{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-25de52372c63f233", "name": "Docker base image is tag-pinned but not digest-pinned: node:24-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:24-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cb352771fe7d7a34", "name": "Insecure pattern 'node_child_process' in src/auth.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/auth.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d29a0758c1bb5e7b", "name": "Insecure pattern 'node_child_process' in src/pidlock.ts:4", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/pidlock.ts:4"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-95e93976ff2b2b07", "name": "Insecure pattern 'node_child_process' in src/version.ts:2", "shortDescription": {"text": "Insecure pattern 'node_child_process' in src/version.ts:2"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1299f0b3d49e916f", "name": "Insecure pattern 'direct_innerhtml_assignment' in src/server.ts:1259", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/server.ts:1259"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-598cce71ac82acc3", "name": "Insecure pattern 'exec_used' in src/db.ts:61", "shortDescription": {"text": "Insecure pattern 'exec_used' in src/db.ts:61"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7ffa33751be3d771", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3c9f53862db8c6f9", "name": "Very large file: src/store.ts (1909 lines)", "shortDescription": {"text": "Very large file: src/store.ts (1909 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d116bd2d3700cfd", "name": "Very large file: src/server.ts (1530 lines)", "shortDescription": {"text": "Very large file: src/server.ts (1530 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d4135bf6df8cbe0a", "name": "Commented-code block (6 lines) in tests/alerts.test.ts:138", "shortDescription": {"text": "Commented-code block (6 lines) in tests/alerts.test.ts:138"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cfbf57ac4b61bc3e", "name": "Commented-code block (10 lines) in src/auth.ts:96", "shortDescription": {"text": "Commented-code block (10 lines) in src/auth.ts:96"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-626fcd2ae0055a87", "name": "Commented-code block (6 lines) in src/store.ts:163", "shortDescription": {"text": "Commented-code block (6 lines) in src/store.ts:163"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c0987f39ade12dd", "name": "Commented-code block (6 lines) in src/index.ts:989", "shortDescription": {"text": "Commented-code block (6 lines) in src/index.ts:989"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-161d6b0f6da5234d", "name": "Commented-code block (8 lines) in src/antigravity.ts:163", "shortDescription": {"text": "Commented-code block (8 lines) in src/antigravity.ts:163"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-50f4efe9bb973cd2", "name": "Commented-code block (5 lines) in src/tokens.ts:24", "shortDescription": {"text": "Commented-code block (5 lines) in src/tokens.ts:24"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-aa06d54a356f17fc", "name": "Commented-code block (5 lines) in src/pricing.ts:47", "shortDescription": {"text": "Commented-code block (5 lines) in src/pricing.ts:47"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-1ef4b85f6b73b02b", "name": "Commented-code block (6 lines) in src/server.ts:142", "shortDescription": {"text": "Commented-code block (6 lines) in src/server.ts:142"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-34114b99e2296faf", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/server.ts:1230", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/server.ts:1230"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3f9566fd566739a5", "name": "Commented-code block (7 lines) in src/usage.ts:364", "shortDescription": {"text": "Commented-code block (7 lines) in src/usage.ts:364"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-680aa015823097b4", "name": "`fetch()` without try/.catch or AbortSignal \u2014 src/usage.ts:127", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/usage.ts:127"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/18646"}, "properties": {"repository": "ryanmurf/claude-pulse", "repoUrl": "https://github.com/ryanmurf/claude-pulse", "branch": "main"}, "results": [{"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-25de52372c63f233", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:24-slim"}, "properties": {"repobilityId": "7b9258013695f0b5", "scanner": "scanner-primary", "fingerprint": "25de52372c63f233", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-cb352771fe7d7a34", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/auth.ts:1"}, "properties": {"repobilityId": "4bd889bcda045441", "scanner": "scanner-primary", "fingerprint": "cb352771fe7d7a34", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/auth.