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/test/semantic-matching.integration.test.ts:11"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-67978e29ab853e79", "name": "Commented-code block (5 lines) in apps/api/test/analytics.integration.test.ts:369", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/test/analytics.integration.test.ts:369"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3615858e9311b4bf", "name": "Commented-code block (5 lines) in apps/api/test/organization-unit-kpi-templates.integration.test.ts:47", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/test/organization-unit-kpi-templates.integration.test.ts:47"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-76d73cb6249b8697", "name": "Commented-code block (5 lines) in apps/api/test/me-sessions.integration.test.ts:5", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/test/me-sessions.integration.test.ts:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a1a7f2fff55cfd72", "name": "Commented-code block (6 lines) in apps/api/test/mfa-enroll-confirm.integration.test.ts:24", "shortDescription": {"text": "Commented-code block (6 lines) in apps/api/test/mfa-enroll-confirm.integration.test.ts:24"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cb1005dc23c74bc8", "name": "Commented-code block (8 lines) in apps/api/test/reconciliation-org-unit-kpi-templates.integration.test.ts:4", "shortDescription": {"text": "Commented-code block (8 lines) in apps/api/test/reconciliation-org-unit-kpi-templates.integration.test.ts:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c9c92966d02e28e1", "name": "Commented-code block (10 lines) in apps/api/test/occupation-skill-requirements.integration.test.ts:4", "shortDescription": {"text": "Commented-code block (10 lines) in apps/api/test/occupation-skill-requirements.integration.test.ts:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-de51efa3bfa3d134", "name": "Legacy-named symbol `skill_categories_legacy` in apps/api/test/upsert-sql-cw-b60-a-silent-skip.test.ts:112", "shortDescription": {"text": "Legacy-named symbol `skill_categories_legacy` in apps/api/test/upsert-sql-cw-b60-a-silent-skip.test.ts:112"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2bd20706be93b231", "name": "Commented-code block (5 lines) in apps/api/test/upsert-sql-cw-b60-a-silent-skip.test.ts:149", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/test/upsert-sql-cw-b60-a-silent-skip.test.ts:149"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0ba0f268b97fee7e", "name": "Commented-code block (6 lines) in apps/api/test/organization-unit-processes.integration.test.ts:6", "shortDescription": {"text": "Commented-code block (6 lines) in apps/api/test/organization-unit-processes.integration.test.ts:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7dbd0ded6d4e3c31", "name": "Commented-code block (31 lines) in apps/api/test/reconciliation-registry.integration.test.ts:16", "shortDescription": {"text": "Commented-code block (31 lines) in apps/api/test/reconciliation-registry.integration.test.ts:16"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3992942a4de6b91d", "name": "Commented-code block (6 lines) in apps/api/test/wave1-debug-scale-v4.test.ts:193", "shortDescription": {"text": "Commented-code block (6 lines) in apps/api/test/wave1-debug-scale-v4.test.ts:193"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ee1e3acedf677bc9", "name": "Commented-code block (5 lines) in apps/api/test/insights-recompute-cli.integration.test.ts:5", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/test/insights-recompute-cli.integration.test.ts:5"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-eead55820af49f35", "name": "Commented-code block (6 lines) in apps/api/test/wave1-cw-b60-tractable-targets.integration.test.ts:80", "shortDescription": {"text": "Commented-code block (6 lines) in apps/api/test/wave1-cw-b60-tractable-targets.integration.test.ts:80"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-54fdf85d86596245", "name": "Commented-code block (5 lines) in apps/api/test/transform-compiler.cast-enum.test.ts:68", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/test/transform-compiler.cast-enum.test.ts:68"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-59667f833b99b33d", "name": "Commented-code block (6 lines) in apps/api/test/skills.integration.test.ts:123", "shortDescription": {"text": "Commented-code block (6 lines) in apps/api/test/skills.integration.test.ts:123"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ead4923ed658b562", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/test/esco-connector.test.ts:11", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/test/esco-connector.test.ts:11"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c3860f8c2d1624b9", "name": "Commented-code block (6 lines) in apps/api/test/wave1-idempotency.test.ts:143", "shortDescription": {"text": "Commented-code block (6 lines) in apps/api/test/wave1-idempotency.test.ts:143"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-18cc2e755ea11035", "name": "Commented-code block (8 lines) in apps/api/test/reconciliation-learning-rehome.integration.test.ts:4", "shortDescription": {"text": "Commented-code block (8 lines) in apps/api/test/reconciliation-learning-rehome.integration.test.ts:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e3c9b5be7883dcdc", "name": "Commented-code block (7 lines) in apps/api/test/reconciliation-wave2-succession-branches.integration.test.ts:6", "shortDescription": {"text": "Commented-code block (7 lines) in apps/api/test/reconciliation-wave2-succession-branches.integration.test.ts:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-dd1282ad6b1dc6e7", "name": "Commented-code block (5 lines) in apps/api/test/content-blueprint-links.integration.test.ts:6", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/test/content-blueprint-links.integration.test.ts:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0b22fc09aa198da0", "name": "Commented-code block (5 lines) in apps/api/test/sdbi-perf-feedback.integration.test.ts:4", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/test/sdbi-perf-feedback.integration.test.ts:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7b651d5bb6704913", "name": "Commented-code block (5 lines) in apps/api/test/enterprise-typing.integration.test.ts:37", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/test/enterprise-typing.integration.test.ts:37"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3c75a71272d5b169", "name": "Commented-code block (5 lines) in apps/api/test/operating-models.integration.test.ts:72", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/test/operating-models.integration.test.ts:72"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b5387a51d76ef4f5", "name": "Commented-code block (5 lines) in apps/api/test/helpers/setup.ts:17", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/test/helpers/setup.ts:17"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-737097d888ca9e06", "name": "Commented-code block (5 lines) in apps/api/src/app.ts:270", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/src/app.ts:270"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-10de721473ef76c5", "name": "Commented-code block (6 lines) in apps/api/src/config/env.ts:55", "shortDescription": {"text": "Commented-code block (6 lines) in apps/api/src/config/env.ts:55"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-62336a36b2d1f03a", "name": "Commented-code block (7 lines) in apps/api/src/modules/users/service.ts:138", "shortDescription": {"text": "Commented-code block (7 lines) in apps/api/src/modules/users/service.ts:138"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-92e8b21bf4786d54", "name": "Commented-code block (7 lines) in apps/api/src/modules/auth/mfa-routes.ts:477", "shortDescription": {"text": "Commented-code block (7 lines) in apps/api/src/modules/auth/mfa-routes.ts:477"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9145f409700cffb1", "name": "Commented-code block (7 lines) in apps/api/src/modules/auth/mailer.ts:58", "shortDescription": {"text": "Commented-code block (7 lines) in apps/api/src/modules/auth/mailer.ts:58"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-91b3aa04108c5427", "name": "Commented-code block (7 lines) in apps/api/src/modules/auth/routes.ts:322", "shortDescription": {"text": "Commented-code block (7 lines) in apps/api/src/modules/auth/routes.ts:322"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-278dd449678d9721", "name": "Commented-code block (12 lines) in apps/api/src/modules/auth/service.ts:344", "shortDescription": {"text": "Commented-code block (12 lines) in apps/api/src/modules/auth/service.ts:344"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6543c0b5d2e6daa3", "name": "Commented-code block (5 lines) in apps/api/src/modules/auth/webauthn-service.ts:240", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/src/modules/auth/webauthn-service.ts:240"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5783d5f384b826af", "name": "Commented-code block (5 lines) in apps/api/src/modules/auth/mfa-service.ts:878", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/src/modules/auth/mfa-service.ts:878"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4291d1bccf34e21e", "name": "Commented-code block (5 lines) in apps/api/src/modules/analytics/repository.ts:187", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/src/modules/analytics/repository.ts:187"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9a448d8ba38eaaf1", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/modules/semantic-matching/voyage-client.ts:28", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/modules/semantic-matching/voyage-client.ts:28"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b86aac52b49b5843", "name": "Commented-code block (5 lines) in apps/api/src/modules/me/routes.ts:204", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/src/modules/me/routes.ts:204"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-348ea76dcda3f3a5", "name": "Commented-code block (5 lines) in apps/api/src/modules/brownfield-wave-executor/audit-rule-codes.ts:22", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/src/modules/brownfield-wave-executor/audit-rule-codes.ts:22"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0a79941ba58443ae", "name": "Commented-code block (5 lines) in apps/api/src/modules/brownfield-wave-executor/upsert-sql.ts:257", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/src/modules/brownfield-wave-executor/upsert-sql.ts:257"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-820316e5be89918e", "name": "Commented-code block (6 lines) in apps/api/src/modules/brownfield-wave-executor/transform-compiler.ts:296", "shortDescription": {"text": "Commented-code block (6 lines) in apps/api/src/modules/brownfield-wave-executor/transform-compiler.ts:296"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e92b075e0691e532", "name": "Commented-code block (6 lines) in apps/api/src/modules/brownfield-wave-executor/engine.ts:196", "shortDescription": {"text": "Commented-code block (6 lines) in