{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-4df9969ccfe4f3eb", "name": "Possibly dead Python function: delete_api_key", "shortDescription": {"text": "Possibly dead Python function: delete_api_key"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-57063d2745b85c17", "name": "Possibly dead Python function: process_transcript_background", "shortDescription": {"text": "Possibly dead Python function: process_transcript_background"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e7f3bdb3ca54313e", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/AudioBackendSelector.tsx:69", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/AudioBackendSelector.tsx:69"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-4987d93ad85b23c7", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/ConsoleToggle.tsx:15", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/ConsoleToggle.tsx:15"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-d2192e7276a461a8", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/PreferenceSettings.tsx:83", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/PreferenceSettings.tsx:83"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-7c21ba8cd9bd39ca", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/components/ChunkProgressDisplay.tsx:230", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/components/ChunkProgressDisplay.tsx:230"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-c970ba5b2f9780a3", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/components/AnalyticsConsentSwitch.tsx:195", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/components/AnalyticsConsentSwitch.tsx:195"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-d9a61fd983cf8f63", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/AnalyticsConsentSwitch.tsx:116", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/AnalyticsConsentSwitch.tsx:116"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-a17057bfcc43789a", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/components/ModelSettingsModal.tsx:896", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/components/ModelSettingsModal.tsx:896"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-df5e958420b8a0ea", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/ModelSettingsModal.tsx:322", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/ModelSettingsModal.tsx:322"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-3fb722b5e63ac9bb", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/SummaryModelSettings.tsx:86", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/SummaryModelSettings.tsx:86"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-c15f1203ce6c4aec", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/UpdateDialog.tsx:93", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/UpdateDialog.tsx:93"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-a2a6357cee7edc49", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/RecordingControls.tsx:77", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/RecordingControls.tsx:77"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-b8e06fb8d4a7c5b2", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/WhisperModelManager.tsx:129", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/WhisperModelManager.tsx:129"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-c03efec8cdf45cb6", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/components/DeviceSelection.tsx:302", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/components/DeviceSelection.tsx:302"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-9b100b0ed5962469", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/DeviceSelection.tsx:59", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/DeviceSelection.tsx:59"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-64501817042a38ab", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/LanguageSelection.tsx:145", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/LanguageSelection.tsx:145"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-5fbbe1debb301fe0", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/TranscriptView.tsx:111", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/TranscriptView.tsx:111"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-d77af8ea678fb8d9", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/ParakeetModelManager.tsx:81", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/ParakeetModelManager.tsx:81"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-967adc84d0fc7f3f", "name": "TODO/FIXME marker in shipping code \u2014 frontend/src/components/MeetingDetails/SummaryPanel.tsx:299", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 frontend/src/components/MeetingDetails/SummaryPanel.tsx:299"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.7}}, {"id": "scanner-4c27c847aafba304", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/MeetingDetails/SummaryPanel.tsx:300", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/MeetingDetails/SummaryPanel.tsx:300"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-947167aea9509ca0", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/MeetingDetails/SummaryGeneratorButtonGroup.", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/MeetingDetails/SummaryGeneratorButtonGroup.tsx:71"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-da29714285c6bff4", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/BlockNoteEditor/Editor.tsx:17", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/BlockNoteEditor/Editor.tsx:17"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-49df6af228f617c8", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/components/shared/DownloadProgressToast.tsx:83", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/components/shared/DownloadProgressToast.tsx:83"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-360efd3af264547e", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/AISummary/index.tsx:218", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/AISummary/index.tsx:218"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-272b8179733e46ef", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/AISummary/BlockNoteSummaryView.tsx:45", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/AISummary/BlockNoteSummaryView.tsx:45"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-52cbfd78a7b0636a", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/components/onboarding/shared/PermissionRow.tsx:4", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/components/onboarding/shared/PermissionRow.tsx:40"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-1cff20d9e81a0ea1", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/onboarding/steps/PermissionsStep.tsx:16", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/onboarding/steps/PermissionsStep.tsx:16"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-6020fcddf0fdefdd", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/onboarding/steps/DownloadProgressStep.tsx:6", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/onboarding/steps/DownloadProgressStep.tsx:66"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-724786c8920b563a", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/Sidebar/index.tsx:113", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/Sidebar/index.tsx:113"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-8cded93ab5c03953", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/Sidebar/SidebarProvider.tsx:151", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/Sidebar/SidebarProvider.tsx:151"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-f7a30fba8764788e", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/components/TranscriptRecovery/TranscriptRecovery", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/components/TranscriptRecovery/TranscriptRecovery.tsx:146"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-9b5965862a15e489", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/TranscriptRecovery/TranscriptRecovery.tsx:8", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/TranscriptRecovery/TranscriptRecovery.tsx:85"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-63acbe20b2f00436", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/components/ImportAudio/ImportAudioDialog.tsx:276", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/components/ImportAudio/ImportAudioDialog.tsx:276"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-5c78f159ec92baf4", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/contexts/TranscriptContext.tsx:103", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/contexts/TranscriptContext.tsx:103"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-3a6ffbcd53d46cd2", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/contexts/OllamaDownloadContext.tsx:45", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/contexts/OllamaDownloadContext.tsx:45"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-de8bea28e5a55b21", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/contexts/ConfigContext.tsx:200", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/contexts/ConfigContext.tsx:200"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-aeacb5aae6dd490a", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/contexts/OnboardingContext.tsx:129", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/contexts/OnboardingContext.tsx:129"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-561da55265733d0d", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/contexts/RecordingPostProcessingProvider.tsx:37", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/contexts/RecordingPostProcessingProvider.tsx:37"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-c860e651a2419fc0", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/contexts/RecordingStateContext.tsx:74", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/contexts/RecordingStateContext.tsx:74"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-da3f2c2c98b350fb", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/app/page.tsx:80", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/app/page.tsx:80"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-1b4a2ee566204a3c", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/app/layout.tsx:87", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/app/layout.tsx:87"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-5de44e5d35654a87", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/app/settings/page.tsx:40", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/app/settings/page.tsx:40"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-5c61afdc1f655809", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/src/app/notes/[id]/page.tsx:174", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/src/app/notes/[id]/page.tsx:174"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-e3898e61e225b02e", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/app/meeting-details/page-content.tsx:50", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/app/meeting-details/page-content.tsx:50"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-0991a6cc8cc0b1e6", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/app/meeting-details/page.tsx:56", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/app/meeting-details/page.tsx:56"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-85022bb8a74756a7", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/lib/analytics.ts:48", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/lib/analytics.ts:48"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-f4d506b5bfd1a9be", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/useRecordingStart.ts:85", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/useRecordingStart.ts:85"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-b6d7ff61ba58b9e1", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/usePermissionCheck.ts:35", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/usePermissionCheck.ts:35"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-90e96909662b2e61", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/useAudioPlayer.ts:19", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/useAudioPlayer.ts:19"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-9a04bdc2e41f3320", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/useProcessingProgress.ts:56", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/useProcessingProgress.ts:56"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-5fcb2bdf19f62b22", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/useModalState.ts:107", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/useModalState.ts:107"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-e01b5d99b8ec9009", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/useRecordingStop.ts:84", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/useRecordingStop.ts:84"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-47d664b9b3772061", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/useRecordingStateSync.ts:26", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/useRecordingStateSync.ts:26"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-7f26cf4e4946ecbe", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/meeting-details/useMeetingData.ts:34", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/meeting-details/useMeetingData.ts:34"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-90c7308601f96bc4", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/meeting-details/useSummaryGeneration.ts:119", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/meeting-details/useSummaryGeneration.ts:119"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-08292eecbfdd53c8", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/meeting-details/useTemplates.ts:23", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/meeting-details/useTemplates.ts:23"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-82c3887b534eb426", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/meeting-details/useModelConfiguration.ts:26", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/meeting-details/useModelConfiguration.ts:26"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-fffd810a7f1420c1", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/meeting-details/useCopyOperations.ts:27", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/meeting-details/useCopyOperations.ts:27"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-b594d73d62170856", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/services/updateService.ts:51", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/services/updateService.ts:51"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-b2b63fc70eada918", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/services/indexedDBService.ts:363", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/services/indexedDBService.ts:363"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-9d6d3d997019154e", "name": "detect child process \u2014 frontend/scripts/auto-detect-gpu.js:12", "shortDescription": {"text": "detect child process \u2014 frontend/scripts/auto-detect-gpu.js:12"}, "fullDescription": {"text": "Detected calls to child_process from a function argument `cmd`. This could lead to a command injection if the input is user controllable. Try to avoid calls to child_process, and if it is needed ensure user input is correctly sanitized or sandboxed.