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d29a0758c1bb5e7b", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/pidlock.ts:4"}, "properties": {"repobilityId": "a4eac621fe915ef9", "scanner": "scanner-primary", "fingerprint": "d29a0758c1bb5e7b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/pidlock.ts"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-95e93976ff2b2b07", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in src/version.ts:2"}, "properties": {"repobilityId": "0b27060140c359c1", "scanner": "scanner-primary", "fingerprint": "95e93976ff2b2b07", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/version.ts"}, "region": {"startLine": 2}}}]}, {"ruleId": "scanner-1299f0b3d49e916f", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in src/server.ts:1259"}, "properties": {"repobilityId": "b4aa5fbc069b7859", "scanner": "scanner-primary", "fingerprint": "1299f0b3d49e916f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/server.ts"}, "region": {"startLine": 1259}}}]}, {"ruleId": "scanner-598cce71ac82acc3", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in src/db.ts:61"}, "properties": {"repobilityId": "0b04e2af2795e8a8", "scanner": "scanner-primary", "fingerprint": "598cce71ac82acc3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/db.ts"}, "region": {"startLine": 61}}}]}, {"ruleId": "scanner-7ffa33751be3d771", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "491a3ad29cbaf189", "scanner": "scanner-primary", "fingerprint": "7ffa33751be3d771", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/publish.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3c9f53862db8c6f9", "level": "note", "message": {"text": "Very large file: src/store.ts (1909 lines)"}, "properties": {"repobilityId": "5bcf39c9e8def28f", "scanner": "scanner-primary", "fingerprint": "3c9f53862db8c6f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9d116bd2d3700cfd", "level": "note", "message": {"text": "Very large file: src/server.ts (1530 lines)"}, "properties": {"repobilityId": "5a658d2965d5fcc6", "scanner": "scanner-primary", "fingerprint": "9d116bd2d3700cfd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "e23c3d41f2dd5bf5", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "5081ef6ca067852a", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "973a69d572eade3e", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-d4135bf6df8cbe0a", "level": "none", "message": {"text": "Commented-code block (6 lines) in tests/alerts.test.ts:138"}, "properties": {"repobilityId": "2343dfbcb9e3cf44", "scanner": "scanner-primary", "fingerprint": "d4135bf6df8cbe0a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cfbf57ac4b61bc3e", "level": "none", "message": {"text": "Commented-code block (10 lines) in src/auth.ts:96"}, "properties": {"repobilityId": "f1c114523b6a6467", "scanner": "scanner-primary", "fingerprint": "cfbf57ac4b61bc3e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-626fcd2ae0055a87", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/store.ts:163"}, "properties": {"repobilityId": "dc363d0eb6ee2178", "scanner": "scanner-primary", "fingerprint": "626fcd2ae0055a87", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-2c0987f39ade12dd", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/index.ts:989"}, "properties": {"repobilityId": "514a33c5dee8db78", "scanner": "scanner-primary", "fingerprint": "2c0987f39ade12dd", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-161d6b0f6da5234d", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/antigravity.ts:163"}, "properties": {"repobilityId": "eeb63d28e3a3c8f0", "scanner": "scanner-primary", "fingerprint": "161d6b0f6da5234d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-50f4efe9bb973cd2", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/tokens.ts:24"}, "properties": {"repobilityId": "da48de32d320181f", "scanner": "scanner-primary", "fingerprint": "50f4efe9bb973cd2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-aa06d54a356f17fc", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/pricing.ts:47"}, "properties": {"repobilityId": "7e62f3e67540c49c", "scanner": "scanner-primary", "fingerprint": "aa06d54a356f17fc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-1ef4b85f6b73b02b", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/server.ts:142"}, "properties": {"repobilityId": "d70b22ffabed3fe8", "scanner": "scanner-primary", "fingerprint": "1ef4b85f6b73b02b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-34114b99e2296faf", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/server.ts:1230"}, "properties": {"repobilityId": "bcf1f7cf097302eb", "scanner": "scanner-primary", "fingerprint": "34114b99e2296faf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3f9566fd566739a5", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/usage.ts:364"}, "properties": {"repobilityId": "065b05782aaad92a", "scanner": "scanner-primary", "fingerprint": "3f9566fd566739a5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-680aa015823097b4", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 src/usage.ts:127"}, "properties": {"repobilityId": "8669ac659f178cf6", "scanner": "scanner-primary", "fingerprint": "680aa015823097b4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}]}]}