apps/api/src/modules/brownfield-wave-executor/engine.ts:196"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-061792b1fc477f9b", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/modules/reference-sync/esco-connector.ts:66", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/modules/reference-sync/esco-connector.ts:66"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-80e82772e674a104", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/modules/reference-sync/istat-ateco-connector.ts:81", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/modules/reference-sync/istat-ateco-connector.ts:81"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-779d877513d14971", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/modules/reference-sync/service.ts:5", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/modules/reference-sync/service.ts:5"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bf7b15dc91783479", "name": "Commented-code block (8 lines) in apps/api/src/db/client.ts:27", "shortDescription": {"text": "Commented-code block (8 lines) in apps/api/src/db/client.ts:27"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f8d0e0cc4d0fe8fc", "name": "Commented-code block (7 lines) in apps/web/playwright.config.ts:8", "shortDescription": {"text": "Commented-code block (7 lines) in apps/web/playwright.config.ts:8"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f35ce3945eb6c36b", "name": "Commented-code block (7 lines) in apps/web/tests/e2e/ess-certifications-upload.spec.ts:25", "shortDescription": {"text": "Commented-code block (7 lines) in apps/web/tests/e2e/ess-certifications-upload.spec.ts:25"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a0014b336fe3b9e3", "name": "Commented-code block (5 lines) in apps/web/tests/e2e/login-mfa-enrollment.spec.ts:204", "shortDescription": {"text": "Commented-code block (5 lines) in apps/web/tests/e2e/login-mfa-enrollment.spec.ts:204"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0b823e1e8d2c465b", "name": "Commented-code block (7 lines) in apps/web/tests/e2e/auth.setup.ts:41", "shortDescription": {"text": "Commented-code block (7 lines) in apps/web/tests/e2e/auth.setup.ts:41"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b7b466659012c325", "name": "Commented-code block (8 lines) in apps/web/src/proxy.ts:4", "shortDescription": {"text": "Commented-code block (8 lines) in apps/web/src/proxy.ts:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e857c8ab91a41687", "name": "Commented-code block (10 lines) in apps/web/src/components/status-pill.tsx:14", "shortDescription": {"text": "Commented-code block (10 lines) in apps/web/src/components/status-pill.tsx:14"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b32239ab3c09e720", "name": "Commented-code block (6 lines) in apps/web/src/components/SystemHealthDashboard.tsx:4", "shortDescription": {"text": "Commented-code block (6 lines) in apps/web/src/components/SystemHealthDashboard.tsx:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-71f81b3e43a7468b", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/src/components/ContentMediaPanel.tsx:6", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/src/components/ContentMediaPanel.tsx:6"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8c863560b2f4b993", "name": "Commented-code block (7 lines) in apps/web/src/app/showcase/layout.tsx:6", "shortDescription": {"text": "Commented-code block (7 lines) in apps/web/src/app/showcase/layout.tsx:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2f66d6ae19c2f6ad", "name": "Commented-code block (6 lines) in apps/web/src/app/(authenticated)/me/security/page.tsx:318", "shortDescription": {"text": "Commented-code block (6 lines) in apps/web/src/app/(authenticated)/me/security/page.tsx:318"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0d9c56118bcace59", "name": "Commented-code block (5 lines) in apps/web/src/app/(authenticated)/me/certifications/page.tsx:37", "shortDescription": {"text": "Commented-code block (5 lines) in apps/web/src/app/(authenticated)/me/certifications/page.tsx:37"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b5fa1eafbf6e5611", "name": "Commented-code block (5 lines) in apps/web/src/app/(authenticated)/me/inbox/page.tsx:33", "shortDescription": {"text": "Commented-code block (5 lines) in apps/web/src/app/(authenticated)/me/inbox/page.tsx:33"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-985b8139a8089ea9", "name": "Commented-code block (6 lines) in apps/web/src/app/(authenticated)/content/page.tsx:25", "shortDescription": {"text": "Commented-code block (6 lines) in apps/web/src/app/(authenticated)/content/page.tsx:25"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-832078a6e602129e", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/agent-gateway/scripts/live-skills-acceptance.ts:113", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/agent-gateway/scripts/live-skills-acceptance.ts:113"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fc34873130a366c2", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/agent-gateway/scripts/live-read-acceptance.ts:61", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/agent-gateway/scripts/live-read-acceptance.ts:61"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f8aa0b6f8207d15d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/agent-gateway/scripts/live-write-acceptance.ts:12", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/agent-gateway/scripts/live-write-acceptance.ts:12"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9b56f1cc667cde0e", "name": "Commented-code block (6 lines) in apps/agent-gateway/src/sdk-agent.ts:47", "shortDescription": {"text": "Commented-code block (6 lines) in apps/agent-gateway/src/sdk-agent.ts:47"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b991fc239a156031", "name": "Commented-code block (8 lines) in apps/agent-gateway/src/server.ts:35", "shortDescription": {"text": "Commented-code block (8 lines) in apps/agent-gateway/src/server.ts:35"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a4513e91c9e03c22", "name": "Network/subprocess call without timeout or try/except \u2014 docs/kb/tools/build_index.py:148", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 docs/kb/tools/build_index.py:148"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0bed884e17be3ba9", "name": "Commented-code block (6 lines) in scripts/generate_wave1_seeds.mjs:41", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/generate_wave1_seeds.mjs:41"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-54a7c3fa33b52759", "name": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/run-wave1-fullscale.mjs:61", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/run-wave1-fullscale.mjs:61"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-61fb50b06373c7ea", "name": "Commented-code block (6 lines) in scripts/generate_wave1_column_mappings.mjs:78", "shortDescription": {"text": "Commented-code block (6 lines) in scripts/generate_wave1_column_mappings.mjs:78"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f2db2b016e37865c", "name": "Commented-code block (6 lines) in packages/shared/src/schemas/analytics.ts:45", "shortDescription": {"text": "Commented-code block (6 lines) in packages/shared/src/schemas/analytics.ts:45"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b0cc2308c1a2f9ec", "name": "Network/subprocess call without timeout or try/except \u2014 db/seeds/rtl-rebuild/11_rederive_b51_titles_roles.py:68", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 db/seeds/rtl-rebuild/11_rederive_b51_titles_roles.py:68"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3f45a82cc48e9df9", "name": "44 env vars used in code but missing from .env.example", "shortDescription": {"text": "44 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `ACC_EMAIL`, `ACC_PASSWORD`, `ACC_PROMPT`, `ADMIN_EMAIL`, `ADMIN_PASSWORD`, `AGENT_GATEWAY`, `AGENT_GATEWAY_APPROVAL_TIMEOUT_MS`, `AGENT_GATEWAY_AUDIT_PATH` + 36 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3bbafa4a7e995e0d", "name": "Dangling fetch: POST /api/v1/content/${documentId}/media (apps/web/src/components/ContentMediaPanel.tsx:47)", "shortDescription": {"text": "Dangling fetch: POST /api/v1/content/${documentId}/media (apps/web/src/components/ContentMediaPanel.tsx:47)"}, "fullDescription": {"text": "`apps/web/src/components/ContentMediaPanel.tsx:47` calls `POST /api/v1/content/${documentId}/media` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/v1/content/<p>/media`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-968d4311ce08cfe9", "name": "Unused endpoint: GET /openapi.json", "shortDescription": {"text": "Unused endpoint: GET /openapi.json"}, "fullDescription": {"text": "`apps/api/src/app.ts` declares `GET /openapi.json` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`apps/api/src/modules/successor-readiness/routes.ts` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ca5756175765b49d", "name": "Unused endpoint: GET /:id", "shortDescription": {"text": "Unused endpoint: GET /:id"}, "fullDescription": {"text": "`apps/api/src/modules/successor-readiness/routes.ts` declares `GET /:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a009b1a56794f45", "name": "Unused endpoint: POST /", "shortDescription": {"text": "Unused endpoint: POST /"}, "fullDescription": {"text": "`apps/api/src/modules/successor-readiness/routes.ts` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-95ed5dbf01be17df", "name": "Unused endpoint: GET /readiness-distribution", "shortDescription": {"text": "Unused endpoint: GET /readiness-distribution"}, "fullDescription": {"text": "`apps/api/src/modules/successor-candidates/routes.ts` declares `GET /readiness-distribution` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5fbc954f63526821", "name": "Unused endpoint: PATCH /:id", "shortDescription": {"text": "Unused endpoint: PATCH /:id"}, "fullDescription": {"text": "`apps/api/src/modules/successor-candidates/routes.ts` declares `PATCH /:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a61c112b611f4bb", "name": "Unused endpoint: DELETE /:id", "shortDescription": {"text": "Unused endpoint: DELETE /:id"}, "fullDescription": {"text": "`apps/api/src/modules/successor-candidates/routes.ts` declares `DELETE /:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-905a9a415644eab4", "name": "Unused endpoint: GET /:id/roles", "shortDescription": {"text": "Unused endpoint: GET /:id/roles"}, "fullDescription": {"text": "`apps/api/src/modules/users/routes.ts` declares `GET /:id/roles` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-35d0de6979ab553d", "name": "Unused endpoint: POST /:id/roles", "shortDescription": {"text": "Unused endpoint: POST /:id/roles"}, "fullDescription": {"text": "`apps/api/src/modules/users/routes.ts` declares `POST /:id/roles` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-84a7c276fb0509b4", "name": "Unused endpoint: DELETE /:id/roles/:grantId", "shortDescription": {"text": "Unused endpoint: DELETE /:id/roles/:grantId"}, "fullDescription": {"text": "`apps/api/src/modules/users/routes.ts` declares `DELETE /:id/roles/:grantId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e1b7bee247ffc801", "name": "Unused endpoint: GET /summary", "shortDescription": {"text": "Unused endpoint: GET /summary"}, "fullDescription": {"text": "`apps/api/src/modules/visualization-graphs/routes.ts` declares `GET /summary` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e9d369baeaf2e09", "name": "Unused endpoint: GET /:id/render", "shortDescription": {"text": "Unused endpoint: GET /:id/render"}, "fullDescription": {"text": "`apps/api/src/modules/visualization-graphs/routes.ts` declares `GET /:id/render` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ab9bf5db6820af4", "name": "Unused endpoint: GET /models", "shortDescription": {"text": "Unused endpoint: GET /models"}, "fullDescription": {"text": "`apps/api/src/modules/predictions/routes.ts` declares `GET /models` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-93ed5b83d7a7324b", "name": "Unused endpoint: GET /models/:id", "shortDescription": {"text": "Unused endpoint: GET /models/:id"}, "fullDescription": {"text": "`apps/api/src/modules/predictions/routes.ts` declares `GET /models/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fc1f9e4aa984943b", "name": "Unused endpoint: GET /:id/intelligence-profile", "shortDescription": {"text": "Unused endpoint: GET /:id/intelligence-profile"}, "fullDescription": {"text": "`apps/api/src/modules/positions/routes.ts` declares `GET /:id/intelligence-profile` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-363cac305f124ca4", "name": "Unused endpoint: GET /:id/skills", "shortDescription": {"text": "Unused endpoint: GET /:id/skills"}, "fullDescription": {"text": "`apps/api/src/modules/positions/routes.ts` declares `GET /:id/skills` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-23d3288a1c1f3586", "name": "Unused endpoint: POST /:id/skills", "shortDescription": {"text": "Unused endpoint: POST /:id/skills"}, "fullDescription": {"text": "`apps/api/src/modules/positions/routes.ts` declares `POST /:id/skills` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4e1985b82a7fe4c8", "name": "Unused endpoint: DELETE /:id/skills/:skillId", "shortDescription": {"text": "Unused endpoint: DELETE /:id/skills/:skillId"}, "fullDescription": {"text": "`apps/api/src/modules/positions/routes.ts` declares `DELETE /:id/skills/:skillId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5a02a6e2bfa9114b", "name": "Unused endpoint: GET /:id/kpis", "shortDescription": {"text": "Unused endpoint: GET /:id/kpis"}, "fullDescription": {"text": "`apps/api/src/modules/positions/routes.ts` declares `GET /:id/kpis` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d9621519bcba4544", "name": "Unused endpoint: GET /profiles/:positionId", "shortDescription": {"text": "Unused endpoint: GET /profiles/:positionId"}, "fullDescription": {"text": "`apps/api/src/modules/compensation/routes.ts` declares `GET /profiles/:positionId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-273559375dc00fd4", "name": "Unused endpoint: GET /reward-gates", "shortDescription": {"text": "Unused endpoint: GET /reward-gates"}, "fullDescription": {"text": "`apps/api/src/modules/compensation/routes.ts` declares `GET /reward-gates` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2458528b423c4e8e", "name": "Unused endpoint: GET /distribution", "shortDescription": {"text": "Unused endpoint: GET /distribution"}, "fullDescription": {"text": "`apps/api/src/modules/compensation/routes.ts` declares `GET /distribution` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c55d68874e810e1a", "name": "Unused endpoint: POST /recommendations", "shortDescription": {"text": "Unused endpoint: POST /recommendations"}, "fullDescription": {"text": "`apps/api/src/modules/compensation/routes.ts` declares `POST /recommendations` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ec4172bf6f044fd", "name": "Unused endpoint: POST /handoff-records", "shortDescription": {"text": "Unused endpoint: POST /handoff-records"}, "fullDescription": {"text": "`apps/api/src/modules/compensation/routes.ts` declares `POST /handoff-records` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-67d28fa8cd6bb12f", "name": "Unused endpoint: PUT /", "shortDescription": {"text": "Unused endpoint: PUT /"}, "fullDescription": {"text": "`apps/api/src/modules/blueprint-overrides/routes.ts` declares `PUT /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be95234cd7d6664a", "name": "Unused endpoint: POST /enroll", "shortDescription": {"text": "Unused endpoint: POST /enroll"}, "fullDescription": {"text": "`apps/api/src/modules/auth/mfa-routes.ts` declares `POST /enroll` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c1fa622edf221471", "name": "Unused endpoint: POST /verify-setup", "shortDescription": {"text": "Unused endpoint: POST /verify-setup"}, "fullDescription": {"text": "`apps/api/src/modules/auth/mfa-routes.ts` declares `POST /verify-setup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a825cc12e8fcb595", "name": "Unused endpoint: GET /factors", "shortDescription": {"text": "Unused endpoint: GET /factors"}, "fullDescription": {"text": "`apps/api/src/modules/auth/mfa-routes.ts` declares `GET /factors` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-409fcab88dc46993", "name": "Unused endpoint: DELETE /factors/:factorId", "shortDescription": {"text": "Unused endpoint: DELETE /factors/:factorId"}, "fullDescription": {"text": "`apps/api/src/modules/auth/mfa-routes.ts` declares `DELETE /factors/:factorId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-95c7570927041b3e", "name": "Unused endpoint: POST /email-otp/enroll", "shortDescription": {"text": "Unused endpoint: POST /email-otp/enroll"}, "fullDescription": {"text": "`apps/api/src/modules/auth/mfa-routes.ts` declares `POST /email-otp/enroll` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-445467dbec719f6a", "name": "Unused endpoint: POST /email-otp/verify-setup", "shortDescription": {"text": "Unused endpoint: POST /email-otp/verify-setup"}, "fullDescription": {"text": "`apps/api/src/modules/auth/mfa-routes.ts` declares `POST /email-otp/verify-setup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-438bdc953e469259", "name": "Unused endpoint: POST /email-otp/resend", "shortDescription": {"text": "Unused endpoint: POST /email-otp/resend"}, "fullDescription": {"text": "`apps/api/src/modules/auth/mfa-routes.ts` declares `POST /email-otp/resend` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-84abeaddf7651a1b", "name": "Unused endpoint: POST /email-otp/resend-login", "shortDescription": {"text": "Unused endpoint: POST /email-otp/resend-login"}, "fullDescription": {"text": "`apps/api/src/modules/auth/mfa-routes.ts` declares `POST /email-otp/resend-login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e0a40ad3ae274acd", "name": "Unused endpoint: POST /enroll-confirm", "shortDescription": {"text": "Unused endpoint: POST /enroll-confirm"}, "fullDescription": {"text": "`apps/api/src/modules/auth/mfa-routes.ts` declares `POST /enroll-confirm` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-feda27069b2a0d9d", "name": "Unused endpoint: POST /enroll-confirm/resend", "shortDescription": {"text": "Unused endpoint: POST /enroll-confirm/resend"}, "fullDescription": {"text": "`apps/api/src/modules/auth/mfa-routes.ts` declares `POST /enroll-confirm/resend` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49aa304a553d5594", "name": "Unused endpoint: POST /sms-otp/enroll", "shortDescription": {"text": "Unused endpoint: POST /sms-otp/enroll"}, "fullDescription": {"text": "`apps/api/src/modules/auth/mfa-routes.ts` declares `POST /sms-otp/enroll` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-90fb20c139c7bf5c", "name": "Unused endpoint: POST /sms-otp/verify-setup", "shortDescription": {"text": "Unused endpoint: POST /sms-otp/verify-setup"}, "fullDescription": {"text": "`apps/api/src/modules/auth/mfa-routes.ts` declares `POST /sms-otp/verify-setup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d3c3a0e9d73b6666", "name": "Unused endpoint: POST /sms-otp/resend", "shortDescription": {"text": "Unused endpoint: POST /sms-otp/resend"}, "fullDescription": {"text": "`apps/api/src/modules/auth/mfa-routes.ts` declares `POST /sms-otp/resend` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f0b2c9c50a87803", "name": "Unused endpoint: POST /sms-otp/resend-login", "shortDescription": {"text": "Unused endpoint: POST /sms-otp/resend-login"}, "fullDescription": {"text": "`apps/api/src/modules/auth/mfa-routes.ts` declares `POST /sms-otp/resend-login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ade4187f8673f090", "name": "Unused endpoint: POST /verify-login", "shortDescription": {"text": "Unused endpoint: POST /verify-login"}, "fullDescription": {"text": "`apps/api/src/modules/auth/mfa-routes.ts` declares `POST /verify-login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-180e66f93f5c3abc", "name": "Unused endpoint: POST /recovery-codes", "shortDescription": {"text": "Unused endpoint: POST /recovery-codes"}, "fullDescription": {"text": "`apps/api/src/modules/auth/mfa-routes.ts` declares `POST /recovery-codes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d6dfaec659ebb180", "name": "Unused endpoint: GET /recovery-codes", "shortDescription": {"text": "Unused endpoint: GET /recovery-codes"}, "fullDescription": {"text": "`apps/api/src/modules/auth/mfa-routes.ts` declares `GET /recovery-codes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b432eaf9b6ecb7a7", "name": "Unused endpoint: POST /webauthn/registration/options", "shortDescription": {"text": "Unused endpoint: POST /webauthn/registration/options"}, "fullDescription": {"text": "`apps/api/src/modules/auth/mfa-routes.ts` declares `POST /webauthn/registration/options` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0637609ee6599fd9", "name": "Unused endpoint: POST /webauthn/registration/verify", "shortDescription": {"text": "Unused endpoint: POST /webauthn/registration/verify"}, "fullDescription": {"text": "`apps/api/src/modules/auth/mfa-routes.ts` declares `POST /webauthn/registration/verify` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-69652c2a485543f2", "name": "Unused endpoint: POST /webauthn/authentication/options", "shortDescription": {"text": "Unused endpoint: POST /webauthn/authentication/options"}, "fullDescription": {"text": "`apps/api/src/modules/auth/mfa-routes.ts` declares `POST /webauthn/authentication/options` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4a4758c24cfa01c3", "name": "Unused endpoint: POST /webauthn/authentication/verify", "shortDescription": {"text": "Unused endpoint: POST /webauthn/authentication/verify"}, "fullDescription": {"text": "`apps/api/src/modules/auth/mfa-routes.ts` declares `POST /webauthn/authentication/verify` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-618721b912bad1c2", "name": "Unused endpoint: POST /login", "shortDescription": {"text": "Unused endpoint: POST /login"}, "fullDescription": {"text": "`apps/api/src/modules/auth/routes.ts` declares `POST /login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7ce17d6b092a81ca", "name": "Unused endpoint: POST /refresh", "shortDescription": {"text": "Unused endpoint: POST /refresh"}, "fullDescription": {"text": "`apps/api/src/modules/auth/routes.ts` declares `POST /refresh` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-99fc36db98c134ce", "name": "Unused endpoint: POST /logout", "shortDescription": {"text": "Unused endpoint: POST /logout"}, "fullDescription": {"text": "`apps/api/src/modules/auth/routes.ts` declares `POST /logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd1dc91abf32142d", "name": "Unused endpoint: GET /me", "shortDescription": {"text": "Unused endpoint: GET /me"}, "fullDescription": {"text": "`apps/api/src/modules/auth/routes.ts` declares `GET /me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20140"}, "properties": {"repository": "Spen-Zosky/heuresys-advanced", "repoUrl": "https://github.com/Spen-Zosky/heuresys-advanced", "branch": "main"}, "results": [{"ruleId": "scanner-058199a40a7f335d", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 ux-design/heuresys_uxix_brand_identity_bundle_v1/code_examples/src/components/dashboard/Sidebar.tsx:72"}, "properties": {"repobilityId": "d1dc4833afb17419", "scanner": "scanner-primary", "fingerprint": "058199a40a7f335d", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-68dec585bb66d7b4", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 