\n\nRule: javascript.lang.security.detect-child-process.detect-child-process\nSeverity: ERROR\nOWASP: A01:2017 - Injection, A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-89e883e5c8764449", "name": "react dangerouslysetinnerhtml \u2014 frontend/src/app/notes/[id]/page.tsx:174", "shortDescription": {"text": "react dangerouslysetinnerhtml \u2014 frontend/src/app/notes/[id]/page.tsx:174"}, "fullDescription": {"text": "Detection of dangerouslySetInnerHTML from non-constant definition. This can inadvertently expose users to cross-site scripting (XSS) attacks if this comes from user-provided input. If you have to use dangerouslySetInnerHTML, consider using a sanitization library such as DOMPurify to sanitize your HTML.\n\nRule: typescript.react.security.audit.react-dangerouslysetinnerhtml.react-dangerouslysetinnerhtml\nSeverity: WARNING\nOWASP: A07:2017 - Cross-Site Scripting (XSS), A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-15e54770576b396b", "name": "GHSA-g98v-hv3f-hcfr: atty 0.2.14 \u2014 Cargo.lock", "shortDescription": {"text": "GHSA-g98v-hv3f-hcfr: atty 0.2.14 \u2014 Cargo.lock"}, "fullDescription": {"text": "atty potential unaligned read\n\nOn windows, `atty` dereferences a potentially unaligned pointer.\n\nIn practice however, the pointer won't be unaligned unless a custom global allocator is used.\n\nIn particular, the `System` allocator on windows uses `HeapAlloc`, which guarantees a large enough alignment.\n\n# atty is Unmaintained\n\nA Pull Request with a fix has been provided over a year ago but the maintainer seems to be unreachable.\n\nLast release of `atty` was almost 3 years ago.\n\n## Possible Alternative(s)\n\nThe below list has not \n\nPackage: atty\nInstalled: 0.2.14\nFixed in: \u2014\nSeverity: LOW\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7d85a0952942c106", "name": "GHSA-wrw7-89jp-8q8g: glib 0.18.5 \u2014 Cargo.lock", "shortDescription": {"text": "GHSA-wrw7-89jp-8q8g: glib 0.18.5 \u2014 Cargo.lock"}, "fullDescription": {"text": "Unsoundness in `Iterator` and `DoubleEndedIterator` impls for `glib::VariantStrIter`\n\nThe `VariantStrIter::impl_get` function (called internally by implementations of the `Iterator` and `DoubleEndedIterator` traits for this type) was unsound, resulting in undefined behaviour.\n\nAn immutable reference `&p` to a `*mut libc::c_char` pointer initialized to `NULL` was passed as an argument to a C function that that mutates the pointer behind `&p` in-place (i.e. as an out-argument), which was unsound. After changes in recent versions of the Rust compiler, these unsound writes through `&\n\nPackage: glib\nInstalled: 0.18.5\nFixed in: 0.20.0\nSeverity: MEDIUM\nFix: Upgrade glib to 0.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3d43fc2ec916071e", "name": "CVE-2026-45784: openssl 0.10.79 \u2014 Cargo.lock", "shortDescription": {"text": "CVE-2026-45784: openssl 0.10.79 \u2014 Cargo.lock"}, "fullDescription": {"text": "rust-openssl provides OpenSSL bindings for the Rust programming langua ...\n\nrust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipher_update_inplace in openssl/src/cipher_ctx.rs incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers EVP_aes_{128,192,256}_wrap_pad. For a non-multiple-of-8 input, OpenSSL writes up to 7 bytes past the end of the caller's buffer or Vec, producing attacker-controllable heap corruption when the plaintext length is attacker-influenced. This issue is fix\n\nPackage: openssl\nInstalled: 0.10.79\nFixed in: 0.10.80\nSeverity: MEDIUM\nFix: Upgrade openssl to 0.10.80"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4d55529f3b48a215", "name": "GHSA-82j2-j2ch-gfr8: rustls-webpki 0.101.7 \u2014 Cargo.lock", "shortDescription": {"text": "GHSA-82j2-j2ch-gfr8: rustls-webpki 0.101.7 \u2014 Cargo.lock"}, "fullDescription": {"text": "rustls-webpki: Denial of service via panic on malformed CRL BIT STRING\n\n### Summary\n\n`bit_string_flags()` in `src/der.rs` panics with an index-out-of-bounds when given a BIT STRING whose content is exactly `[0x00]` (one byte: zero padding bits, zero data bytes). This is reachable through the public API `BorrowedCertRevocationList::from_der()` via the `issuingDistributionPoint` CRL extension.\n\n**Precondition**: CRL checking is opt-in in rustls-webpki. This vulnerability affects only applications that explicitly pass `RevocationOptions` to `verify_for_usage()` and loa\n\nPackage: rustls-webpki\nInstalled: 0.101.7\nFixed in: 0.103.13, 0.104.0-alpha.7\nSeverity: HIGH\nFix: Upgrade rustls-webpki to 0.103.13, 0.104.0-alpha.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2c37ef3d9ce9b15c", "name": "GHSA-965h-392x-2mh5: rustls-webpki 0.101.7 \u2014 Cargo.lock", "shortDescription": {"text": "GHSA-965h-392x-2mh5: rustls-webpki 0.101.7 \u2014 Cargo.lock"}, "fullDescription": {"text": "webpki: Name constraints for URI names were incorrectly accepted\n\nName constraints for URI names were ignored and therefore accepted.\n\nNote this library does not provide an API for asserting URI names, and URI name constraints are otherwise not implemented.  URI name constraints are now rejected unconditionally.\n\nSince name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and requires misissuance to exploit.\n\nPackage: rustls-webpki\nInstalled: 0.101.7\nFixed in: 0.103.12, 0.104.0-alpha.6\nSeverity: LOW\nFix: Upgrade rustls-webpki to 0.103.12, 0.104.0-alpha.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9ab852bad3531e7", "name": "GHSA-xgp8-3hg3-c2mh: rustls-webpki 0.101.7 \u2014 Cargo.lock", "shortDescription": {"text": "GHSA-xgp8-3hg3-c2mh: rustls-webpki 0.101.7 \u2014 Cargo.lock"}, "fullDescription": {"text": "webpki: Name constraints were accepted for certificates asserting a wildcard name\n\nPermitted subtree name constraints for DNS names were accepted for certificates asserting a wildcard name.\n\nThis was incorrect because, given a name constraint of `accept.example.com`, `*.example.com` could feasibly allow a name of `reject.example.com` which is outside the constraint.\nThis is very similar to [CVE-2025-61727](https://go.dev/issue/76442).\n\nSince name constraints are restrictions on otherwise properly-issued certificates, this bug is reachable only after signature verification and \n\nPackage: rustls-webpki\nInstalled: 0.101.7\nFixed in: 0.103.12, 0.104.0-alpha.6\nSeverity: LOW\nFix: Upgrade rustls-webpki to 0.103.12, 0.104.0-alpha.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-322b7699f11a74fc", "name": "GHSA-7gcf-g7xr-8hxj: serde_with 3.20.0 \u2014 Cargo.lock", "shortDescription": {"text": "GHSA-7gcf-g7xr-8hxj: serde_with 3.20.0 \u2014 Cargo.lock"}, "fullDescription": {"text": "serde_with: KeyValueMap serialization panics on empty sequence or map entries\n\n### Summary\n\nThe public `KeyValueMap` serializer assumes that each mapped element has at least one field or item to use as the map key, but it subtracts `1` from the caller-visible length before validating that assumption. An application that serializes attacker-controlled data through `#[serde_as(as = \"KeyValueMap<_>\")]` can be crashed by an empty inner sequence or map entry.\n\n### Details\n\nThe affected public surface includes:\n\n- Serialization of `#[serde_as(as = \"KeyValueMap<_>\")]` values thro\n\nPackage: serde_with\nInstalled: 3.20.0\nFixed in: 3.21.0\nSeverity: MEDIUM\nFix: Upgrade serde_with to 3.21.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-14f1502ee75e5df4", "name": "GHSA-3pv8-6f4r-ffg2: tar 0.4.45 \u2014 Cargo.lock", "shortDescription": {"text": "GHSA-3pv8-6f4r-ffg2: tar 0.4.45 \u2014 Cargo.lock"}, "fullDescription": {"text": "tar has a PAX header desynchronization issue\n\n### Summary\n\nWhen a tar stream contains multiple \"header\" entries prior to a file entry, tar-rs applies the PAX header (`x`) to the _next_ entry in the stream, regardless of type. For example, a stream of `x -> L -> file` (PAX, GNU longname, file) would result in `x`'s extensions being applied to `L` rather than to `file`.\n\n[Per POSIX pax](https://pubs.opengroup.org/onlinepubs/9799919799/utilities/pax.html), this is incorrect: a PAX header always applies to a file entry, not any intermediary ent\n\nPackage: tar\nInstalled: 0.4.45\nFixed in: 0.4.46\nSeverity: MEDIUM\nFix: Upgrade tar to 0.4.46"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b49aa950d8eccfb4", "name": "CVE-2026-25580: pydantic-ai 0.2.15 \u2014 backend/requirements.txt", "shortDescription": {"text": "CVE-2026-25580: pydantic-ai 0.2.15 \u2014 backend/requirements.txt"}, "fullDescription": {"text": "Pydantic AI: Pydantic AI: Information disclosure via Server-Side Request Forgery (SSRF) through malicious URLs in message history.\n\nPydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 0.0.26 to before 1.56.0, aServer-Side Request Forgery (SSRF) vulnerability exists in Pydantic AI's URL download functionality. When applications accept message history from untrusted sources, attackers can include malicious URLs that cause the server to make HTTP requests to internal network resources, potentially accessing internal services or cloud credentials. This vulnerability only affec\n\nPackage: pydantic-ai\nInstalled: 0.2.15\nFixed in: 1.56.0\nSeverity: HIGH\nFix: Upgrade pydantic-ai to 1.56.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5514aa234ba2c5da", "name": "CVE-2026-28684: python-dotenv 1.1.0 \u2014 backend/requirements.txt", "shortDescription": {"text": "CVE-2026-28684: python-dotenv 1.1.0 \u2014 backend/requirements.txt"}, "fullDescription": {"text": "python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following\n\npython-dotenv reads key-value pairs from a .env file and can set them as environment variables. Prior to version 1.2.2, `set_key()` and `unset_key()` in python-dotenv follow symbolic links when rewriting `.env` files, allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. Users should upgrade to v.1.2.2 or, as a workaround, apply the patch manually.\n\nPackage: python-dotenv\nInstalled: 1.1.0\nFixed in: 1.2.2\nSeverity: MEDIUM\nFix: Upgrade python-dotenv to 1.2.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-41d07d787aa308d9", "name": "CVE-2026-24486: python-multipart 0.0.20 \u2014 backend/requirements.txt", "shortDescription": {"text": "CVE-2026-24486: python-multipart 0.0.20 \u2014 backend/requirements.txt"}, "fullDescription": {"text": "python-multipart: Python-Multipart: Arbitrary file write via path traversal vulnerability\n\nPython-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbitrary locations on the filesystem by crafting a malicious filename. Users should upgrade to version 0.0.22 to receive a patch or, as a workaround, avoid using `UPLOAD_KEEP_FILENAME=True` in project configurations.\n\nPackage: python-multipart\nInstalled: 0.0.20\nFixed in: 0.0.22\nSeverity: HIGH\nFix: Upgrade python-multipart to 0.0.22"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9bdf5a2de92553f9", "name": "CVE-2026-42561: python-multipart 0.0.20 \u2014 backend/requirements.txt", "shortDescription": {"text": "CVE-2026-42561: python-multipart 0.0.20 \u2014 backend/requirements.txt"}, "fullDescription": {"text": "python-multipart: python-multipart: Denial of Service via excessive multipart part headers\n\nPython-Multipart is a streaming multipart parser for Python. Prior to 0.0.27, python-multipart has a denial of service vulnerability in multipart part header parsing. When parsing multipart/form-data, MultipartParser previously had no limit on the number of part headers or the size of an individual part header. An attacker could send a request with either many repeated headers without terminating the header block or a single very large header value, causing excessive CPU work before request reje\n\nPackage: python-multipart\nInstalled: 0.0.20\nFixed in: 0.0.27\nSeverity: HIGH\nFix: Upgrade python-multipart to 0.0.27"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-429531869356e982", "name": "CVE-2026-53539: python-multipart 0.0.20 \u2014 backend/requirements.txt", "shortDescription": {"text": "CVE-2026-53539: python-multipart 0.0.20 \u2014 backend/requirements.txt"}, "fullDescription": {"text": "python-multipart: Python-Multipart: Denial of Service via crafted form-urlencoded bodies\n\nPython-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, when parsing application/x-www-form-urlencoded bodies, QuerystringParser located the field separator with a two step lookup: it first scanned the entire remaining buffer for &, and only when no & existed anywhere ahead did it fall back to scanning for ;. For a body that uses ; as the separator and contains no &, every field iteration performed a full failed & scan over the entire remaining buffer before locating the ne\n\nPackage: python-multipart\nInstalled: 0.0.20\nFixed in: 0.0.30\nSeverity: HIGH\nFix: Upgrade python-multipart to 0.0.30"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d62d5798dedaabab", "name": "CVE-2026-40347: python-multipart 0.0.20 \u2014 backend/requirements.txt", "shortDescription": {"text": "CVE-2026-40347: python-multipart 0.0.20 \u2014 backend/requirements.txt"}, "fullDescription": {"text": "python-multipart: Python-Multipart: Denial of Service via crafted multipart/form-data requests\n\nPython-Multipart is a streaming multipart parser for Python. Versions prior to 0.0.26 have a denial of service vulnerability when parsing crafted `multipart/form-data` requests with large preamble or epilogue sections. Upgrade to version 0.0.26 or later, which skips ahead to the next boundary candidate when processing leading CR/LF data and immediately discards epilogue data after the closing boundary.\n\nPackage: python-multipart\nInstalled: 0.0.20\nFixed in: 0.0.26\nSeverity: MEDIUM\nFix: Upgrade python-multipart to 0.0.26"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8a4fda5e0544583e", "name": "CVE-2026-53537: python-multipart 0.0.20 \u2014 backend/requirements.txt", "shortDescription": {"text": "CVE-2026-53537: python-multipart 0.0.20 \u2014 backend/requirements.txt"}, "fullDescription": {"text": "multipart: Python-Multipart: Information disclosure via header parsing discrepancy\n\nPython-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, parse_options_header parsed Content-Disposition (and Content-Type) headers with email.message.Message, which transparently applies RFC 2231/5987 decoding. The extended parameter syntax (filename*=charset'lang'value, name*=..., and the filename*0/filename*1 continuation form) is decoded and surfaced under the bare filename/name key, and overrides the plain parameter when both are present. RFC 7578 \u00a74.2 explicitly forbid\n\nPackage: python-multipart\nInstalled: 0.0.20\nFixed in: 0.0.30\nSeverity: LOW\nFix: Upgrade python-multipart to 0.0.30"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fc27466c3f82e67a", "name": "CVE-2026-53538: python-multipart 0.0.20 \u2014 backend/requirements.txt", "shortDescription": {"text": "CVE-2026-53538: python-multipart 0.0.20 \u2014 backend/requirements.txt"}, "fullDescription": {"text": "python-multipart: Python-Multipart: Information disclosure due to parser differential in form data handling\n\nPython-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern browsers, and Python's urllib.parse (since the CVE-2021-23336 fix) treat only & as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form \n\nPackage: python-multipart\nInstalled: 0.0.20\nFixed in: 0.0.30\nSeverity: LOW\nFix: Upgrade python-multipart to 0.0.30"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-68dfefffd5aadcac", "name": "CVE-2026-53540: python-multipart 0.0.20 \u2014 backend/requirements.txt", "shortDescription": {"text": "CVE-2026-53540: python-multipart 0.0.20 \u2014 backend/requirements.txt"}, "fullDescription": {"text": "python-multipart: Python-Multipart: Negative Content-Length in parse_form buffers the entire body in memory\n\nPython-Multipart is a streaming multipart parser for Python. Prior to 0.0.31, parse_form() did not validate the Content-Length header before using it to bound its chunked read of the request body. A negative Content-Length turned the bounded read into a read-until-EOF, so the entire body was loaded into memory in a single read instead of in fixed-size chunks. This vulnerability is fixed in 0.0.31.\n\nPackage: python-multipart\nInstalled: 0.0.20\nFixed in: 0.0.31\nSeverity: LOW\nFix: Upgrade python-multipart to 0.0.31"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-febbdc86a35b1210", "name": "CVE-2026-49356: @babel/core 7.29.0 \u2014 frontend/pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-49356: @babel/core 7.29.0 \u2014 frontend/pnpm-lock.yaml"}, "fullDescription": {"text": "@babel/core: @babel/core: Arbitrary file read via sourceMappingURL comment\n\nBabel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 an\n\nPackage: @babel/core\nInstalled: 7.29.0\nFixed in: 8.0.0-rc.6, 7.29.6\nSeverity: LOW\nFix: Upgrade @babel/core to 8.0.0-rc.6, 7.29.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d36be0e33794978", "name": "CVE-2026-13149: brace-expansion 2.1.0 \u2014 frontend/pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-13149: brace-expansion 2.1.0 \u2014 frontend/pnpm-lock.yaml"}, "fullDescription": {"text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity\n\nbrace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.\n\nPackage: brace-expansion\nInstalled: 2.1.0\nFixed in: 5.0.7, 1.1.16, 2.1.2\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.7, 1.1.16, 2.1.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3e8e9fdc8a35927a", "name": "CVE-2026-48801: linkify-it 5.0.0 \u2014 frontend/pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-48801: linkify-it 5.0.0 \u2014 frontend/pnpm-lock.yaml"}, "fullDescription": {"text": "linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability\n\nlinkify-it is a links recognition library with full Unicode support. Prior to 5.0.1, LinkifyIt.prototype.match, the package's primary public API, has O(N\u00b2) algorithmic complexity for inputs containing many fuzzy links or emails because the JavaScript-level scan loop re-slices input and re-runs unanchored regex searches on progressively shorter tails. Any service that synchronously renders untrusted Markdown with linkify:true on a request hot path can inherit a worker-process denial of service tr\n\nPackage: linkify-it\nInstalled: 5.0.0\nFixed in: 5.0.1\nSeverity: HIGH\nFix: Upgrade linkify-it to 5.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a720a1cbdcbfddca", "name": "CVE-2026-59887: linkify-it 5.0.0 \u2014 frontend/pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-59887: linkify-it 5.0.0 \u2014 frontend/pnpm-lock.yaml"}, "fullDescription": {"text": "linkify-it: Quadratic-complexity DoS via the `mailto:` validator scan-loop on attacker text\n\nlinkify-it is a links recognition library with full Unicode support. Prior to 5.0.2, the mailto: schema validator used by .test() and .match() can be invoked at every mailto: occurrence and scan the remaining input through src_email_name in lib/re.mjs, causing O(n^2) CPU consumption on crafted user text. This issue is fixed in version 5.0.2.\n\nPackage: linkify-it\nInstalled: 5.0.0\nFixed in: 5.0.2\nSeverity: HIGH\nFix: Upgrade linkify-it to 5.0.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fcffb21b742a99d8", "name": "CVE-2026-48988: markdown-it 14.1.1 \u2014 frontend/pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-48988: markdown-it 14.1.1 \u2014 frontend/pnpm-lock.yaml"}, "fullDescription": {"text": "markdown-it is a Markdown parser. Versions 14.1.1 and below contain a  ...\n\nmarkdown-it is a Markdown parser. Versions 14.1.1 and below contain a denial-of-service vulnerability when typographer: true is enabled, due to quadratic (O(n^2)) processing in the smartquotes rule. The issue stems from repeatedly modifying strings with replaceAt(), which performs O(n) slicing and concatenation per quote character. This can cause excessive CPU consumption when parsing quote-heavy, user-supplied markdown and may let attackers degrade or disrupt service availability. Although typo\n\nPackage: markdown-it\nInstalled: 14.1.1\nFixed in: 14.2.0\nSeverity: MEDIUM\nFix: Upgrade markdown-it to 14.2.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-417a083d737dbc7d", "name": "CVE-2026-44573: next 14.2.35 \u2014 frontend/pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-44573: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "fullDescription": {"text": "next.js: Next.js: Information disclosure due to middleware bypass in Pages Router with i18n\n\nNext.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, Applications using the Pages Router with i18n configured and middleware/proxy-based authorization can allow unauthorized access to protected page data through locale-less /_next/data/<buildId>/<page>.json requests. In affected configurations, middleware does not run for the unprefixed data route, allowing an attacker to retrieve SSR JSON for protected pages without passing the intende\n\nPackage: next\nInstalled: 14.2.35\nFixed in: 15.5.16, 16.2.5\nSeverity: HIGH\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-963b883651c7cf14", "name": "CVE-2026-44578: next 14.2.35 \u2014 frontend/pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-44578: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "fullDescription": {"text": "Next.js: Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requests\n\nNext.js is a React framework for building full-stack web applications. From 13.4.13 to before 15.5.16 and 16.2.5, self-hosted applications using the built-in Node.js server can be vulnerable to server-side request forgery through crafted WebSocket upgrade requests. An attacker can cause the server to proxy requests to arbitrary internal or external destinations, which may expose internal services or cloud metadata endpoints. Vercel-hosted deployments are not affected. This vulnerability is fixed\n\nPackage: next\nInstalled: 14.2.35\nFixed in: 15.5.16, 16.2.5\nSeverity: HIGH\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3d72bfcd8fea1ae7", "name": "CVE-2026-64641: next 14.2.35 \u2014 frontend/pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-64641: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "fullDescription": {"text": "Next.js: Denial of Service in App Router using Server Actions\n\n## Impact\n\nCrafted requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive CPU usage blocking processing of further requests in the same process.\n\n## Workarounds\n\nNo workaround exists besides upgrading. Applications using Pages Router or not using Server Actions are not vulnerable.\n\nPackage: next\nInstalled: 14.2.35\nFixed in: 15.5.21, 16.2.11\nSeverity: HIGH\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-128331724a227a23", "name": "CVE-2026-64645: next 14.2.35 \u2014 frontend/pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-64645: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "fullDescription": {"text": "Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname\n\n## Impact\n\nA `rewrites()` or `redirects()` rule that builds its external destination hostname from request-controlled input can be pointed at an arbitrary hostname, regardless of the rule's\u00a0hostname suffix. For a rewrite, Next.js proxies the request to that arbitrary host and serves the response from the application's origin, leading to Server-Side Request forgery. A `redirects()` rule configured this way is vulnerable to an Open Redirect.\n\nThis affects any destination that puts a dynamic segmen\n\nPackage: next\nInstalled: 14.2.35\nFixed in: 15.5.21, 16.2.11\nSeverity: HIGH\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-72f713819eee4350", "name": "CVE-2026-64649: next 14.2.35 \u2014 frontend/pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-64649: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "fullDescription": {"text": "Next.js: Server-Side Request Forgery in Server Actions on custom servers\n\n## Impact\n\nWhen a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization.\n\nApplications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs\n\nPackage: next\nInstalled: 14.2.35\nFixed in: 15.5.21, 16.2.11\nSeverity: HIGH\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c98869f79570281c", "name": "GHSA-8h8q-6873-q5fj: next 14.2.35 \u2014 frontend/pnpm-lock.yaml", "shortDescription": {"text": "GHSA-8h8q-6873-q5fj: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "fullDescription": {"text": "Next.js Vulnerable to Denial of Service with Server Components\n\nA vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23870](https://github.com/facebook/react/security/advisories/GHSA-rv78-f8rc-xrxh). \n\nA specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage. This can result in denial of \n\nPackage: next\nInstalled: 14.2.35\nFixed in: 15.5.16, 16.2.5\nSeverity: HIGH\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-73edc2b61f1577f6", "name": "GHSA-h25m-26qc-wcjf: next 14.2.35 \u2014 frontend/pnpm-lock.yaml", "shortDescription": {"text": "GHSA-h25m-26qc-wcjf: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "fullDescription": {"text": "Next.js HTTP request deserialization can lead to DoS when using insecure React Server Components\n\nA vulnerability affects certain React Server Components packages for versions 19.0.x, 19.1.x, and 19.2.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23864](https://github.com/facebook/react/security/advisories/GHSA-83fc-fqcc-2hmg).\n\nA specially crafted HTTP request can be sent to any App Router Server Function endpoint that, when deserialized, may trigger excessive CPU usage, out-of-m\n\nPackage: next\nInstalled: 14.2.35\nFixed in: 15.0.8, 15.1.12, 15.2.9, 15.3.9, 15.4.11, 15.5.10, 15.6.0-canary.61, 16.0.11, 16.1.5\nSeverity: HIGH\nFix: Upgrade next to 15.0.8, 15.1.12, 15.2.9, 15.3.9, 15.4.11, 15.5.10, 15.6.0-canary.61, 16.0.11, 16.1.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b917f5a5fd20496a", "name": "GHSA-q4gf-8mx6-v5v3: next 14.2.35 \u2014 frontend/pnpm-lock.yaml", "shortDescription": {"text": "GHSA-q4gf-8mx6-v5v3: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "fullDescription": {"text": "Next.js has a Denial of Service with Server Components\n\nA vulnerability affects certain React Server Components packages for versions 19.x and frameworks that use the affected packages, including Next.js 13.x, 14.x, 15.x, and 16.x using the App Router. The issue is tracked upstream as [CVE-2026-23869](https://github.com/facebook/react/security/advisories/GHSA-479c-33wc-g2pg). You can read more about this advisory our [this changelog](https://vercel.com/changelog/summary-of-cve-2026-23869).\n\nA specially crafted HTTP request can be sent to any App Rout\n\nPackage: next\nInstalled: 14.2.35\nFixed in: 15.5.15, 16.2.3\nSeverity: HIGH\nFix: Upgrade next to 15.5.15, 16.2.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b3b7f75e2de71244", "name": "CVE-2025-59471: next 14.2.35 \u2014 frontend/pnpm-lock.yaml", "shortDescription": {"text": "CVE-2025-59471: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "fullDescription": {"text": "next: NextJS Denial of Service in Image Optimizer\n\nA denial of service vulnerability exists in self-hosted Next.js applications that have `remotePatterns` configured for the Image Optimizer. The image optimization endpoint (`/_next/image`) loads external images entirely into memory without enforcing a maximum size limit, allowing an attacker to cause out-of-memory conditions by requesting optimization of arbitrarily large images. This vulnerability requires that `remotePatterns` is configured to allow image optimization from external domains and\n\nPackage: next\nInstalled: 14.2.35\nFixed in: 15.5.10, 16.1.5\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.10, 16.1.