ux-design/heuresys_uxix_brand_identity_bundle_v1/code_examples/src/components/dashboard/DBSupervisorSidebar.tsx:46"}, "properties": {"repobilityId": "f02a9acd404ac8a0", "scanner": "scanner-primary", "fingerprint": "68dec585bb66d7b4", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-db455a272417d72f", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/showcase/src/app/layout.tsx:21"}, "properties": {"repobilityId": "63e18eee7288251b", "scanner": "scanner-primary", "fingerprint": "db455a272417d72f", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-62c536edc6b71734", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/modules/insights/recompute-cli.ts:19"}, "properties": {"repobilityId": "f90a4b74b98aacf1", "scanner": "scanner-primary", "fingerprint": "62c536edc6b71734", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-453afaa6a1aae7eb", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/modules/semantic-matching/backfill.ts:48"}, "properties": {"repobilityId": "5b73dcdb6e92136f", "scanner": "scanner-primary", "fingerprint": "453afaa6a1aae7eb", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8f07ef8e4501f2d4", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/modules/reference-sync/sync-cli.ts:18"}, "properties": {"repobilityId": "da58835a5a8461e2", "scanner": "scanner-primary", "fingerprint": "8f07ef8e4501f2d4", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-eaec05515d245641", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/web/tests/e2e/global-teardown.ts:49"}, "properties": {"repobilityId": "7e60c25167c81eae", "scanner": "scanner-primary", "fingerprint": "eaec05515d245641", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-4ed44ce8c00fe6f6", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/web/scripts/check-i18n-parity.ts:73"}, "properties": {"repobilityId": "be5067418dae45b3", "scanner": "scanner-primary", "fingerprint": "4ed44ce8c00fe6f6", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-81c0bda4cc81d56a", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/components/ContentMediaPanel.tsx:139"}, "properties": {"repobilityId": "c4d4a6a8218712b3", "scanner": "scanner-primary", "fingerprint": "81c0bda4cc81d56a", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-018982112d373dac", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/src/app/layout.tsx:35"}, "properties": {"repobilityId": "eff0c5cb869a98ef", "scanner": "scanner-primary", "fingerprint": "018982112d373dac", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-054181325e7a4596", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/app/showcase/palettes/page.tsx:163"}, "properties": {"repobilityId": "4c217ab26ff492be", "scanner": "scanner-primary", "fingerprint": "054181325e7a4596", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-17558fee64b19812", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/app/(authenticated)/layout.tsx:238"}, "properties": {"repobilityId": "783d30fc295b579f", "scanner": "scanner-primary", "fingerprint": "17558fee64b19812", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-b491dd94c0bb6f91", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/app/(authenticated)/dashboard/page.tsx:156"}, "properties": {"repobilityId": "c33eb4876271423e", "scanner": "scanner-primary", "fingerprint": "b491dd94c0bb6f91", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-a28aeac89349d7c3", "level": "none", "message": {"text": "`truncate` class without `title=` for hover reveal \u2014 apps/web/src/app/(authenticated)/me/handbook/[id]/page.tsx:116"}, "properties": {"repobilityId": "79c2da71fa92a9ff", "scanner": "scanner-primary", "fingerprint": "a28aeac89349d7c3", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.truncate.no-title"]}}, {"ruleId": "scanner-c884c6d69dbf7282", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/src/app/(authenticated)/content/page.tsx:56"}, "properties": {"repobilityId": "9bae6480865138b9", "scanner": "scanner-primary", "fingerprint": "c884c6d69dbf7282", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-e2bafa513b8f3c99", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/agent-gateway/scripts/live-skills-acceptance.ts:119"}, "properties": {"repobilityId": "2b911ec246448a7f", "scanner": "scanner-primary", "fingerprint": "e2bafa513b8f3c99", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5a77f500651fb547", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/agent-gateway/scripts/live-read-acceptance.ts:67"}, "properties": {"repobilityId": "d9e82efeb17e6ce9", "scanner": "scanner-primary", "fingerprint": "5a77f500651fb547", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3691dc41fe47f462", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/agent-gateway/scripts/smoke-sdk-auth.ts:21"}, "properties": {"repobilityId": "2720af47d21fc673", "scanner": "scanner-primary", "fingerprint": "3691dc41fe47f462", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-69e3dd173e418841", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/agent-gateway/scripts/live-write-acceptance.ts:88"}, "properties": {"repobilityId": "fca26c636af28e58", "scanner": "scanner-primary", "fingerprint": "69e3dd173e418841", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b13705d45bb1df71", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/agent-gateway/src/server.ts:170"}, "properties": {"repobilityId": "62d0e97769be2aa2", "scanner": "scanner-primary", "fingerprint": "b13705d45bb1df71", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5de5ef5cc07b98fb", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 db/scripts/seed-service-user.ts:74"}, "properties": {"repobilityId": "6f522829637bcf01", "scanner": "scanner-primary", "fingerprint": "5de5ef5cc07b98fb", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-676fb81c3123ef9b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 db/scripts/seed-reference-bank.ts:187"}, "properties": {"repobilityId": "2b876ed2cadbc27c", "scanner": "scanner-primary", "fingerprint": "676fb81c3123ef9b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-26cc11ecc9f8f93a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 db/scripts/seed-r2-personas.ts:143"}, "properties": {"repobilityId": "a858e41793f2a6b3", "scanner": "scanner-primary", "fingerprint": "26cc11ecc9f8f93a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5b45edb0717e333f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 db/scripts/seed-test-admin.ts:190"}, "properties": {"repobilityId": "2456348ce5d610c5", "scanner": "scanner-primary", "fingerprint": "5b45edb0717e333f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8ead6cb1682d09a6", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 db/scripts/seed-r1b-personas.ts:135"}, "properties": {"repobilityId": "04688e2068b91ef2", "scanner": "scanner-primary", "fingerprint": "8ead6cb1682d09a6", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6aad62a629d99730", "level": "warning", "message": {"text": "Privileged port 38 in use"}, "properties": {"repobilityId": "b7214bb254c5881d", "scanner": "scanner-primary", "fingerprint": "6aad62a629d99730", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "docs/kb/index_paths.yaml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-74c104e9320e311f", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/showcase/src/app/layout.tsx:21"}, "properties": {"repobilityId": "436421246009e609", "scanner": "scanner-primary", "fingerprint": "74c104e9320e311f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/showcase/src/app/layout.tsx"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-71376fec9cf74d56", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in apps/api/src/modules/auth/mfa-service.ts:52"}, "properties": {"repobilityId": "11372ceb02922882", "scanner": "scanner-primary", "fingerprint": "71376fec9cf74d56", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/src/modules/auth/mfa-service.ts"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-e38cb3e1481cbba0", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/src/app/layout.tsx:35"}, "properties": {"repobilityId": "346ebefd3b315f3f", "scanner": "scanner-primary", "fingerprint": "e38cb3e1481cbba0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/src/app/layout.tsx"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-78fa74d64f3c295c", "level": "error", "message": {"text": "Possible secret in apps/agent-gateway/scripts/live-skills-acceptance.ts"}, "properties": {"repobilityId": "1e51b516c6babe97", "scanner": "scanner-primary", "fingerprint": "78fa74d64f3c295c", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/agent-gateway/scripts/live-skills-acceptance.ts"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-cbc13016c9399897", "level": "error", "message": {"text": "Possible secret in apps/agent-gateway/scripts/live-read-acceptance.ts"}, "properties": {"repobilityId": "f0b826c1aa95e66f", "scanner": "scanner-primary", "fingerprint": "cbc13016c9399897", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/agent-gateway/scripts/live-read-acceptance.ts"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-28b5e08eec3c03cf", "level": "error", "message": {"text": "Possible secret in apps/agent-gateway/scripts/live-write-acceptance.ts"}, "properties": {"repobilityId": "336b98a28436afb0", "scanner": "scanner-primary", "fingerprint": "28b5e08eec3c03cf", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/agent-gateway/scripts/live-write-acceptance.ts"}, "region": {"startLine": 20}}}]}, {"ruleId": "scanner-d1a6975dde599064", "level": "error", "message": {"text": "Possible secret in scripts/generate_wave1_column_mappings.mjs"}, "properties": {"repobilityId": "3061580104954ee5", "scanner": "scanner-primary", "fingerprint": "d1a6975dde599064", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/generate_wave1_column_mappings.mjs"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-d5d29a4717cb00de", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/generate_wave1_column_mappings.mjs:31"}, "properties": {"repobilityId": "3a30e586abb99cf9", "scanner": "scanner-primary", "fingerprint": "d5d29a4717cb00de", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/generate_wave1_column_mappings.mjs"}, "region": {"startLine": 31}}}]}, {"ruleId": "scanner-e05a07cd541989d8", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/cowork-exchange/session-end.mjs:39"}, "properties": {"repobilityId": "ba0952aa8a286848", "scanner": "scanner-primary", "fingerprint": "e05a07cd541989d8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/cowork-exchange/session-end.mjs"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-33bab82b4f114e49", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in scripts/cowork-exchange/apply-pending.mjs:30"}, "properties": {"repobilityId": "1b994c8fa9de325d", "scanner": "scanner-primary", "fingerprint": "33bab82b4f114e49", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/cowork-exchange/apply-pending.mjs"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-fecb1a0dba6d6293", "level": "error", "message": {"text": "Possible secret in db/scripts/setup_oci_vm_database.sh"}, "properties": {"repobilityId": "3e2c76bf5e2c847a", "scanner": "scanner-primary", "fingerprint": "fecb1a0dba6d6293", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "db/scripts/setup_oci_vm_database.sh"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-047c4153cce5d6d6", "level": "error", "message": {"text": "Possible secret in