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-59eb22f11d23a2b1", "name": "CVE-2026-27980: next 14.2.35 \u2014 frontend/pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-27980: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "fullDescription": {"text": "next.js: Next.js: Unbounded next/image disk cache growth can exhaust storage\n\nNext.js is a React framework for building full-stack web applications. Starting in version 10.0.0 and prior to version 16.1.7, the default Next.js image optimization disk cache (`/_next/image`) did not have a configurable upper bound, allowing unbounded cache growth. An attacker could generate many unique image-optimization variants and exhaust disk space, causing denial of service. This is fixed in version 16.1.7 by adding an LRU-backed disk cache with `images.maximumDiskCacheSize`, including e\n\nPackage: next\nInstalled: 14.2.35\nFixed in: 16.1.7, 15.5.14\nSeverity: MEDIUM\nFix: Upgrade next to 16.1.7, 15.5.14"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ed5f9886404cac4c", "name": "CVE-2026-29057: next 14.2.35 \u2014 frontend/pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-29057: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "fullDescription": {"text": "next.js: Next.js: HTTP request smuggling in rewrites\n\nNext.js is a React framework for building full-stack web applications. Starting in version 9.5.0 and prior to versions 15.5.13 and 16.1.7, when Next.js rewrites proxy traffic to an external backend, a crafted `DELETE`/`OPTIONS` request using `Transfer-Encoding: chunked` could trigger request boundary disagreement between the proxy and backend. This could allow request smuggling through rewritten routes. An attacker could smuggle a second request to unintended backend routes (for example, interna\n\nPackage: next\nInstalled: 14.2.35\nFixed in: 16.1.7, 15.5.13\nSeverity: MEDIUM\nFix: Upgrade next to 16.1.7, 15.5.13"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d903d89d375593a", "name": "CVE-2026-44576: next 14.2.35 \u2014 frontend/pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-44576: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "fullDescription": {"text": "Next.js: Next.js: Cache poisoning vulnerability in React Server Components\n\nNext.js is a React framework for building full-stack web applications. From 14.2.0 to before 15.5.16 and 16.2.5, applications using React Server Components can be vulnerable to cache poisoning when shared caches do not correctly partition response variants. Under affected conditions, an attacker can cause an RSC response to be served from the original URL and poison shared cache entries so later visitors receive component payloads instead of the expected HTML. This vulnerability is fixed in 15.5\n\nPackage: next\nInstalled: 14.2.35\nFixed in: 15.5.16, 16.2.5\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-824de2883c03c2cf", "name": "CVE-2026-44577: next 14.2.35 \u2014 frontend/pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-44577: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "fullDescription": {"text": "Next.js: Next.js: Denial of Service via Image Optimization API\n\nNext.js is a React framework for building full-stack web applications. From 10.0.0 to before 15.5.16 and 16.2.5, when self-hosting Next.js with the default image loader, the Image Optimization API fetches local images entirely into memory without enforcing a maximum size limit. An attacker could cause out-of-memory conditions by requesting large local assets from the /_next/image endpoint that match the images.localPatterns configuration (by default, all patterns are allowed). This vulnerability\n\nPackage: next\nInstalled: 14.2.35\nFixed in: 15.5.16, 16.2.5\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-77682c6389c70a01", "name": "CVE-2026-44580: next 14.2.35 \u2014 frontend/pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-44580: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "fullDescription": {"text": "next.js: Next.js: Cross-site scripting allows arbitrary code execution via untrusted script content\n\nNext.js is a React framework for building full-stack web applications. From 13.0.0 to before 15.5.16 and 16.2.5, applications that use beforeInteractive scripts together with untrusted content can be vulnerable to cross-site scripting. In affected versions, serialized script content was not escaped safely before being embedded into the document, which could allow attacker-controlled input to break out of the intended script context and execute arbitrary JavaScript in a visitor's browser. This vu\n\nPackage: next\nInstalled: 14.2.35\nFixed in: 15.5.16, 16.2.5\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-55f6a73bc5b3ffa8", "name": "CVE-2026-44581: next 14.2.35 \u2014 frontend/pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-44581: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "fullDescription": {"text": "next.js: Next.js: Stored Cross-Site Scripting via malformed nonce values in cached responses\n\nNext.js is a React framework for building full-stack web applications. From 13.4.0 to before 15.5.16 and 16.2.5, App Router applications that rely on CSP nonces can be vulnerable to stored cross-site scripting when deployed behind shared caches. In affected versions, malformed nonce values derived from request headers could be reflected into rendered HTML in an unsafe way, allowing an attacker to poison cached responses and cause script execution for later visitors. This vulnerability is fixed i\n\nPackage: next\nInstalled: 14.2.35\nFixed in: 15.5.16, 16.2.5\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bc20e6832f1e576c", "name": "CVE-2026-64643: next 14.2.35 \u2014 frontend/pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-64643: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "fullDescription": {"text": "Next.js: Unauthenticated disclosure of internal Server Function endpoints\n\n## Impact\n\nIn Next.js applications using App Router, Server Actions (`use server`) or `use cache` endpoints can be disclosed bypassing any authentication on the pages where these endpoints are usually used.\n\nServer Action IDs can be disclosed to unauthenticated users via publicly served client artifacts (for example, static chunks containing action references).\n\nAffected users are applications using App Router + Server Actions.  \n\nBy itself, this disclosure is typically a recon/enumeration primi\n\nPackage: next\nInstalled: 14.2.35\nFixed in: 15.5.21, 16.2.11\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-63253a8dcec9af9a", "name": "CVE-2026-64646: next 14.2.35 \u2014 frontend/pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-64646: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "fullDescription": {"text": "Next.js: Unbounded Server Action payload in Edge runtime\n\n## Impact\n\nRequests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime\n\n## Workarounds\n\nIf you cannot upgrade, ensure your hosting provider limits the request's body size. 5 MiB should be allowed at max by your hosting provider.\n\nPackage: next\nInstalled: 14.2.35\nFixed in: 15.5.21, 16.2.11\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7b53a8cfc96eb7ca", "name": "CVE-2026-64647: next 14.2.35 \u2014 frontend/pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-64647: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "fullDescription": {"text": "Next.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences\n\n## Impact\n\nA server-side `fetch` with a request body may return a cached **response** body from a different request to the same URL but different body. Confidential data in the `POST`'s **response** body would then leak to unauthorized requests. Though the request itself will not be deduped.\n\nThis is only an issue when receiving request bodies with a content type charset other than UTF-8. For example, the UTF-16 byte sequences for `\uc083\uc083` and `\uc104\uc104` in the request body would share the same cache.\n\n##\n\nPackage: next\nInstalled: 14.2.35\nFixed in: 15.5.21, 16.2.11\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8c5b3659d01fad8a", "name": "CVE-2026-64648: next 14.2.35 \u2014 frontend/pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-64648: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "fullDescription": {"text": "Next.js: Cache confusion of response bodies for requests with bodies\n\n## Impact\n\nA server-side `fetch` with a request body may return a cached **response** body from a different request to the same URL but different body. Confidential data in the `POST`'s **response** body would then leak to unauthorized requests. Though the request itself will not be deduped.\n\nThis only applies to `fetch` calls with a request that has a different init than the one passed to `fetch`.\nSafe: `fetch(new Request(init), init)`\nUnsafe: `fetch(new Request(init), aDifferentInit)`\n\n## Work\n\nPackage: next\nInstalled: 14.2.35\nFixed in: 15.5.21, 16.2.11\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.21, 16.2.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e7e5b63bd429464c", "name": "CVE-2026-44572: next 14.2.35 \u2014 frontend/pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-44572: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "fullDescription": {"text": "next.js: Next.js: Denial of Service due to improper handling of x-nextjs-data header with redirects\n\nNext.js is a React framework for building full-stack web applications. From 12.2.0 to before 15.5.16 and 16.2.5, an external client could send a x-nextjs-data header on a normal request to a path handled by middleware that returns a redirect. When that happened, the middleware/proxy could treat the request as a data request and replace the standard Location redirect header with the internal x-nextjs-redirect header. Browsers do not follow x-nextjs-redirect, so the response became an unusable red\n\nPackage: next\nInstalled: 14.2.35\nFixed in: 15.5.16, 16.2.5\nSeverity: LOW\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-192c87782eed48a1", "name": "CVE-2026-44582: next 14.2.35 \u2014 frontend/pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-44582: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "fullDescription": {"text": "Next.js: Next.js: Cache poisoning allows incorrect response delivery\n\nNext.js is a React framework for building full-stack web applications. From 13.4.6 to before 15.5.16 and 16.2.5, React Server Component responses can be vulnerable to cache poisoning in deployments that rely on shared caches with insufficient response partitioning. In affected conditions, collisions in the _rsc cache-busting value can allow an attacker to poison cache entries so users receive the wrong response variant for a given URL. This vulnerability is fixed in 15.5.16 and 16.2.5.\n\nPackage: next\nInstalled: 14.2.35\nFixed in: 15.5.16, 16.2.5\nSeverity: LOW\nFix: Upgrade next to 15.5.16, 16.2.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a2543dc3d22eba66", "name": "CVE-2026-41305: postcss 8.4.31 \u2014 frontend/pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-41305: postcss 8.4.31 \u2014 frontend/pnpm-lock.yaml"}, "fullDescription": {"text": "postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.\n\nPackage: postcss\nInstalled: 8.4.31\nFixed in: 8.5.10\nSeverity: MEDIUM\nFix: Upgrade postcss to 8.5.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ca9b1598cf19a2c9", "name": "CVE-2026-41907: uuid 8.3.2 \u2014 frontend/pnpm-lock.yaml", "shortDescription": {"text": "CVE-2026-41907: uuid 8.3.2 \u2014 frontend/pnpm-lock.yaml"}, "fullDescription": {"text": "uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality\n\nuuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.\n\nPackage: uuid\nInstalled: 8.3.2\nFixed in: 11.1.1, 12.0.1, 13.0.1\nSeverity: MEDIUM\nFix: Upgrade uuid to 11.1.1, 12.0.1, 13.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e00ba51ffdb0e2bc", "name": "DS-0002: Image user should not be 'root' \u2014 backend/Dockerfile.app", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 backend/Dockerfile.app"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: backend/Dockerfile.app"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-62c588d517c8f5c6", "name": "DS-0029: 'apt-get' missing '--no-install-recommends' \u2014 backend/Dockerfile.app", "shortDescription": {"text": "DS-0029: 'apt-get' missing '--no-install-recommends' \u2014 backend/Dockerfile.app"}, "fullDescription": {"text": "'apt-get' missing '--no-install-recommends'\n\n'--no-install-recommends' flag is missed: 'apt-get update && apt-get install -y     curl     && rm -rf /var/lib/apt/lists/*'\n\nRule: DS-0029\nSeverity: HIGH\nTarget: backend/Dockerfile.app"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-feb76d8c8f785250", "name": "DS-0029: 'apt-get' missing '--no-install-recommends' \u2014 backend/Dockerfile.server-cpu", "shortDescription": {"text": "DS-0029: 'apt-get' missing '--no-install-recommends' \u2014 backend/Dockerfile.server-cpu"}, "fullDescription": {"text": "'apt-get' missing '--no-install-recommends'\n\n'--no-install-recommends' flag is missed: 'apt-get update && apt-get install -y     build-essential     cmake     git     wget     pkg-config     libsdl2-dev     && rm -rf /var/lib/apt/lists/*'\n\nRule: DS-0029\nSeverity: HIGH\nTarget: backend/Dockerfile.server-cpu"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-62bf32276cc4596d", "name": "DS-0029: 'apt-get' missing '--no-install-recommends' \u2014 backend/Dockerfile.server-gpu", "shortDescription": {"text": "DS-0029: 'apt-get' missing '--no-install-recommends' \u2014 backend/Dockerfile.server-gpu"}, "fullDescription": {"text": "'apt-get' missing '--no-install-recommends'\n\n'--no-install-recommends' flag is missed: 'apt-get update && apt-get install -y     build-essential     cmake     git     wget     pkg-config     libsdl2-dev     && rm -rf /var/lib/apt/lists/*'\n\nRule: DS-0029\nSeverity: HIGH\nTarget: backend/Dockerfile.server-gpu"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0f842d787ac002d0", "name": "DS-0029: 'apt-get' missing '--no-install-recommends' \u2014 backend/Dockerfile.server-macos", "shortDescription": {"text": "DS-0029: 'apt-get' missing '--no-install-recommends' \u2014 backend/Dockerfile.server-macos"}, "fullDescription": {"text": "'apt-get' missing '--no-install-recommends'\n\n'--no-install-recommends' flag is missed: 'apt-get update && apt-get install -y     build-essential     cmake     git     wget     pkg-config     libsdl2-dev     && rm -rf /var/lib/apt/lists/*'\n\nRule: DS-0029\nSeverity: HIGH\nTarget: backend/Dockerfile.server-macos"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-00f762e952a7fdee", "name": "Insecure pattern 'node_child_process' in frontend/scripts/auto-detect-gpu.js:7", "shortDescription": {"text": "Insecure pattern 'node_child_process' in frontend/scripts/auto-detect-gpu.js:7"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-2d1a8f9c9ff96291", "name": "Insecure pattern 'node_child_process' in frontend/scripts/tauri-auto.js:6", "shortDescription": {"text": "Insecure pattern 'node_child_process' in frontend/scripts/tauri-auto.js:6"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.9}}, {"id": "scanner-75da38780fda9a93", "name": "Possible secret in frontend/src-tauri/src/lib_old_complex.rs", "shortDescription": {"text": "Possible secret in frontend/src-tauri/src/lib_old_complex.rs"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching generic_api_key. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.72}}, {"id": "scanner-a801cd3442de9d2d", "name": "Possible secret in frontend/src-tauri/src/analytics/commands.rs", "shortDescription": {"text": "Possible secret in frontend/src-tauri/src/analytics/commands.rs"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching generic_api_key. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.72}}, {"id": "scanner-067758e72d298deb", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/src/app/notes/[id]/page.tsx:174", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/src/app/notes/[id]/page.tsx:174"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-4f724a257c5083a9", "name": "Insecure pattern 'cors_wildcard' in scripts/test-update-locally.js:64", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in scripts/test-update-locally.js:64"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-94934be055b74668", "name": "Insecure pattern 'cors_wildcard' in backend/app/main.py:46", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in backend/app/main.py:46"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-54f10efc48351923", "name": "Insecure pattern 'weak_hash' in .github/workflows/build-windows.yml:374", "shortDescription": {"text": "Insecure pattern 'weak_hash' in .github/workflows/build-windows.yml:374"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e3d76b90742c18c8", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a8fe4d106191eff7", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cf880af02cdc7559", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ddc00f9f9d305e77", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d1bab6ae48e5872", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e91838cee6739c63", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-46c644c6227e4d4a", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1838a141491ce38c", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-360cb263256aacfa", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6e61fb60af308a45", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-67cb8bcad9284f7b", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6ba9bfab5f283202", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b769174c9fcf8ea8", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e587fd4cfccc926d", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3d9895df4231ea7f", "name": "Very large file: frontend/src-tauri/src/lib_old_complex.rs (2437 lines)", "shortDescription": {"text": "Very large file: frontend/src-tauri/src/lib_old_complex.rs (2437 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af09ecd370355721", "name": "Very large file: frontend/src/components/ModelSettingsModal.tsx (1408 lines)", "shortDescription": {"text": "Very large file: frontend/src/components/ModelSettingsModal.tsx (1408 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ef596331ac43260", "name": "Very large file: backend/run-docker.sh (2008 lines)", "shortDescription": {"text": "Very large file: backend/run-docker.sh (2008 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "5 test file(s) for 330 source file(s) (ratio 0.02). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 485 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 74 placeholder/mock markers across 34 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-58bedf14d559c6f9", "name": "Legacy-named symbol `eleven_multilingual_v2` in frontend/src/components/TranscriptSettings.tsx:57", "shortDescription": {"text": "Legacy-named symbol `eleven_multilingual_v2` in frontend/src/components/TranscriptSettings.tsx:57"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-539374dcc5622cef", "name": "Commented-code block (5 lines) in frontend/src/components/Sidebar/index.tsx:97", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/src/components/Sidebar/index.tsx:97"}, "fullDescription": {"text": "4 of 5 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-6348b763eaf09ef5", "name": "Legacy-named symbol `daysOld` in frontend/src/services/indexedDBService.ts:326", "shortDescription": {"text": "Legacy-named symbol `daysOld` in frontend/src/services/indexedDBService.ts:326"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af022f937dd5b7fd", "name": "9 env vars used in code but missing from .env.example", "shortDescription": {"text": "9 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `APPDATA`, `BLAS_INCLUDE_DIRS`, `CUDA_PATH`, `DATABASE_PATH`, `NODE_ENV`, `OLLAMA_HOST`, `ROCM_PATH`, `TAURI_GPU_FEATURE` + 1 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ebe08a58f15297e7", "name": "FastAPI POST `save_meeting_title` without auth dependency \u2014 backend/app/main.py:196", "shortDescription": {"text": "FastAPI POST `save_meeting_title` without auth dependency \u2014 backend/app/main.py:196"}, "fullDescription": {"text": "`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.75}}, {"id": "scanner-888a519a8f0cee1c", "name": "FastAPI POST `delete_meeting` without auth dependency \u2014 backend/app/main.py:206", "shortDescription": {"text": "FastAPI POST `delete_meeting` without auth dependency \u2014 backend/app/main.py:206"}, "fullDescription": {"text": "`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.75}}, {"id": "scanner-66d5fb7adfdd84ac", "name": "FastAPI POST `process_transcript_api` without auth dependency \u2014 backend/app/main.py:329", "shortDescription": {"text": "FastAPI POST `process_transcript_api` without auth dependency \u2014 backend/app/main.py:329"}, "fullDescription": {"text": "`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.75}}, {"id": "scanner-04ff5814b5a2de41", "name": "FastAPI POST `save_transcript` without auth dependency \u2014 backend/app/main.py:511", "shortDescription": {"text": "FastAPI POST `save_transcript` without auth dependency \u2014 backend/app/main.py:511"}, "fullDescription": {"text": "`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.75}}, {"id": "scanner-a52f3e6baf3a2ca8", "name": "FastAPI POST `save_model_config` without auth dependency \u2014 backend/app/main.py:560", "shortDescription": {"text": "FastAPI POST `save_model_config` without auth dependency \u2014 backend/app/main.py:560"}, "fullDescription": {"text": "`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.75}}, {"id": "scanner-32b75008a78f9a81", "name": "FastAPI POST `save_transcript_config` without auth dependency \u2014 backend/app/main.py:578", "shortDescription": {"text": "FastAPI POST `save_transcript_config` without auth dependency \u2014 backend/app/main.py:578"}, "fullDescription": {"text": "`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.75}}, {"id": "scanner-4d6a8719f140bc14", "name": "FastAPI POST `get_api_key` without auth dependency \u2014 backend/app/main.py:589", "shortDescription": {"text": "FastAPI POST `get_api_key` without auth dependency \u2014 backend/app/main.py:589"}, "fullDescription": {"text": "`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.75}}, {"id": "scanner-1d71af6ec9a90b58", "name": "FastAPI POST `get_transcript_api_key` without auth dependency \u2014 backend/app/main.py:596", "shortDescription": {"text": "FastAPI POST `get_transcript_api_key` without auth dependency \u2014 backend/app/main.py:596"}, "fullDescription": {"text": "`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.75}}, {"id": "scanner-645b932051f7e8be", "name": "FastAPI POST `save_meeting_summary` without auth dependency \u2014 backend/app/main.py:607", "shortDescription": {"text": "FastAPI POST `save_meeting_summary` without auth dependency \u2014 backend/app/main.py:607"}, "fullDescription": {"text": "`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.75}}, {"id": "scanner-38446bac3cb30438", "name": "FastAPI POST `search_transcripts` without auth dependency \u2014 backend/app/main.py:623", "shortDescription": {"text": "FastAPI POST `search_transcripts` without auth dependency \u2014 backend/app/main.py:623"}, "fullDescription": {"text": "`@app.post` has no route-local auth dependency, and `app` has no auth-shaped constructor dependency in this file. Mutating endpoints should normally authenticate. Auth enforced where the router is mounted, by a trusted gateway, or by a local-only deployment can make this finding non-reachable."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.75}}, {"id": "scanner-13f24b5d2689e542", "name": "Vulnerable dependency anyhow 1.0.102: RUSTSEC-2026-0190", "shortDescription": {"text": "Vulnerable dependency anyhow 1.0.102: RUSTSEC-2026-0190"}, "fullDescription": {"text": "OSV.dev reports `anyhow` at version `1.0.102` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0190.\n\nUnsoundness in `Error::downcast_mut()`\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0190\nFix: upgrade `anyhow` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-514f0913b7f28acb", "name": "Vulnerable dependency tar 0.4.45: GHSA-3pv8-6f4r-ffg2", "shortDescription": {"text": "Vulnerable dependency tar 0.4.45: GHSA-3pv8-6f4r-ffg2"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `0.4.45` (resolved in `Cargo.lock`) is affected by GHSA-3pv8-6f4r-ffg2.\n\ntar has a PAX header desynchronization issue\n\nAdvisory: https://osv.dev/vulnerability/GHSA-3pv8-6f4r-ffg2\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c87a8512ea3042b2", "name": "Vulnerable dependency next 14.2.35: GHSA-36qx-fr4f-26g5", "shortDescription": {"text": "Vulnerable dependency next 14.2.35: GHSA-36qx-fr4f-26g5"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-36qx-fr4f-26g5 (aka CVE-2026-44573).\n\nNext.js has a Middleware / Proxy bypass in Pages Router applications using i18n\n\nAliases: CVE-2026-44573\nAdvisory: https://osv.dev/vulnerability/GHSA-36qx-fr4f-26g5\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9a736a7379f85384", "name": "Vulnerable dependency next 14.2.35: GHSA-3g8h-86w9-wvmq", "shortDescription": {"text": "Vulnerable dependency next 14.2.35: GHSA-3g8h-86w9-wvmq"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-3g8h-86w9-wvmq (aka CVE-2026-44572).\n\nNext.js's Middleware / Proxy redirects can be cache-poisoned\n\nAliases: CVE-2026-44572\nAdvisory: https://osv.dev/vulnerability/GHSA-3g8h-86w9-wvmq\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b2ba659e4c9a6745", "name": "Vulnerable dependency next 14.2.35: GHSA-3x4c-7xq6-9pq8", "shortDescription": {"text": "Vulnerable dependency next 14.2.35: GHSA-3x4c-7xq6-9pq8"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-3x4c-7xq6-9pq8 (aka CVE-2026-27980).\n\nNext.js: Unbounded next/image disk cache growth can exhaust storage\n\nAliases: CVE-2026-27980\nAdvisory: https://osv.dev/vulnerability/GHSA-3x4c-7xq6-9pq8\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3412b90e10aef24b", "name": "Vulnerable dependency next 14.2.35: GHSA-4633-3j49-mh5q", "shortDescription": {"text": "Vulnerable dependency next 14.2.35: GHSA-4633-3j49-mh5q"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-4633-3j49-mh5q (aka CVE-2026-64647).\n\nNext.js: Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences\n\nAliases: CVE-2026-64647\nAdvisory: https://osv.dev/vulnerability/GHSA-4633-3j49-mh5q\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea6cbd7b05c03f41", "name": "Vulnerable dependency next 14.2.35: GHSA-4c39-4ccg-62r3", "shortDescription": {"text": "Vulnerable dependency next 14.2.35: GHSA-4c39-4ccg-62r3"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-4c39-4ccg-62r3 (aka CVE-2026-64646).\n\nNext.js: Unbounded Server Action payload in Edge runtime\n\nAliases: CVE-2026-64646\nAdvisory: https://osv.dev/vulnerability/GHSA-4c39-4ccg-62r3\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-41370549236bb650", "name": "Vulnerable dependency next 14.2.35: GHSA-68g3-v927-f742", "shortDescription": {"text": "Vulnerable dependency next 14.2.35: GHSA-68g3-v927-f742"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-68g3-v927-f742 (aka CVE-2026-64648).\n\nNext.js: Cache confusion of response bodies for requests with bodies\n\nAliases: CVE-2026-64648\nAdvisory: https://osv.dev/vulnerability/GHSA-68g3-v927-f742\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e3c401d45669b619", "name": "Vulnerable dependency next 14.2.35: GHSA-89xv-2m56-2m9x", "shortDescription": {"text": "Vulnerable dependency next 14.2.35: GHSA-89xv-2m56-2m9x"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-89xv-2m56-2m9x (aka CVE-2026-64649).\n\nNext.js: Server-Side Request Forgery in Server Actions on custom servers\n\nAliases: CVE-2026-64649\nAdvisory: https://osv.dev/vulnerability/GHSA-89xv-2m56-2m9x\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-13d5e13e178bd9df", "name": "Vulnerable dependency next 14.2.35: GHSA-8h8q-6873-q5fj", "shortDescription": {"text": "Vulnerable dependency next 14.2.35: GHSA-8h8q-6873-q5fj"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-8h8q-6873-q5fj.\n\nNext.js Vulnerable to Denial of Service with Server Components\n\nAdvisory: https://osv.dev/vulnerability/GHSA-8h8q-6873-q5fj\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5b0f55ea725048fc", "name": "Vulnerable dependency next 14.2.35: GHSA-955p-x3mx-jcvp", "shortDescription": {"text": "Vulnerable dependency next 14.2.35: GHSA-955p-x3mx-jcvp"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-955p-x3mx-jcvp (aka CVE-2026-64643).\n\nNext.js: Unauthenticated disclosure of internal Server Function endpoints\n\nAliases: CVE-2026-64643\nAdvisory: https://osv.dev/vulnerability/GHSA-955p-x3mx-jcvp\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a2f228c086d05c6e", "name": "Vulnerable dependency next 14.2.35: GHSA-9g9p-9gw9-jx7f", "shortDescription": {"text": "Vulnerable dependency next 14.2.35: GHSA-9g9p-9gw9-jx7f"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-9g9p-9gw9-jx7f (aka CVE-2025-59471).\n\nNext.js self-hosted applications vulnerable to DoS via Image Optimizer remotePatterns configuration\n\nAliases: CVE-2025-59471\nAdvisory: https://osv.dev/vulnerability/GHSA-9g9p-9gw9-jx7f\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-912ce012da1a0187", "name": "Vulnerable dependency next 14.2.35: GHSA-c4j6-fc7j-m34r", "shortDescription": {"text": "Vulnerable dependency next 14.2.35: GHSA-c4j6-fc7j-m34r"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-c4j6-fc7j-m34r.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-c4j6-fc7j-m34r\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8aec7d5f059eb153", "name": "Vulnerable dependency next 14.2.35: GHSA-ffhc-5mcf-pf4q", "shortDescription": {"text": "Vulnerable dependency next 14.2.35: GHSA-ffhc-5mcf-pf4q"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-ffhc-5mcf-pf4q.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-ffhc-5mcf-pf4q\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-47128876c5d93b4a", "name": "Vulnerable dependency next 14.2.35: GHSA-ggv3-7p47-pfv8", "shortDescription": {"text": "Vulnerable dependency next 14.2.35: GHSA-ggv3-7p47-pfv8"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-ggv3-7p47-pfv8.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-ggv3-7p47-pfv8\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bfa5974b09b49798", "name": "Vulnerable dependency next 14.2.35: GHSA-gx5p-jg67-6x7h", "shortDescription": {"text": "Vulnerable dependency next 14.2.35: GHSA-gx5p-jg67-6x7h"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-gx5p-jg67-6x7h.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-gx5p-jg67-6x7h\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-79bb0648b1947926", "name": "Vulnerable dependency next 14.2.35: GHSA-h25m-26qc-wcjf", "shortDescription": {"text": "Vulnerable dependency next 14.2.35: GHSA-h25m-26qc-wcjf"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-h25m-26qc-wcjf.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-h25m-26qc-wcjf\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0aaee7cc5c1564b4", "name": "Vulnerable dependency next 14.2.35: GHSA-h64f-5h5j-jqjh", "shortDescription": {"text": "Vulnerable dependency next 14.2.35: GHSA-h64f-5h5j-jqjh"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-h64f-5h5j-jqjh.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-h64f-5h5j-jqjh\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1dc7657b180df1f3", "name": "Vulnerable dependency next 14.2.35: GHSA-m99w-x7hq-7vfj", "shortDescription": {"text": "Vulnerable dependency next 14.2.35: GHSA-m99w-x7hq-7vfj"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-m99w-x7hq-7vfj.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-m99w-x7hq-7vfj\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8b891581e2f8b889", "name": "Vulnerable dependency next 14.2.35: GHSA-p9j2-gv94-2wf4", "shortDescription": {"text": "Vulnerable dependency next 14.2.35: GHSA-p9j2-gv94-2wf4"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-p9j2-gv94-2wf4.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p9j2-gv94-2wf4\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-86e9dd0d1ded9582", "name": "Vulnerable dependency next 14.2.35: GHSA-q4gf-8mx6-v5v3", "shortDescription": {"text": "Vulnerable dependency next 14.2.35: GHSA-q4gf-8mx6-v5v3"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-q4gf-8mx6-v5v3.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-q4gf-8mx6-v5v3\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d0a842edd6970113", "name": "Vulnerable dependency next 14.2.35: GHSA-vfv6-92ff-j949", "shortDescription": {"text": "Vulnerable dependency next 14.2.35: GHSA-vfv6-92ff-j949"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-vfv6-92ff-j949.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vfv6-92ff-j949\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-41b07cb44379fe84", "name": "Vulnerable dependency next 14.2.35: GHSA-wfc6-r584-vfw7", "shortDescription": {"text": "Vulnerable dependency next 14.2.35: GHSA-wfc6-r584-vfw7"}, "fullDescription": {"text": "OSV.dev reports `next` at version `14.2.35` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-wfc6-r584-vfw7.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wfc6-r584-vfw7\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fcdcb2c3148fa4f0", "name": "Vulnerable dependency postcss 8.4.31: GHSA-6g55-p6wh-862q", "shortDescription": {"text": "Vulnerable dependency postcss 8.4.31: GHSA-6g55-p6wh-862q"}, "fullDescription": {"text": "OSV.dev reports `postcss` at version `8.4.31` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-6g55-p6wh-862q (aka CVE-2026-45623).\n\nPostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments\n\nAliases: CVE-2026-45623\nAdvisory: https://osv.dev/vulnerability/GHSA-6g55-p6wh-862q\nFix: upgrade `postcss` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-32216f200e4c4a7c", "name": "Vulnerable dependency postcss 8.4.31: GHSA-qx2v-qp2m-jg93", "shortDescription": {"text": "Vulnerable dependency postcss 8.4.31: GHSA-qx2v-qp2m-jg93"}, "fullDescription": {"text": "OSV.dev reports `postcss` at version `8.4.31` (resolved in `frontend/pnpm-lock.yaml`) is affected by GHSA-qx2v-qp2m-jg93.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-qx2v-qp2m-jg93\nFix: upgrade `postcss` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fabf28a748c3ccb7", "name": "Vulnerable dependency pydantic-ai 0.2.15: GHSA-2jrp-274c-jhv3", "shortDescription": {"text": "Vulnerable dependency pydantic-ai 0.2.15: GHSA-2jrp-274c-jhv3"}, "fullDescription": {"text": "OSV.dev reports `pydantic-ai` at version `0.2.15` (declared in `backend/requirements.txt`) is affected by GHSA-2jrp-274c-jhv3 (aka CVE-2026-25580).\n\nPydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling\n\nAliases: CVE-2026-25580, PYSEC-2026-2976, PYSEC-2026-2980\nAdvisory: https://osv.dev/vulnerability/GHSA-2jrp-274c-jhv3\nFix: upgrade `pydantic-ai` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e8a7c173f2eb294f", "name": "Vulnerable dependency python-dotenv 1.1.0: GHSA-mf9w-mj56-hr94", "shortDescription": {"text": "Vulnerable dependency python-dotenv 1.1.0: GHSA-mf9w-mj56-hr94"}, "fullDescription": {"text": "OSV.dev reports `python-dotenv` at version `1.1.0` (declared in `backend/requirements.txt`) is affected by GHSA-mf9w-mj56-hr94.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-mf9w-mj56-hr94\nFix: upgrade `python-dotenv` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bef6d2d0d434389c", "name": "Vulnerable dependency python-dotenv 1.1.0: PYSEC-2026-2270", "shortDescription": {"text": "Vulnerable dependency python-dotenv 1.1.0: PYSEC-2026-2270"}, "fullDescription": {"text": "OSV.dev reports `python-dotenv` at version `1.1.0` (declared in `backend/requirements.txt`) is affected by PYSEC-2026-2270.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-2270\nFix: upgrade `python-dotenv` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a90136eba1162087", "name": "Vulnerable dependency python-multipart 0.0.20: GHSA-5rvq-cxj2-64vf", "shortDescription": {"text": "Vulnerable dependency python-multipart 0.0.20: GHSA-5rvq-cxj2-64vf"}, "fullDescription": {"text": "OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by GHSA-5rvq-cxj2-64vf (aka CVE-2026-53539).\n\npython-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of service\n\nAliases: CVE-2026-53539, PYSEC-2026-3036\nAdvisory: https://osv.dev/vulnerability/GHSA-5rvq-cxj2-64vf\nFix: upgrade `python-multipart` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 1.0}}, {"id": "scanner-025e5bfadee63a94", "name": "Vulnerable dependency python-multipart 0.0.20: GHSA-6jv3-5f52-599m", "shortDescription": {"text": "Vulnerable dependency python-multipart 0.0.20: GHSA-6jv3-5f52-599m"}, "fullDescription": {"text": "OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by GHSA-6jv3-5f52-599m (aka CVE-2026-53538).\n\npython-multipart: Semicolon treated as querystring field separator enables parameter smuggling\n\nAliases: CVE-2026-53538, PYSEC-2026-3037\nAdvisory: https://osv.dev/vulnerability/GHSA-6jv3-5f52-599m\nFix: upgrade `python-multipart` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4440181654e3aeb5", "name": "Vulnerable dependency python-multipart 0.0.20: GHSA-mj87-hwqh-73pj", "shortDescription": {"text": "Vulnerable dependency python-multipart 0.0.20: GHSA-mj87-hwqh-73pj"}, "fullDescription": {"text": "OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by GHSA-mj87-hwqh-73pj.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-mj87-hwqh-73pj\nFix: upgrade `python-multipart` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-67f67a873073fea1", "name": "Vulnerable dependency python-multipart 0.0.20: GHSA-pp6c-gr5w-3c5g", "shortDescription": {"text": "Vulnerable dependency python-multipart 0.0.20: GHSA-pp6c-gr5w-3c5g"}, "fullDescription": {"text": "OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by GHSA-pp6c-gr5w-3c5g.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-pp6c-gr5w-3c5g\nFix: upgrade `python-multipart` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f016b67dd55a75f1", "name": "Vulnerable dependency python-multipart 0.0.20: GHSA-v9pg-7xvm-68hf", "shortDescription": {"text": "Vulnerable dependency python-multipart 0.0.20: GHSA-v9pg-7xvm-68hf"}, "fullDescription": {"text": "OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by GHSA-v9pg-7xvm-68hf.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-v9pg-7xvm-68hf\nFix: upgrade `python-multipart` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-934fd0dda9948de8", "name": "Vulnerable dependency python-multipart 0.0.20: GHSA-vffw-93wf-4j4q", "shortDescription": {"text": "Vulnerable dependency python-multipart 0.0.20: GHSA-vffw-93wf-4j4q"}, "fullDescription": {"text": "OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by GHSA-vffw-93wf-4j4q.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vffw-93wf-4j4q\nFix: upgrade `python-multipart` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4c498ed65c43d9bd", "name": "Vulnerable dependency python-multipart 0.0.20: GHSA-wp53-j4wj-2cfg", "shortDescription": {"text": "Vulnerable dependency python-multipart 0.0.20: GHSA-wp53-j4wj-2cfg"}, "fullDescription": {"text": "OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by GHSA-wp53-j4wj-2cfg.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wp53-j4wj-2cfg\nFix: upgrade `python-multipart` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-473b84af3fa3cf2b", "name": "Vulnerable dependency python-multipart 0.0.20: PYSEC-2026-1852", "shortDescription": {"text": "Vulnerable dependency python-multipart 0.0.20: PYSEC-2026-1852"}, "fullDescription": {"text": "OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by PYSEC-2026-1852.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-1852\nFix: upgrade `python-multipart` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-78e8a1a0dd993fb3", "name": "Vulnerable dependency python-multipart 0.0.20: PYSEC-2026-3038", "shortDescription": {"text": "Vulnerable dependency python-multipart 0.0.20: PYSEC-2026-3038"}, "fullDescription": {"text": "OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by PYSEC-2026-3038.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3038\nFix: upgrade `python-multipart` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-981ea6297a37ed9b", "name": "Vulnerable dependency python-multipart 0.0.20: PYSEC-2026-3039", "shortDescription": {"text": "Vulnerable dependency python-multipart 0.0.20: PYSEC-2026-3039"}, "fullDescription": {"text": "OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by PYSEC-2026-3039.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3039\nFix: upgrade `python-multipart` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-83a8367ef19acded", "name": "Vulnerable dependency python-multipart 0.0.20: PYSEC-2026-3040", "shortDescription": {"text": "Vulnerable dependency python-multipart 0.0.20: PYSEC-2026-3040"}, "fullDescription": {"text": "OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by PYSEC-2026-3040.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3040\nFix: upgrade `python-multipart` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e27c483569d7e04e", "name": "Vulnerable dependency python-multipart 0.0.20: PYSEC-2026-3041", "shortDescription": {"text": "Vulnerable dependency python-multipart 0.0.20: PYSEC-2026-3041"}, "fullDescription": {"text": "OSV.dev reports `python-multipart` at version `0.0.20` (declared in `backend/requirements.txt`) is affected by PYSEC-2026-3041.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/PYSEC-2026-3041\nFix: upgrade `python-multipart` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-41eb3c70b4d39b98", "name": "Vulnerable dependency bytes 1.9.0: GHSA-434x-w66g-qw3r", "shortDescription": {"text": "Vulnerable dependency bytes 1.9.0: GHSA-434x-w66g-qw3r"}, "fullDescription": {"text": "OSV.dev reports `bytes` at version `1.9.0` (declared in `frontend/src-tauri/Cargo.toml`) is affected by GHSA-434x-w66g-qw3r (aka CVE-2026-25541).\nNote: `1.9.0` is the declared floor of a range \u2014 the installed version may be newer.\n\nbytes has integer overflow in BytesMut::reserve\n\nAliases: CVE-2026-25541, RUSTSEC-2026-0007\nAdvisory: https://osv.dev/vulnerability/GHSA-434x-w66g-qw3r\nFix: upgrade `bytes` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-b5dd9d71a80f9c12", "name": "Vulnerable dependency tauri 2.6.2: GHSA-7gmj-67g7-phm9", "shortDescription": {"text": "Vulnerable dependency tauri 2.6.2: GHSA-7gmj-67g7-phm9"}, "fullDescription": {"text": "OSV.dev reports `tauri` at version `2.6.2` (declared in `frontend/src-tauri/Cargo.toml`) is affected by GHSA-7gmj-67g7-phm9 (aka CVE-2026-42184).\nNote: `2.6.2` is the declared floor of a range \u2014 the installed version may be newer.\n\nTauri has an Origin Confusion Issue that Allows Remote Pages to Invoke Local-Only IPC Commands\n\nAliases: CVE-2026-42184\nAdvisory: https://osv.dev/vulnerability/GHSA-7gmj-67g7-phm9\nFix: upgrade `tauri` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.7}}, {"id": "scanner-edc156d17650a78f", "name": "Vulnerable dependency zip 2.2: GHSA-94vh-gphv-8pm8", "shortDescription": {"text": "Vulnerable dependency zip 2.2: GHSA-94vh-gphv-8pm8"}, "fullDescription": {"text": "OSV.dev reports `zip` at version `2.2` (declared in `frontend/src-tauri/Cargo.toml`) is affected by GHSA-94vh-gphv-8pm8 (aka CVE-2025-29787).\nNote: `2.2` is the declared floor of a range \u2014 the installed version may be newer.\n\nzip Incorrectly Canonicalizes Paths during Archive Extraction Leading to Arbitrary File Write\n\nAliases: CVE-2025-29787\nAdvisory: https://osv.dev/vulnerability/GHSA-94vh-gphv-8pm8\nFix: upgrade `zip` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.7}}, {"id": "scanner-c4ac8e6d271c9885", "name": "Vulnerable dependency atk 0.18.2: RUSTSEC-2024-0413", "shortDescription": {"text": "Vulnerable dependency atk 0.18.2: RUSTSEC-2024-0413"}, "fullDescription": {"text": "OSV.dev reports `atk` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0413.\nNote: `atk` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2024-0413\nFix: upgrade `atk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-842c917ae827e02e", "name": "Vulnerable dependency atk-sys 0.18.2: RUSTSEC-2024-0416", "shortDescription": {"text": "Vulnerable dependency atk-sys 0.18.2: RUSTSEC-2024-0416"}, "fullDescription": {"text": "OSV.dev reports `atk-sys` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0416.\nNote: `atk-sys` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2024-0416\nFix: upgrade `atk-sys` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-5c552332a3cd6edd", "name": "Vulnerable dependency atty 0.2.14: GHSA-g98v-hv3f-hcfr", "shortDescription": {"text": "Vulnerable dependency atty 0.2.14: GHSA-g98v-hv3f-hcfr"}, "fullDescription": {"text": "OSV.dev reports `atty` at version `0.2.14` (resolved in `Cargo.lock`) is affected by GHSA-g98v-hv3f-hcfr.\nNote: `atty` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-g98v-hv3f-hcfr\nFix: upgrade `atty` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-1c0ace4497525c92", "name": "Vulnerable dependency atty 0.2.14: RUSTSEC-2021-0145", "shortDescription": {"text": "Vulnerable dependency atty 0.2.14: RUSTSEC-2021-0145"}, "fullDescription": {"text": "OSV.dev reports `atty` at version `0.2.14` (resolved in `Cargo.lock`) is affected by RUSTSEC-2021-0145.\nNote: `atty` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2021-0145\nFix: upgrade `atty` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-1b2e9e59514e0a9f", "name": "Vulnerable dependency atty 0.2.14: RUSTSEC-2024-0375", "shortDescription": {"text": "Vulnerable dependency atty 0.2.14: RUSTSEC-2024-0375"}, "fullDescription": {"text": "OSV.dev reports `atty` at version `0.2.14` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0375.\nNote: `atty` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2024-0375\nFix: upgrade `atty` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-1395070335461b7b", "name": "Vulnerable dependency crossbeam-epoch 0.9.18: RUSTSEC-2026-0204", "shortDescription": {"text": "Vulnerable dependency crossbeam-epoch 0.9.18: RUSTSEC-2026-0204"}, "fullDescription": {"text": "OSV.dev reports `crossbeam-epoch` at version `0.9.18` (resolved in `Cargo.lock`) is affected by RUSTSEC-2026-0204.\nNote: `crossbeam-epoch` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2026-0204\nFix: upgrade `crossbeam-epoch` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-d7bceec8201184d3", "name": "Vulnerable dependency gdk 0.18.2: RUSTSEC-2024-0412", "shortDescription": {"text": "Vulnerable dependency gdk 0.18.2: RUSTSEC-2024-0412"}, "fullDescription": {"text": "OSV.dev reports `gdk` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0412.\nNote: `gdk` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2024-0412\nFix: upgrade `gdk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-2bbf2c9378af6d99", "name": "Vulnerable dependency gdk-sys 0.18.2: RUSTSEC-2024-0418", "shortDescription": {"text": "Vulnerable dependency gdk-sys 0.18.2: RUSTSEC-2024-0418"}, "fullDescription": {"text": "OSV.dev reports `gdk-sys` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0418.