db/scripts/seed-r2-personas.ts"}, "properties": {"repobilityId": "5f3d46bd413e1fe0", "scanner": "scanner-primary", "fingerprint": "047c4153cce5d6d6", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "db/scripts/seed-r2-personas.ts"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-370141cf96b5f35d", "level": "error", "message": {"text": "Possible secret in db/scripts/seed-test-admin.ts"}, "properties": {"repobilityId": "df2660cd4021e655", "scanner": "scanner-primary", "fingerprint": "370141cf96b5f35d", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "db/scripts/seed-test-admin.ts"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-25609fc757eed186", "level": "error", "message": {"text": "Possible secret in db/scripts/seed-r1b-personas.ts"}, "properties": {"repobilityId": "0eac38d1b58a1ca5", "scanner": "scanner-primary", "fingerprint": "25609fc757eed186", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "db/scripts/seed-r1b-personas.ts"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-7ddb4d2552bb8311", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "36ac515c5bc07890", "scanner": "scanner-primary", "fingerprint": "7ddb4d2552bb8311", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/shell-tests.yml"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-47019809066cf7f6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5cf5b636b1fe7434", "scanner": "scanner-primary", "fingerprint": "47019809066cf7f6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/typecheck.yml"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-47019809066cf7f6", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "380893527c8ec28b", "scanner": "scanner-primary", "fingerprint": "47019809066cf7f6", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/typecheck.yml"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-47019809066cf7f6", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "644675ba412e074c", "scanner": "scanner-primary", "fingerprint": "47019809066cf7f6", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/typecheck.yml"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-266162aa2c525a31", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "5c15fc5d75bc0d4a", "scanner": "scanner-primary", "fingerprint": "266162aa2c525a31", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/lint.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-266162aa2c525a31", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d6f011547df7ee21", "scanner": "scanner-primary", "fingerprint": "266162aa2c525a31", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/lint.yml"}, "region": {"startLine": 42}}}]}, {"ruleId": "scanner-266162aa2c525a31", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "93ceda53feb42d55", "scanner": "scanner-primary", "fingerprint": "266162aa2c525a31", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/lint.yml"}, "region": {"startLine": 47}}}]}, {"ruleId": "scanner-c74b19f238850ddf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "cd903616984623ac", "scanner": "scanner-primary", "fingerprint": "c74b19f238850ddf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test-integration.yml"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-c74b19f238850ddf", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "4021bced74f99a55", "scanner": "scanner-primary", "fingerprint": "c74b19f238850ddf", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test-integration.yml"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-c74b19f238850ddf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "9f189d7d89cf4804", "scanner": "scanner-primary", "fingerprint": "c74b19f238850ddf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test-integration.yml"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-c74b19f238850ddf", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "27b903b2656bf316", "scanner": "scanner-primary", "fingerprint": "c74b19f238850ddf", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/test-integration.yml"}, "region": {"startLine": 81}}}]}, {"ruleId": "scanner-ddbf78496f8bae16", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f08ab906154e25c9", "scanner": "scanner-primary", "fingerprint": "ddbf78496f8bae16", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/i18n-parity.yml"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-ddbf78496f8bae16", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f718bb1dd3a7b5d5", "scanner": "scanner-primary", "fingerprint": "ddbf78496f8bae16", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/i18n-parity.yml"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-ddbf78496f8bae16", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "e4d56accde8f245f", "scanner": "scanner-primary", "fingerprint": "ddbf78496f8bae16", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/i18n-parity.yml"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-fe63deed1f1ef0e1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "a02166e67c355606", "scanner": "scanner-primary", "fingerprint": "fe63deed1f1ef0e1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-web.yml"}, "region": {"startLine": 41}}}]}, {"ruleId": "scanner-fe63deed1f1ef0e1", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "466bcee3f46e004c", "scanner": "scanner-primary", "fingerprint": "fe63deed1f1ef0e1", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-web.yml"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-fe63deed1f1ef0e1", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "86e67ed37cc54563", "scanner": "scanner-primary", "fingerprint": "fe63deed1f1ef0e1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-web.yml"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-e3905f4b1efcc980", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "932b4c125b2da8e5", "scanner": "scanner-primary", "fingerprint": "e3905f4b1efcc980", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/playwright-smoke.yml"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-e3905f4b1efcc980", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "750a5758a221b270", "scanner": "scanner-primary", "fingerprint": "e3905f4b1efcc980", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/playwright-smoke.yml"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-e3905f4b1efcc980", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "bf59a8aa3394078b", "scanner": "scanner-primary", "fingerprint": "e3905f4b1efcc980", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/playwright-smoke.yml"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-e3905f4b1efcc980", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "03af5a1403744a16", "scanner": "scanner-primary", "fingerprint": "e3905f4b1efcc980", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/playwright-smoke.yml"}, "region": {"startLine": 143}}}]}, {"ruleId": "scanner-6357f23e4bed2efe", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "73f57442f52b212b", "scanner": "scanner-primary", "fingerprint": "6357f23e4bed2efe", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/showcase.yml"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-6357f23e4bed2efe", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "73f57442f52b212b", "scanner": "scanner-primary", "fingerprint": "6357f23e4bed2efe", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/showcase.yml"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-6357f23e4bed2efe", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c70657dfcce51a46", "scanner": "scanner-primary", "fingerprint": "6357f23e4bed2efe", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/showcase.yml"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-6357f23e4bed2efe", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "c0393cca61f098ab", "scanner": "scanner-primary", "fingerprint": "6357f23e4bed2efe", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/showcase.yml"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-6357f23e4bed2efe", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "7dd452c875e4b4c7", "scanner": "scanner-primary", "fingerprint": "6357f23e4bed2efe", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/showcase.yml"}, "region": {"startLine": 91}}}]}, {"ruleId": "scanner-0eef382a99b27134", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "83913305c6334e0e", "scanner": "scanner-primary", "fingerprint": "0eef382a99b27134", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/showcase.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-51b5cf11a5e7bd6c", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "91a240c40347cb2d", "scanner": "scanner-primary", "fingerprint": "51b5cf11a5e7bd6c", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/shared/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-00413acf0f6becdc", "level": "note", "message": {"text": "Very large file: apps/api/src/modules/brownfield-wave-executor/engine.ts (1387 lines)"}, "properties": {"repobilityId": "173ba67be576380f", "scanner": "scanner-primary", "fingerprint": "00413acf0f6becdc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-fd20eb24efc0de46", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/showcase/package.json"}, "properties": {"repobilityId": "2668fc536d06cf3f", "scanner": "scanner-primary", "fingerprint": "fd20eb24efc0de46", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/showcase/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b06b8d86f24c77f9", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/api/package.json"}, "properties": {"repobilityId": "ce77cd34ed0306d4", "scanner": "scanner-primary", "fingerprint": "b06b8d86f24c77f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4a9eb7dc7c6e3880", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/web/package.json"}, "properties": {"repobilityId": "6c1704bf24cf19ac", "scanner": "scanner-primary", "fingerprint": "4a9eb7dc7c6e3880", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-63bc8083df8fafe7", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/agent-gateway/package.json"}, "properties": {"repobilityId": "1d5a0c4b1f1ccdbf", "scanner": "scanner-primary", "fingerprint": "63bc8083df8fafe7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/agent-gateway/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2699d5f16ae11282", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/shared/package.json"}, "properties": {"repobilityId": "37ac218a4ef9b430", "scanner": "scanner-primary", "fingerprint": "2699d5f16ae11282", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/shared/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "1ce7bf3a1c289d60", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "5412a8fdd3fbdc53", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "073786397d542d63", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "3c65c8aaa3be1753", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "cce1bd6c626cab88", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "16ab5dc32ac6652d", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-c646c8f5a772ae8a", "level": "none", "message": {"text": "Commented-code block (12 lines) in eslint.config.mjs:50"}, "properties": {"repobilityId": "de2752689444ca8f", "scanner": "scanner-primary", "fingerprint": "c646c8f5a772ae8a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1d1178b5b96fa9dc", "level": "none", "message": {"text": "Commented-code block (10 lines) in