\nNote: `gdk-sys` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2024-0418\nFix: upgrade `gdk-sys` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-03a30a94eacf0291", "name": "Vulnerable dependency gdkwayland-sys 0.18.2: RUSTSEC-2024-0411", "shortDescription": {"text": "Vulnerable dependency gdkwayland-sys 0.18.2: RUSTSEC-2024-0411"}, "fullDescription": {"text": "OSV.dev reports `gdkwayland-sys` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0411.\nNote: `gdkwayland-sys` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2024-0411\nFix: upgrade `gdkwayland-sys` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-413ce96b314f8dfd", "name": "Vulnerable dependency gdkx11 0.18.2: RUSTSEC-2024-0417", "shortDescription": {"text": "Vulnerable dependency gdkx11 0.18.2: RUSTSEC-2024-0417"}, "fullDescription": {"text": "OSV.dev reports `gdkx11` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0417.\nNote: `gdkx11` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2024-0417\nFix: upgrade `gdkx11` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-02f8a0023c26a1d1", "name": "Vulnerable dependency gdkx11-sys 0.18.2: RUSTSEC-2024-0414", "shortDescription": {"text": "Vulnerable dependency gdkx11-sys 0.18.2: RUSTSEC-2024-0414"}, "fullDescription": {"text": "OSV.dev reports `gdkx11-sys` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0414.\nNote: `gdkx11-sys` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2024-0414\nFix: upgrade `gdkx11-sys` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-aba37c4b23d91a38", "name": "Vulnerable dependency glib 0.18.5: GHSA-wrw7-89jp-8q8g", "shortDescription": {"text": "Vulnerable dependency glib 0.18.5: GHSA-wrw7-89jp-8q8g"}, "fullDescription": {"text": "OSV.dev reports `glib` at version `0.18.5` (resolved in `Cargo.lock`) is affected by GHSA-wrw7-89jp-8q8g.\nNote: `glib` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-wrw7-89jp-8q8g\nFix: upgrade `glib` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-246ba79c5452e2a4", "name": "Vulnerable dependency glib 0.18.5: RUSTSEC-2024-0429", "shortDescription": {"text": "Vulnerable dependency glib 0.18.5: RUSTSEC-2024-0429"}, "fullDescription": {"text": "OSV.dev reports `glib` at version `0.18.5` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0429.\nNote: `glib` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2024-0429\nFix: upgrade `glib` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-6fcf2fefb1ab0dd5", "name": "Vulnerable dependency gtk 0.18.2: RUSTSEC-2024-0415", "shortDescription": {"text": "Vulnerable dependency gtk 0.18.2: RUSTSEC-2024-0415"}, "fullDescription": {"text": "OSV.dev reports `gtk` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0415.\nNote: `gtk` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2024-0415\nFix: upgrade `gtk` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-23623b1c14069ecc", "name": "Vulnerable dependency gtk-sys 0.18.2: RUSTSEC-2024-0420", "shortDescription": {"text": "Vulnerable dependency gtk-sys 0.18.2: RUSTSEC-2024-0420"}, "fullDescription": {"text": "OSV.dev reports `gtk-sys` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0420.\nNote: `gtk-sys` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2024-0420\nFix: upgrade `gtk-sys` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-15f346314b4a2018", "name": "Vulnerable dependency gtk3-macros 0.18.2: RUSTSEC-2024-0419", "shortDescription": {"text": "Vulnerable dependency gtk3-macros 0.18.2: RUSTSEC-2024-0419"}, "fullDescription": {"text": "OSV.dev reports `gtk3-macros` at version `0.18.2` (resolved in `Cargo.lock`) is affected by RUSTSEC-2024-0419.\nNote: `gtk3-macros` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/RUSTSEC-2024-0419\nFix: upgrade `gtk3-macros` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-e0b75641babbcb4f", "name": "Dependency dirs is a major version behind", "shortDescription": {"text": "Dependency dirs is a major version behind"}, "fullDescription": {"text": "`dirs` is pinned at `5.0.1` in `frontend/src-tauri/Cargo.toml` while the latest release on the cargo registry is `6.0.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `dirs` to `6.0.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-49b3ea44153b3018", "name": "Dependency rubato is two or more major versions behind", "shortDescription": {"text": "Dependency rubato is two or more major versions behind"}, "fullDescription": {"text": "`rubato` is pinned at `0.15.0` in `frontend/src-tauri/Cargo.toml` while the latest release on the cargo registry is `4.0.0` \u2014 4 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `rubato` to `4.0.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}]}}, "automationDetails": {"id": "repobility/30758"}, "properties": {"repository": "Zackriya-Solutions/meetily", "repoUrl": "https://github.com/Zackriya-Solutions/meetily", "branch": "main"}, "results": [{"ruleId": "scanner-4df9969ccfe4f3eb", "level": "note", "message": {"text": "Possibly dead Python function: delete_api_key"}, "properties": {"repobilityId": "5c8067258f1c2c3e", "scanner": "scanner-primary", "fingerprint": "4df9969ccfe4f3eb", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/db.py:863"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-57063d2745b85c17", "level": "note", "message": {"text": "Possibly dead Python function: process_transcript_background"}, "properties": {"repobilityId": "ba91a34f46e9ab62", "scanner": "scanner-primary", "fingerprint": "57063d2745b85c17", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py:219"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e7f3bdb3ca54313e", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/AudioBackendSelector.tsx:69"}, "properties": {"repobilityId": "3a09e563f89bc510", "scanner": "scanner-primary", "fingerprint": "e7f3bdb3ca54313e", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/AudioBackendSelector.tsx"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-4987d93ad85b23c7", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/ConsoleToggle.tsx:15"}, "properties": {"repobilityId": "0576f019352e6755", "scanner": "scanner-primary", "fingerprint": "4987d93ad85b23c7", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/ConsoleToggle.tsx"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-d2192e7276a461a8", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/PreferenceSettings.tsx:83"}, "properties": {"repobilityId": "1dd295a33138c051", "scanner": "scanner-primary", "fingerprint": "d2192e7276a461a8", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/PreferenceSettings.tsx"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-7c21ba8cd9bd39ca", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/components/ChunkProgressDisplay.tsx:230"}, "properties": {"repobilityId": "907814104e11ffdc", "scanner": "scanner-primary", "fingerprint": "7c21ba8cd9bd39ca", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/ChunkProgressDisplay.tsx"}, "region": {"startLine": 230}}}]}, {"ruleId": "scanner-c970ba5b2f9780a3", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/components/AnalyticsConsentSwitch.tsx:195"}, "properties": {"repobilityId": "1d02a4e5a356bf1a", "scanner": "scanner-primary", "fingerprint": "c970ba5b2f9780a3", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/AnalyticsConsentSwitch.tsx"}, "region": {"startLine": 195}}}]}, {"ruleId": "scanner-d9a61fd983cf8f63", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/AnalyticsConsentSwitch.tsx:116"}, "properties": {"repobilityId": "617fc1dfdb996246", "scanner": "scanner-primary", "fingerprint": "d9a61fd983cf8f63", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/AnalyticsConsentSwitch.tsx"}, "region": {"startLine": 116}}}]}, {"ruleId": "scanner-a17057bfcc43789a", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/components/ModelSettingsModal.tsx:896"}, "properties": {"repobilityId": "443eb87c438fcbfb", "scanner": "scanner-primary", "fingerprint": "a17057bfcc43789a", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/ModelSettingsModal.tsx"}, "region": {"startLine": 896}}}]}, {"ruleId": "scanner-df5e958420b8a0ea", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/ModelSettingsModal.tsx:322"}, "properties": {"repobilityId": "5466c4f3f0d04516", "scanner": "scanner-primary", "fingerprint": "df5e958420b8a0ea", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/ModelSettingsModal.tsx"}, "region": {"startLine": 322}}}]}, {"ruleId": "scanner-3fb722b5e63ac9bb", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/SummaryModelSettings.tsx:86"}, "properties": {"repobilityId": "51fd8ce6c8a6f63f", "scanner": "scanner-primary", "fingerprint": "3fb722b5e63ac9bb", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/SummaryModelSettings.tsx"}, "region": {"startLine": 86}}}]}, {"ruleId": "scanner-c15f1203ce6c4aec", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/UpdateDialog.tsx:93"}, "properties": {"repobilityId": "5112bd352cf4ff7f", "scanner": "scanner-primary", "fingerprint": "c15f1203ce6c4aec", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/UpdateDialog.tsx"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-a2a6357cee7edc49", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/RecordingControls.tsx:77"}, "properties": {"repobilityId": "ea79205ee782a495", "scanner": "scanner-primary", "fingerprint": "a2a6357cee7edc49", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/RecordingControls.tsx"}, "region": {"startLine": 77}}}]}, {"ruleId": "scanner-b8e06fb8d4a7c5b2", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/WhisperModelManager.tsx:129"}, "properties": {"repobilityId": "ae646c90a1bd4b57", "scanner": "scanner-primary", "fingerprint": "b8e06fb8d4a7c5b2", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/WhisperModelManager.tsx"}, "region": {"startLine": 129}}}]}, {"ruleId": "scanner-c03efec8cdf45cb6", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/components/DeviceSelection.tsx:302"}, "properties": {"repobilityId": "02878a0b1a2d3dde", "scanner": "scanner-primary", "fingerprint": "c03efec8cdf45cb6", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/DeviceSelection.tsx"}, "region": {"startLine": 302}}}]}, {"ruleId": "scanner-9b100b0ed5962469", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/DeviceSelection.tsx:59"}, "properties": {"repobilityId": "5e809d3baa7877f0", "scanner": "scanner-primary", "fingerprint": "9b100b0ed5962469", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/DeviceSelection.tsx"}, "region": {"startLine": 59}}}]}, {"ruleId": "scanner-64501817042a38ab", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/LanguageSelection.tsx:145"}, "properties": {"repobilityId": "7ddb464d08e33ffc", "scanner": "scanner-primary", "fingerprint": "64501817042a38ab", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/LanguageSelection.tsx"}, "region": {"startLine": 145}}}]}, {"ruleId": "scanner-5fbbe1debb301fe0", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/TranscriptView.tsx:111"}, "properties": {"repobilityId": "0923a1fd736210d3", "scanner": "scanner-primary", "fingerprint": "5fbbe1debb301fe0", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/TranscriptView.tsx"}, "region": {"startLine": 111}}}]}, {"ruleId": "scanner-d77af8ea678fb8d9", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/ParakeetModelManager.tsx:81"}, "properties": {"repobilityId": "80476e75958b2990", "scanner": "scanner-primary", "fingerprint": "d77af8ea678fb8d9", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/ParakeetModelManager.tsx"}, "region": {"startLine": 81}}}]}, {"ruleId": "scanner-967adc84d0fc7f3f", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 frontend/src/components/MeetingDetails/SummaryPanel.tsx:299"}, "properties": {"repobilityId": "7f012028107477a8", "scanner": "scanner-primary", "fingerprint": "967adc84d0fc7f3f", "layer": "frontend", "severity": "info", "confidence": 0.7, "tags": ["frontend-quality", "fq.todo-marker"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/MeetingDetails/SummaryPanel.tsx"}, "region": {"startLine": 299}}}]}, {"ruleId": "scanner-4c27c847aafba304", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/MeetingDetails/SummaryPanel.tsx:300"}, "properties": {"repobilityId": "484dc9386f927573", "scanner": "scanner-primary", "fingerprint": "4c27c847aafba304", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/MeetingDetails/SummaryPanel.tsx"}, "region": {"startLine": 300}}}]}, {"ruleId": "scanner-947167aea9509ca0", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/MeetingDetails/SummaryGeneratorButtonGroup.tsx:71"}, "properties": {"repobilityId": "f6f47dd87576dd68", "scanner": "scanner-primary", "fingerprint": "947167aea9509ca0", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/MeetingDetails/SummaryGeneratorButtonGroup.tsx"}, "region": {"startLine": 71}}}]}, {"ruleId": "scanner-da29714285c6bff4", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/BlockNoteEditor/Editor.tsx:17"}, "properties": {"repobilityId": "fd6fed160bdd65a5", "scanner": "scanner-primary", "fingerprint": "da29714285c6bff4", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/BlockNoteEditor/Editor.tsx"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-49df6af228f617c8", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/components/shared/DownloadProgressToast.tsx:83"}, "properties": {"repobilityId": "50a88515f8eae7b6", "scanner": "scanner-primary", "fingerprint": "49df6af228f617c8", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/shared/DownloadProgressToast.tsx"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-360efd3af264547e", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/AISummary/index.tsx:218"}, "properties": {"repobilityId": "93c63577fe8dae93", "scanner": "scanner-primary", "fingerprint": "360efd3af264547e", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/AISummary/index.tsx"}, "region": {"startLine": 218}}}]}, {"ruleId": "scanner-272b8179733e46ef", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/AISummary/BlockNoteSummaryView.tsx:45"}, "properties": {"repobilityId": "0aafab52758e58c7", "scanner": "scanner-primary", "fingerprint": "272b8179733e46ef", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/AISummary/BlockNoteSummaryView.tsx"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-52cbfd78a7b0636a", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/components/onboarding/shared/PermissionRow.tsx:40"}, "properties": {"repobilityId": "2f8266f0bb5e06f1", "scanner": "scanner-primary", "fingerprint": "52cbfd78a7b0636a", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/onboarding/shared/PermissionRow.tsx"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-1cff20d9e81a0ea1", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/onboarding/steps/PermissionsStep.tsx:16"}, "properties": {"repobilityId": "5ee8579bd988bfde", "scanner": "scanner-primary", "fingerprint": "1cff20d9e81a0ea1", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/onboarding/steps/PermissionsStep.tsx"}, "region": {"startLine": 