apps/showcase/src/components/status-pill.tsx:14"}, "properties": {"repobilityId": "b2b74495b212980c", "scanner": "scanner-primary", "fingerprint": "1d1178b5b96fa9dc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1fba8bed400f34e8", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/showcase/src/components/SystemHealthDashboard.tsx:4"}, "properties": {"repobilityId": "3d25d0fb15630d34", "scanner": "scanner-primary", "fingerprint": "1fba8bed400f34e8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6beade0b4ab4ad4c", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/tsup.config.ts:28"}, "properties": {"repobilityId": "d3abf4a06034b143", "scanner": "scanner-primary", "fingerprint": "6beade0b4ab4ad4c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a3c63879811f6921", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/api/test/reference-sync-esco-skill-hierarchy.integration.test.ts:12"}, "properties": {"repobilityId": "e9e443966735ccc8", "scanner": "scanner-primary", "fingerprint": "a3c63879811f6921", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0ce9ba1af805dc07", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/test/semantic-matching.integration.test.ts:11"}, "properties": {"repobilityId": "4311625d01946c7b", "scanner": "scanner-primary", "fingerprint": "0ce9ba1af805dc07", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-67978e29ab853e79", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/test/analytics.integration.test.ts:369"}, "properties": {"repobilityId": "2cbf730492e1d1ab", "scanner": "scanner-primary", "fingerprint": "67978e29ab853e79", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3615858e9311b4bf", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/test/organization-unit-kpi-templates.integration.test.ts:47"}, "properties": {"repobilityId": "aa35e61008c84cff", "scanner": "scanner-primary", "fingerprint": "3615858e9311b4bf", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-76d73cb6249b8697", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/test/me-sessions.integration.test.ts:5"}, "properties": {"repobilityId": "3ed709b961e5e2a6", "scanner": "scanner-primary", "fingerprint": "76d73cb6249b8697", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a1a7f2fff55cfd72", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/api/test/mfa-enroll-confirm.integration.test.ts:24"}, "properties": {"repobilityId": "998897050a84c89b", "scanner": "scanner-primary", "fingerprint": "a1a7f2fff55cfd72", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cb1005dc23c74bc8", "level": "none", "message": {"text": "Commented-code block (8 lines) in apps/api/test/reconciliation-org-unit-kpi-templates.integration.test.ts:4"}, "properties": {"repobilityId": "3c9c27c2bb1d32ad", "scanner": "scanner-primary", "fingerprint": "cb1005dc23c74bc8", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c9c92966d02e28e1", "level": "none", "message": {"text": "Commented-code block (10 lines) in apps/api/test/occupation-skill-requirements.integration.test.ts:4"}, "properties": {"repobilityId": "999df5d4ad31c607", "scanner": "scanner-primary", "fingerprint": "c9c92966d02e28e1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-de51efa3bfa3d134", "level": "note", "message": {"text": "Legacy-named symbol `skill_categories_legacy` in apps/api/test/upsert-sql-cw-b60-a-silent-skip.test.ts:112"}, "properties": {"repobilityId": "ee3aec8dd57e640a", "scanner": "scanner-primary", "fingerprint": "de51efa3bfa3d134", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2bd20706be93b231", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/test/upsert-sql-cw-b60-a-silent-skip.test.ts:149"}, "properties": {"repobilityId": "06018ed80a7484a4", "scanner": "scanner-primary", "fingerprint": "2bd20706be93b231", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0ba0f268b97fee7e", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/api/test/organization-unit-processes.integration.test.ts:6"}, "properties": {"repobilityId": "74a2139b6d522dd7", "scanner": "scanner-primary", "fingerprint": "0ba0f268b97fee7e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7dbd0ded6d4e3c31", "level": "none", "message": {"text": "Commented-code block (31 lines) in apps/api/test/reconciliation-registry.integration.test.ts:16"}, "properties": {"repobilityId": "5d516004db0e7978", "scanner": "scanner-primary", "fingerprint": "7dbd0ded6d4e3c31", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3992942a4de6b91d", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/api/test/wave1-debug-scale-v4.test.ts:193"}, "properties": {"repobilityId": "422888cda9c6a431", "scanner": "scanner-primary", "fingerprint": "3992942a4de6b91d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ee1e3acedf677bc9", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/test/insights-recompute-cli.integration.test.ts:5"}, "properties": {"repobilityId": "2b2d04bd0146f0c5", "scanner": "scanner-primary", "fingerprint": "ee1e3acedf677bc9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-eead55820af49f35", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/api/test/wave1-cw-b60-tractable-targets.integration.test.ts:80"}, "properties": {"repobilityId": "bb24474fa2ebe7e2", "scanner": "scanner-primary", "fingerprint": "eead55820af49f35", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-54fdf85d86596245", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/test/transform-compiler.cast-enum.test.ts:68"}, "properties": {"repobilityId": "c5573a6f2fd67d72", "scanner": "scanner-primary", "fingerprint": "54fdf85d86596245", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-59667f833b99b33d", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/api/test/skills.integration.test.ts:123"}, "properties": {"repobilityId": "74cccab5cb5bc805", "scanner": "scanner-primary", "fingerprint": "59667f833b99b33d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ead4923ed658b562", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/test/esco-connector.test.ts:11"}, "properties": {"repobilityId": "b6306e25d05d6bff", "scanner": "scanner-primary", "fingerprint": "ead4923ed658b562", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-c3860f8c2d1624b9", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/api/test/wave1-idempotency.test.ts:143"}, "properties": {"repobilityId": "5e9820eeadd97ffd", "scanner": "scanner-primary", "fingerprint": "c3860f8c2d1624b9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-18cc2e755ea11035", "level": "none", "message": {"text": "Commented-code block (8 lines) in apps/api/test/reconciliation-learning-rehome.integration.test.ts:4"}, "properties": {"repobilityId": "017637bc006a8acd", "scanner": "scanner-primary", "fingerprint": "18cc2e755ea11035", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e3c9b5be7883dcdc", "level": "none", "message": {"text": "Commented-code block (7 lines) in apps/api/test/reconciliation-wave2-succession-branches.integration.test.ts:6"}, "properties": {"repobilityId": "3c7ab5da0ce574d4", "scanner": "scanner-primary", "fingerprint": "e3c9b5be7883dcdc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-dd1282ad6b1dc6e7", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/test/content-blueprint-links.integration.test.ts:6"}, "properties": {"repobilityId": "eb5f7f0197a34481", "scanner": "scanner-primary", "fingerprint": "dd1282ad6b1dc6e7", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0b22fc09aa198da0", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/test/sdbi-perf-feedback.integration.test.ts:4"}, "properties": {"repobilityId": "098081205d4bef96", "scanner": "scanner-primary", "fingerprint": "0b22fc09aa198da0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7b651d5bb6704913", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/test/enterprise-typing.integration.test.ts:37"}, "properties": {"repobilityId": "f0ae3974e7c3a16c", "scanner": "scanner-primary", "fingerprint": "7b651d5bb6704913", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3c75a71272d5b169", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/test/operating-models.integration.test.ts:72"}, "properties": {"repobilityId": "5e142a7ef1710320", "scanner": "scanner-primary", "fingerprint": "3c75a71272d5b169", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b5387a51d76ef4f5", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/test/helpers/setup.ts:17"}, "properties": {"repobilityId": "dec05ee89c5aac8c", "scanner": "scanner-primary", "fingerprint": "b5387a51d76ef4f5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-737097d888ca9e06", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/src/app.ts:270"}, "properties": {"repobilityId": "68972825f79b60ac", "scanner": "scanner-primary", "fingerprint": "737097d888ca9e06", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-10de721473ef76c5", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/api/src/config/env.ts:55"}, "properties": {"repobilityId": "740e3c009118713b", "scanner": "scanner-primary", "fingerprint": "10de721473ef76c5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-62336a36b2d1f03a", "level": "none", "message": {"text": "Commented-code block (7 lines) in apps/api/src/modules/users/service.ts:138"}, "properties": {"repobilityId": "2fb04f66373278ce", "scanner": "scanner-primary", "fingerprint": "62336a36b2d1f03a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-92e8b21bf4786d54", "level": "none", "message": {"text": "Commented-code block (7 lines) in apps/api/src/modules/auth/mfa-routes.ts:477"}, "properties": {"repobilityId": "fc2b0ffa9dc5913e", "scanner": "scanner-primary", "fingerprint": "92e8b21bf4786d54", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9145f409700cffb1", "level": "none", "message": {"text": "Commented-code block (7 lines) in apps/api/src/modules/auth/mailer.ts:58"}, "properties": {"repobilityId": "84981eab214726bb", "scanner": "scanner-primary", "fingerprint": "9145f409700cffb1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-91b3aa04108c5427", "level": "none", "message": {"text": "Commented-code block (7 lines) in apps/api/src/modules/auth/routes.ts:322"}, "properties": {"repobilityId": "78086cf6b837fe90", "scanner": "scanner-primary", "fingerprint": "91b3aa04108c5427", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-278dd449678d9721", "level": "none", "message": {"text": "Commented-code block (12 lines) in apps/api/src/modules/auth/service.ts:344"}, "properties": {"repobilityId": "88ed9db0222bc405", "scanner": "scanner-primary", "fingerprint": "278dd449678d9721", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6543c0b5d2e6daa3", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/src/modules/auth/webauthn-service.ts:240"}, "properties": {"repobilityId": "384872242b0efc03", "scanner": "scanner-primary", "fingerprint": "6543c0b5d2e6daa3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5783d5f384b826af", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/src/modules/auth/mfa-service.ts:878"}, "properties": {"repobilityId": "bc598582426be8fb", "scanner": "scanner-primary", "fingerprint": "5783d5f384b826af", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4291d1bccf34e21e", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/src/modules/analytics/repository.ts:187"}, "properties": {"repobilityId": "d81157936a1bf95f", "scanner": "scanner-primary", "fingerprint": "4291d1bccf34e21e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9a448d8ba38eaaf1", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/modules/semantic-matching/voyage-client.ts:28"}, "properties": {"repobilityId": "58953ea9f90c981b", "scanner": "scanner-primary", "fingerprint": "9a448d8ba38eaaf1", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-b86aac52b49b5843", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/src/modules/me/routes.ts:204"}, "properties": {"repobilityId": "912b876131a42f10", "scanner": "scanner-primary", "fingerprint": "b86aac52b49b5843", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-348ea76dcda3f3a5", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/src/modules/brownfield-wave-executor/audit-rule-codes.ts:22"}, "properties": {"repobilityId": "7fbd4d59fb88cd0b", "scanner": "scanner-primary", "fingerprint": "348ea76dcda3f3a5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0a79941ba58443ae", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/src/modules/brownfield-wave-executor/upsert-sql.ts:257"}, "properties": {"repobilityId": "410d95c044565d39", "scanner": "scanner-primary", "fingerprint": "0a79941ba58443ae", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-820316e5be89918e", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/api/src/modules/brownfield-wave-executor/transform-compiler.ts:296"}, "properties": {"repobilityId": "d0113957ddf94300", "scanner": "scanner-primary", "fingerprint": "820316e5be89918e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e92b075e0691e532", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/api/src/modules/brownfield-wave-executor/engine.ts:196"}, "properties": {"repobilityId": "187e6ec4b7c89628", "scanner": "scanner-primary", "fingerprint": "e92b075e0691e532", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-061792b1fc477f9b", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/modules/reference-sync/esco-connector.ts:66"}, "properties": {"repobilityId": "b05e1debe674f050", "scanner": "scanner-primary", "fingerprint": "061792b1fc477f9b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-80e82772e674a104", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/modules/reference-sync/istat-ateco-connector.ts:81"}, "properties": {"repobilityId": "5f591540e73aa5d9", "scanner": "scanner-primary", "fingerprint": "80e82772e674a104", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-779d877513d14971", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/modules/reference-sync/service.ts:5"}, "properties": {"repobilityId": "595506a7275fb3eb", "scanner": "scanner-primary", "fingerprint": "779d877513d14971", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-bf7b15dc91783479", "level": "none", "message": {"text": "Commented-code block (8 lines) in apps/api/src/db/client.ts:27"}, "properties": {"repobilityId": "d58a23fba4017e09", "scanner": "scanner-primary", "fingerprint": "bf7b15dc91783479", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f8d0e0cc4d0fe8fc", "level": "none", "message": {"text": "Commented-code block (7 lines) in apps/web/playwright.config.ts:8"}, "properties": {"repobilityId": "d97fd09f013446c6", "scanner": "scanner-primary", "fingerprint": "f8d0e0cc4d0fe8fc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f35ce3945eb6c36b", "level": "none", "message": {"text": "Commented-code block (7 lines) in apps/web/tests/e2e/ess-certifications-upload.spec.ts:25"}, "properties": {"repobilityId": "f97a179870567200", "scanner": "scanner-primary", "fingerprint": "f35ce3945eb6c36b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a0014b336fe3b9e3", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/web/tests/e2e/login-mfa-enrollment.spec.ts:204"}, "properties": {"repobilityId": "7504552a6596b586", "scanner": "scanner-primary", "fingerprint": "a0014b336fe3b9e3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0b823e1e8d2c465b", "level": "none", "message": {"text": "Commented-code block (7 lines) in apps/web/tests/e2e/auth.setup.ts:41"}, "properties": {"repobilityId": "a8fa839c1c8688a5", "scanner": "scanner-primary", "fingerprint": "0b823e1e8d2c465b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b7b466659012c325", "level": "none", "message": {"text": "Commented-code block (8 lines) in apps/web/src/proxy.ts:4"}, "properties": {"repobilityId": "6325178e07ea1319", "scanner": "scanner-primary", "fingerprint": "b7b466659012c325", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e857c8ab91a41687", "level": "none", "message": {"text": "Commented-code block (10 lines) in apps/web/src/components/status-pill.tsx:14"}, "properties": {"repobilityId": "cb232d35d4590549", "scanner": "scanner-primary", "fingerprint": "e857c8ab91a41687", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b32239ab3c09e720", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/web/src/components/SystemHealthDashboard.tsx:4"}, "properties": {"repobilityId": "e9e9d452665545a5", "scanner": "scanner-primary", "fingerprint": "b32239ab3c09e720", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-71f81b3e43a7468b", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/web/src/components/ContentMediaPanel.tsx:6"}, "properties": {"repobilityId": "4262e05178d64962", "scanner": "scanner-primary", "fingerprint": "71f81b3e43a7468b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-8c863560b2f4b993", "level": "none", "message": {"text": "Commented-code block (7 lines) in apps/web/src/app/showcase/layout.tsx:6"}, "properties": {"repobilityId": "be54881ba580b8a8", "scanner": "scanner-primary", "fingerprint": "8c863560b2f4b993", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2f66d6ae19c2f6ad", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/web/src/app/(authenticated)/me/security/page.tsx:318"}, "properties": {"repobilityId": "f83743c1fb1de842", "scanner": "scanner-primary", "fingerprint": "2f66d6ae19c2f6ad", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0d9c56118bcace59", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/web/src/app/(authenticated)/me/certifications/page.tsx:37"}, "properties": {"repobilityId": "041958d858fe7415", "scanner": "scanner-primary", "fingerprint": "0d9c56118bcace59", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b5fa1eafbf6e5611", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/web/src/app/(authenticated)/me/inbox/page.tsx:33"}, "properties": {"repobilityId": "cdb13ddcc2ff9d06", "scanner": "scanner-primary", "fingerprint": "b5fa1eafbf6e5611", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-985b8139a8089ea9", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/web/src/app/(authenticated)/content/page.tsx:25"}, "properties": {"repobilityId": "bbeb9b40baa29de8", "scanner": "scanner-primary", "fingerprint": "985b8139a8089ea9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-832078a6e602129e", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/agent-gateway/scripts/live-skills-acceptance.ts:113"}, "properties": {"repobilityId": "a66b4b02e5295212", "scanner": "scanner-primary", "fingerprint": "832078a6e602129e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-fc34873130a366c2", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/agent-gateway/scripts/live-read-acceptance.ts:61"}, "properties": {"repobilityId": "980bad34f5677e96", "scanner": "scanner-primary", "fingerprint": "fc34873130a366c2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-f8aa0b6f8207d15d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/agent-gateway/scripts/live-write-acceptance.ts:12"}, "properties": {"repobilityId": "6950f7dddefecd1c", "scanner": "scanner-primary", "fingerprint": "f8aa0b6f8207d15d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-9b56f1cc667cde0e", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/agent-gateway/src/sdk-agent.ts:47"}, "properties": {"repobilityId": "e57a17996c997519", "scanner": "scanner-primary", "fingerprint": "9b56f1cc667cde0e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b991fc239a156031", "level": "none", "message": {"text": "Commented-code block (8 lines) in apps/agent-gateway/src/server.ts:35"}, "properties": {"repobilityId": "3c22886694440b64", "scanner": "scanner-primary", "fingerprint": "b991fc239a156031", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a4513e91c9e03c22", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 docs/kb/tools/build_index.py:148"}, "properties": {"repobilityId": "ec1e28aac5dbea5b", "scanner": "scanner-primary", "fingerprint": "a4513e91c9e03c22", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-0bed884e17be3ba9", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/generate_wave1_seeds.mjs:41"}, "properties": {"repobilityId": "666b32303f5d7087", "scanner": "scanner-primary", "fingerprint": "0bed884e17be3ba9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-54a7c3fa33b52759", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 scripts/run-wave1-fullscale.mjs:61"}, "properties": {"repobilityId": "7f8d17dcb547e570", "scanner": "scanner-primary", "fingerprint": "54a7c3fa33b52759", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-61fb50b06373c7ea", "level": "none", "message": {"text": "Commented-code block (6 lines) in scripts/generate_wave1_column_mappings.mjs:78"}, "properties": {"repobilityId": "7df1f54d6878c01d", "scanner": "scanner-primary", "fingerprint": "61fb50b06373c7ea", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f2db2b016e37865c", "level": "none", "message": {"text": "Commented-code block (6 lines) in packages/shared/src/schemas/analytics.ts:45"}, "properties": {"repobilityId": "8f3af691a7859c93", "scanner": "scanner-primary", "fingerprint": "f2db2b016e37865c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b0cc2308c1a2f9ec", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 db/seeds/rtl-rebuild/11_rederive_b51_titles_roles.py:68"}, "properties": {"repobilityId": "40e9849270e82c92", "scanner": "scanner-primary", "fingerprint": "b0cc2308c1a2f9ec", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3f45a82cc48e9df9", "level": "note", "message": {"text": "44 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "589836c35e9d9c49", "scanner": "scanner-primary", "fingerprint": "3f45a82cc48e9df9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-3bbafa4a7e995e0d", "level": "error", "message": {"text": "Dangling fetch: POST /api/v1/content/${documentId}/media (apps/web/src/components/ContentMediaPanel.tsx:47)"}, "properties": {"repobilityId": "4645d6931edf5483", "scanner": "scanner-primary", "fingerprint": "3bbafa4a7e995e0d", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-968d4311ce08cfe9", "level": "note", "message": {"text": "Unused endpoint: GET /openapi.json"}, "properties": {"repobilityId": "28176f8a9cc17314", "scanner": "scanner-primary", "fingerprint": "968d4311ce08cfe9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "2e0b9add49999ae8", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ca5756175765b49d", "level": "note", "message": {"text": "Unused endpoint: GET /:id"}, "properties": {"repobilityId": "778c4cde09671698", "scanner": "scanner-primary", "fingerprint": "ca5756175765b49d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a009b1a56794f45", "level": "note", "message": {"text": "Unused endpoint: POST /"}, "properties": {"repobilityId": "fd016e3656cf9afd", "scanner": "scanner-primary", "fingerprint": "7a009b1a56794f45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-95ed5dbf01be17df", "level": "note", "message": {"text": "Unused endpoint: GET /readiness-distribution"}, "properties": {"repobilityId": "bd206b893e416a44", "scanner": "scanner-primary", "fingerprint": "95ed5dbf01be17df", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5fbc954f63526821", "level": "note", "message": {"text": "Unused endpoint: PATCH /:id"}, "properties": {"repobilityId": "487bcc8166867977", "scanner": "scanner-primary", "fingerprint": "5fbc954f63526821", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a61c112b611f4bb", "level": "note", "message": {"text": "Unused endpoint: DELETE /:id"}, "properties": {"repobilityId": "47471ec52bb6c32a", "scanner": "scanner-primary", "fingerprint": "7a61c112b611f4bb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-905a9a415644eab4", "level": "note", "message": {"text": "Unused endpoint: GET /:id/roles"}, "properties": {"repobilityId": "7691339190d8fdc1", "scanner": "scanner-primary", "fingerprint": "905a9a415644eab4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-35d0de6979ab553d", "level": "note", "message": {"text": "Unused endpoint: POST /:id/roles"}, "properties": {"repobilityId": "03c33228588bd0ef", "scanner": "scanner-primary", "fingerprint": "35d0de6979ab553d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-84a7c276fb0509b4", "level": "note", "message": {"text": "Unused endpoint: DELETE /:id/roles/:grantId"}, "properties": {"repobilityId": "42231b3c0c6bf61c", "scanner": "scanner-primary", "fingerprint": "84a7c276fb0509b4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e1b7bee247ffc801", "level": "note", "message": {"text": "Unused endpoint: GET /summary"}, "properties": {"repobilityId": "ea581e9da8c87cdf", "scanner": "scanner-primary", "fingerprint": "e1b7bee247ffc801", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8e9d369baeaf2e09", "level": "note", "message": {"text": "Unused endpoint: GET /:id/render"}, "properties": {"repobilityId": "d1ddc3fd36fa091e", "scanner": "scanner-primary", "fingerprint": "8e9d369baeaf2e09", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2ab9bf5db6820af4", "level": "note", "message": {"text": "Unused endpoint: GET /models"}, "properties": {"repobilityId": "feb66efd8088d34e", "scanner": "scanner-primary", "fingerprint": "2ab9bf5db6820af4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-93ed5b83d7a7324b", "level": "note", "message": {"text": "Unused endpoint: GET /models/:id"}, "properties": {"repobilityId": "931c36f4f7356287", "scanner": "scanner-primary", "fingerprint": "93ed5b83d7a7324b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fc1f9e4aa984943b", "level": "note", "message": {"text": "Unused endpoint: GET /:id/intelligence-profile"}, "properties": {"repobilityId": "ada6e0dcc63aa63d", "scanner": "scanner-primary", "fingerprint": "fc1f9e4aa984943b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-363cac305f124ca4", "level": "note", "message": {"text": "Unused endpoint: GET /:id/skills"}, "properties": {"repobilityId": "650a4c6a4f363f1c", "scanner": "scanner-primary", "fingerprint": "363cac305f124ca4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-23d3288a1c1f3586", "level": "note", "message": {"text": "Unused endpoint: POST /:id/skills"}, "properties": {"repobilityId": "2feae8baf32c0cc0", "scanner": "scanner-primary", "fingerprint": "23d3288a1c1f3586", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4e1985b82a7fe4c8", "level": "note", "message": {"text": "Unused endpoint: DELETE /:id/skills/:skillId"}, "properties": {"repobilityId": "4663b625ef008150", "scanner": "scanner-primary", "fingerprint": "4e1985b82a7fe4c8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5a02a6e2bfa9114b", "level": "note", "message": {"text": "Unused endpoint: GET /:id/kpis"}, "properties": {"repobilityId": "0d68e64ae209f42c", "scanner": "scanner-primary", "fingerprint": "5a02a6e2bfa9114b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d9621519bcba4544", "level": "note", "message": {"text": "Unused endpoint: GET /profiles/:positionId"}, "properties": {"repobilityId": "54774ba85451db1c", "scanner": "scanner-primary", "fingerprint": "d9621519bcba4544", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-273559375dc00fd4", "level": "note", "message": {"text": "Unused endpoint: GET /reward-gates"}, "properties": {"repobilityId": "694399fd4070750b", "scanner": "scanner-primary", "fingerprint": "273559375dc00fd4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2458528b423c4e8e", "level": "note", "message": {"text": "Unused endpoint: GET /distribution"}, "properties": {"repobilityId": "4c83ff5e37a4c90d", "scanner": "scanner-primary", "fingerprint": "2458528b423c4e8e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c55d68874e810e1a", "level": "note", "message": {"text": "Unused endpoint: POST /recommendations"}, "properties": {"repobilityId": "afa1c0717adb2b62", "scanner": "scanner-primary", "fingerprint": "c55d68874e810e1a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2ec4172bf6f044fd", "level": "note", "message": {"text": "Unused endpoint: POST /handoff-records"}, "properties": {"repobilityId": "092fa46b1be43cc1", "scanner": "scanner-primary", "fingerprint": "2ec4172bf6f044fd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-67d28fa8cd6bb12f", "level": "note", "message": {"text": "Unused endpoint: PUT /"}, "properties": {"repobilityId": "5f360c850184803d", "scanner": "scanner-primary", "fingerprint": "67d28fa8cd6bb12f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-be95234cd7d6664a", "level": "note", "message": {"text": "Unused endpoint: POST /enroll"}, "properties": {"repobilityId": "cd319dd1a94406af", "scanner": "scanner-primary", "fingerprint": "be95234cd7d6664a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c1fa622edf221471", "level": "note", "message": {"text": "Unused endpoint: POST /verify-setup"}, "properties": {"repobilityId": "f1e1d82784d18f64", "scanner": "scanner-primary", "fingerprint": "c1fa622edf221471", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a825cc12e8fcb595", "level": "note", "message": {"text": "Unused endpoint: GET /factors"}, "properties": {"repobilityId": "bc4df0b50d303067", "scanner": "scanner-primary", "fingerprint": "a825cc12e8fcb595", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-409fcab88dc46993", "level": "note", "message": {"text": "Unused endpoint: DELETE /factors/:factorId"}, "properties": {"repobilityId": "ff688ce786e71bf8", "scanner": "scanner-primary", "fingerprint": "409fcab88dc46993", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-95c7570927041b3e", "level": "note", "message": {"text": "Unused endpoint: POST /email-otp/enroll"}, "properties": {"repobilityId": "ead423c87f4236cb", "scanner": "scanner-primary", "fingerprint": "95c7570927041b3e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-445467dbec719f6a", "level": "note", "message": {"text": "Unused endpoint: POST /email-otp/verify-setup"}, "properties": {"repobilityId": "7393e552112d8621", "scanner": "scanner-primary", "fingerprint": "445467dbec719f6a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-438bdc953e469259", "level": "note", "message": {"text": "Unused endpoint: POST /email-otp/resend"}, "properties": {"repobilityId": "6d991cd58ab46b2e", "scanner": "scanner-primary", "fingerprint": "438bdc953e469259", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-84abeaddf7651a1b", "level": "note", "message": {"text": "Unused endpoint: POST /email-otp/resend-login"}, "properties": {"repobilityId": "11b1ce74d30f97e6", "scanner": "scanner-primary", "fingerprint": "84abeaddf7651a1b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e0a40ad3ae274acd", "level": "note", "message": {"text": "Unused endpoint: POST /enroll-confirm"}, "properties": {"repobilityId": "756f3ee6ee6b0f56", "scanner": "scanner-primary", "fingerprint": "e0a40ad3ae274acd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-feda27069b2a0d9d", "level": "note", "message": {"text": "Unused endpoint: POST /enroll-confirm/resend"}, "properties": {"repobilityId": "20fd65e303ebd1c2", "scanner": "scanner-primary", "fingerprint": "feda27069b2a0d9d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-49aa304a553d5594", "level": "note", "message": {"text": "Unused endpoint: POST /sms-otp/enroll"}, "properties": {"repobilityId": "80dfda960b1819b9", "scanner": "scanner-primary", "fingerprint": "49aa304a553d5594", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-90fb20c139c7bf5c", "level": "note", "message": {"text": "Unused endpoint: POST /sms-otp/verify-setup"}, "properties": {"repobilityId": "f34c1ca7fee6b2cf", "scanner": "scanner-primary", "fingerprint": "90fb20c139c7bf5c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d3c3a0e9d73b6666", "level": "note", "message": {"text": "Unused endpoint: POST /sms-otp/resend"}, "properties": {"repobilityId": "9b437a9f55358592", "scanner": "scanner-primary", "fingerprint": "d3c3a0e9d73b6666", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1f0b2c9c50a87803", "level": "note", "message": {"text": "Unused endpoint: POST /sms-otp/resend-login"}, "properties": {"repobilityId": "6b17b553ba686fde", "scanner": "scanner-primary", "fingerprint": "1f0b2c9c50a87803", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ade4187f8673f090", "level": "note", "message": {"text": "Unused endpoint: POST /verify-login"}, "properties": {"repobilityId": "de39a684db91c6f1", "scanner": "scanner-primary", "fingerprint": "ade4187f8673f090", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-180e66f93f5c3abc", "level": "note", "message": {"text": "Unused endpoint: POST /recovery-codes"}, "properties": {"repobilityId": "ca4706cb88080155", "scanner": "scanner-primary", "fingerprint": "180e66f93f5c3abc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d6dfaec659ebb180", "level": "note", "message": {"text": "Unused endpoint: GET /recovery-codes"}, "properties": {"repobilityId": "02af0f76d33a2da2", "scanner": "scanner-primary", "fingerprint": "d6dfaec659ebb180", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b432eaf9b6ecb7a7", "level": "note", "message": {"text": "Unused endpoint: POST /webauthn/registration/options"}, "properties": {"repobilityId": "b2f95787db09face", "scanner": "scanner-primary", "fingerprint": "b432eaf9b6ecb7a7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0637609ee6599fd9", "level": "note", "message": {"text": "Unused endpoint: POST /webauthn/registration/verify"}, "properties": {"repobilityId": "bca2ea0c4ddc96fe", "scanner": "scanner-primary", "fingerprint": "0637609ee6599fd9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-69652c2a485543f2", "level": "note", "message": {"text": "Unused endpoint: POST /webauthn/authentication/options"}, "properties": {"repobilityId": "b69fc92b4d7eb55d", "scanner": "scanner-primary", "fingerprint": "69652c2a485543f2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4a4758c24cfa01c3", "level": "note", "message": {"text": "Unused endpoint: POST /webauthn/authentication/verify"}, "properties": {"repobilityId": "752ab0361f99ab35", "scanner": "scanner-primary", "fingerprint": "4a4758c24cfa01c3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-618721b912bad1c2", "level": "note", "message": {"text": "Unused endpoint: POST /login"}, "properties": {"repobilityId": "12a92b6f30e94e69", "scanner": "scanner-primary", "fingerprint": "618721b912bad1c2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7ce17d6b092a81ca", "level": "note", "message": {"text": "Unused endpoint: POST /refresh"}, "properties": {"repobilityId": "09f5c05cf586d69e", "scanner": "scanner-primary", "fingerprint": "7ce17d6b092a81ca", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-99fc36db98c134ce", "level": "note", "message": {"text": "Unused endpoint: POST /logout"}, "properties": {"repobilityId": "4e120fbd2c5b81e2", "scanner": "scanner-primary", "fingerprint": "99fc36db98c134ce", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd1dc91abf32142d", "level": "note", "message": {"text": "Unused endpoint: GET /me"}, "properties": {"repobilityId": "9923fa1dcf66be27", "scanner": "scanner-primary", "fingerprint": "fd1dc91abf32142d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}