16}}}]}, {"ruleId": "scanner-6020fcddf0fdefdd", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/onboarding/steps/DownloadProgressStep.tsx:66"}, "properties": {"repobilityId": "e7ebac30f29dc6f0", "scanner": "scanner-primary", "fingerprint": "6020fcddf0fdefdd", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/onboarding/steps/DownloadProgressStep.tsx"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-724786c8920b563a", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/Sidebar/index.tsx:113"}, "properties": {"repobilityId": "2450ded9777a90af", "scanner": "scanner-primary", "fingerprint": "724786c8920b563a", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/Sidebar/index.tsx"}, "region": {"startLine": 113}}}]}, {"ruleId": "scanner-8cded93ab5c03953", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/Sidebar/SidebarProvider.tsx:151"}, "properties": {"repobilityId": "0b088a1ed3073451", "scanner": "scanner-primary", "fingerprint": "8cded93ab5c03953", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/Sidebar/SidebarProvider.tsx"}, "region": {"startLine": 151}}}]}, {"ruleId": "scanner-f7a30fba8764788e", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/components/TranscriptRecovery/TranscriptRecovery.tsx:146"}, "properties": {"repobilityId": "b4e7a3ce0cec8496", "scanner": "scanner-primary", "fingerprint": "f7a30fba8764788e", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/TranscriptRecovery/TranscriptRecovery.tsx"}, "region": {"startLine": 146}}}]}, {"ruleId": "scanner-9b5965862a15e489", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/components/TranscriptRecovery/TranscriptRecovery.tsx:85"}, "properties": {"repobilityId": "191df9c61fa927c6", "scanner": "scanner-primary", "fingerprint": "9b5965862a15e489", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/TranscriptRecovery/TranscriptRecovery.tsx"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-63acbe20b2f00436", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/components/ImportAudio/ImportAudioDialog.tsx:276"}, "properties": {"repobilityId": "e20061542fdf1368", "scanner": "scanner-primary", "fingerprint": "63acbe20b2f00436", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/ImportAudio/ImportAudioDialog.tsx"}, "region": {"startLine": 276}}}]}, {"ruleId": "scanner-5c78f159ec92baf4", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/contexts/TranscriptContext.tsx:103"}, "properties": {"repobilityId": "e767ce52f40bf502", "scanner": "scanner-primary", "fingerprint": "5c78f159ec92baf4", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/contexts/TranscriptContext.tsx"}, "region": {"startLine": 103}}}]}, {"ruleId": "scanner-3a6ffbcd53d46cd2", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/contexts/OllamaDownloadContext.tsx:45"}, "properties": {"repobilityId": "21663de05913675a", "scanner": "scanner-primary", "fingerprint": "3a6ffbcd53d46cd2", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/contexts/OllamaDownloadContext.tsx"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-de8bea28e5a55b21", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/contexts/ConfigContext.tsx:200"}, "properties": {"repobilityId": "43e437af2756a30e", "scanner": "scanner-primary", "fingerprint": "de8bea28e5a55b21", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/contexts/ConfigContext.tsx"}, "region": {"startLine": 200}}}]}, {"ruleId": "scanner-aeacb5aae6dd490a", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/contexts/OnboardingContext.tsx:129"}, "properties": {"repobilityId": "86440425d8c6d275", "scanner": "scanner-primary", "fingerprint": "aeacb5aae6dd490a", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/contexts/OnboardingContext.tsx"}, "region": {"startLine": 129}}}]}, {"ruleId": "scanner-561da55265733d0d", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/contexts/RecordingPostProcessingProvider.tsx:37"}, "properties": {"repobilityId": "f1a8e3efaec7be84", "scanner": "scanner-primary", "fingerprint": "561da55265733d0d", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/contexts/RecordingPostProcessingProvider.tsx"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-c860e651a2419fc0", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/contexts/RecordingStateContext.tsx:74"}, "properties": {"repobilityId": "0e2e3c106cb3dba1", "scanner": "scanner-primary", "fingerprint": "c860e651a2419fc0", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/contexts/RecordingStateContext.tsx"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-da3f2c2c98b350fb", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/app/page.tsx:80"}, "properties": {"repobilityId": "416a75fc522df897", "scanner": "scanner-primary", "fingerprint": "da3f2c2c98b350fb", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/app/page.tsx"}, "region": {"startLine": 80}}}]}, {"ruleId": "scanner-1b4a2ee566204a3c", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/app/layout.tsx:87"}, "properties": {"repobilityId": "5229a767d0f4516f", "scanner": "scanner-primary", "fingerprint": "1b4a2ee566204a3c", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/app/layout.tsx"}, "region": {"startLine": 87}}}]}, {"ruleId": "scanner-5de44e5d35654a87", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/app/settings/page.tsx:40"}, "properties": {"repobilityId": "e7beb321c96acd3b", "scanner": "scanner-primary", "fingerprint": "5de44e5d35654a87", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/app/settings/page.tsx"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-5c61afdc1f655809", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/src/app/notes/[id]/page.tsx:174"}, "properties": {"repobilityId": "5570e729997612a7", "scanner": "scanner-primary", "fingerprint": "5c61afdc1f655809", "layer": "frontend", "severity": "medium", "confidence": 0.8, "tags": ["frontend-quality", "fq.dangerous-html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/app/notes/[id]/page.tsx"}, "region": {"startLine": 174}}}]}, {"ruleId": "scanner-e3898e61e225b02e", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/app/meeting-details/page-content.tsx:50"}, "properties": {"repobilityId": "680195744c7154aa", "scanner": "scanner-primary", "fingerprint": "e3898e61e225b02e", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/app/meeting-details/page-content.tsx"}, "region": {"startLine": 50}}}]}, {"ruleId": "scanner-0991a6cc8cc0b1e6", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/app/meeting-details/page.tsx:56"}, "properties": {"repobilityId": "c1b6501e2c602745", "scanner": "scanner-primary", "fingerprint": "0991a6cc8cc0b1e6", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/app/meeting-details/page.tsx"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-85022bb8a74756a7", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/lib/analytics.ts:48"}, "properties": {"repobilityId": "736ce2c5bde74bc9", "scanner": "scanner-primary", "fingerprint": "85022bb8a74756a7", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/lib/analytics.ts"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-f4d506b5bfd1a9be", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/useRecordingStart.ts:85"}, "properties": {"repobilityId": "8d613bee38ac5a5a", "scanner": "scanner-primary", "fingerprint": "f4d506b5bfd1a9be", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/hooks/useRecordingStart.ts"}, "region": {"startLine": 85}}}]}, {"ruleId": "scanner-b6d7ff61ba58b9e1", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/usePermissionCheck.ts:35"}, "properties": {"repobilityId": "14fd9632ab31e526", "scanner": "scanner-primary", "fingerprint": "b6d7ff61ba58b9e1", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/hooks/usePermissionCheck.ts"}, "region": {"startLine": 35}}}]}, {"ruleId": "scanner-90e96909662b2e61", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/useAudioPlayer.ts:19"}, "properties": {"repobilityId": "31b64566c6570926", "scanner": "scanner-primary", "fingerprint": "90e96909662b2e61", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/hooks/useAudioPlayer.ts"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-9a04bdc2e41f3320", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/useProcessingProgress.ts:56"}, "properties": {"repobilityId": "a8cb123ebb10f836", "scanner": "scanner-primary", "fingerprint": "9a04bdc2e41f3320", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/hooks/useProcessingProgress.ts"}, "region": {"startLine": 56}}}]}, {"ruleId": "scanner-5fcb2bdf19f62b22", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/useModalState.ts:107"}, "properties": {"repobilityId": "0d8af01157c60461", "scanner": "scanner-primary", "fingerprint": "5fcb2bdf19f62b22", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/hooks/useModalState.ts"}, "region": {"startLine": 107}}}]}, {"ruleId": "scanner-e01b5d99b8ec9009", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/useRecordingStop.ts:84"}, "properties": {"repobilityId": "c3bb5eddb8c46e66", "scanner": "scanner-primary", "fingerprint": "e01b5d99b8ec9009", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/hooks/useRecordingStop.ts"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-47d664b9b3772061", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/useRecordingStateSync.ts:26"}, "properties": {"repobilityId": "afcd4d85a075ebdf", "scanner": "scanner-primary", "fingerprint": "47d664b9b3772061", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/hooks/useRecordingStateSync.ts"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-7f26cf4e4946ecbe", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/meeting-details/useMeetingData.ts:34"}, "properties": {"repobilityId": "8a21ed0863e05622", "scanner": "scanner-primary", "fingerprint": "7f26cf4e4946ecbe", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/hooks/meeting-details/useMeetingData.ts"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-90c7308601f96bc4", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/meeting-details/useSummaryGeneration.ts:119"}, "properties": {"repobilityId": "21b3a2a2f32bd179", "scanner": "scanner-primary", "fingerprint": "90c7308601f96bc4", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/hooks/meeting-details/useSummaryGeneration.ts"}, "region": {"startLine": 119}}}]}, {"ruleId": "scanner-08292eecbfdd53c8", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/meeting-details/useTemplates.ts:23"}, "properties": {"repobilityId": "141ec529f952d517", "scanner": "scanner-primary", "fingerprint": "08292eecbfdd53c8", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/hooks/meeting-details/useTemplates.ts"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-82c3887b534eb426", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/meeting-details/useModelConfiguration.ts:26"}, "properties": {"repobilityId": "a407e9328ac33e4f", "scanner": "scanner-primary", "fingerprint": "82c3887b534eb426", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/hooks/meeting-details/useModelConfiguration.ts"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-fffd810a7f1420c1", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/hooks/meeting-details/useCopyOperations.ts:27"}, "properties": {"repobilityId": "dd9ec1451525edaa", "scanner": "scanner-primary", "fingerprint": "fffd810a7f1420c1", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/hooks/meeting-details/useCopyOperations.ts"}, "region": {"startLine": 27}}}]}, {"ruleId": "scanner-b594d73d62170856", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/services/updateService.ts:51"}, "properties": {"repobilityId": "959f6b9142b55ead", "scanner": "scanner-primary", "fingerprint": "b594d73d62170856", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/services/updateService.ts"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-b2b63fc70eada918", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/services/indexedDBService.ts:363"}, "properties": {"repobilityId": "dcd632ef637c1de5", "scanner": "scanner-primary", "fingerprint": "b2b63fc70eada918", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/services/indexedDBService.ts"}, "region": {"startLine": 363}}}]}, {"ruleId": "scanner-9d6d3d997019154e", "level": "warning", "message": {"text": "detect child process \u2014 frontend/scripts/auto-detect-gpu.js:12"}, "properties": {"repobilityId": "f8d3b01f47ef5773", "scanner": "scanner-primary", "fingerprint": "9d6d3d997019154e", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "javascript"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/auto-detect-gpu.js"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-89e883e5c8764449", "level": "warning", "message": {"text": "react dangerouslysetinnerhtml \u2014 frontend/src/app/notes/[id]/page.tsx:174"}, "properties": {"repobilityId": "8db89afe304f0904", "scanner": "scanner-primary", "fingerprint": "89e883e5c8764449", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "react"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/app/notes/[id]/page.tsx"}, "region": {"startLine": 174}}}]}, {"ruleId": "scanner-15e54770576b396b", "level": "note", "message": {"text": "GHSA-g98v-hv3f-hcfr: atty 0.2.14 \u2014 Cargo.lock"}, "properties": {"repobilityId": "9065313b4118ab86", "scanner": "scanner-primary", "fingerprint": "15e54770576b396b", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-g98v-hv3f-hcfr"]}}, {"ruleId": "scanner-7d85a0952942c106", "level": "warning", "message": {"text": "GHSA-wrw7-89jp-8q8g: glib 0.18.5 \u2014 Cargo.lock"}, "properties": {"repobilityId": "ea7fb90c0d6c704b", "scanner": "scanner-primary", "fingerprint": "7d85a0952942c106", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-wrw7-89jp-8q8g"]}}, {"ruleId": "scanner-3d43fc2ec916071e", "level": "warning", "message": {"text": "CVE-2026-45784: openssl 0.10.79 \u2014 Cargo.lock"}, "properties": {"repobilityId": "3d729df144eb308e", "scanner": "scanner-primary", "fingerprint": "3d43fc2ec916071e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45784"]}}, {"ruleId": "scanner-4d55529f3b48a215", "level": "error", "message": {"text": "GHSA-82j2-j2ch-gfr8: rustls-webpki 0.101.7 \u2014 Cargo.lock"}, "properties": {"repobilityId": "691e87dd066207fd", "scanner": "scanner-primary", "fingerprint": "4d55529f3b48a215", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-82j2-j2ch-gfr8"]}}, {"ruleId": "scanner-2c37ef3d9ce9b15c", "level": "note", "message": {"text": "GHSA-965h-392x-2mh5: rustls-webpki 0.101.7 \u2014 Cargo.lock"}, "properties": {"repobilityId": "62703cd2499f7de4", "scanner": "scanner-primary", "fingerprint": "2c37ef3d9ce9b15c", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-965h-392x-2mh5"]}}, {"ruleId": "scanner-b9ab852bad3531e7", "level": "note", "message": {"text": "GHSA-xgp8-3hg3-c2mh: rustls-webpki 0.101.7 \u2014 Cargo.lock"}, "properties": {"repobilityId": "6a8c11d4b68e8af3", "scanner": "scanner-primary", "fingerprint": "b9ab852bad3531e7", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-xgp8-3hg3-c2mh"]}}, {"ruleId": "scanner-322b7699f11a74fc", "level": "warning", "message": {"text": "GHSA-7gcf-g7xr-8hxj: serde_with 3.20.0 \u2014 Cargo.lock"}, "properties": {"repobilityId": "47a6724ca8234261", "scanner": "scanner-primary", "fingerprint": "322b7699f11a74fc", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-7gcf-g7xr-8hxj"]}}, {"ruleId": "scanner-14f1502ee75e5df4", "level": "warning", "message": {"text": "GHSA-3pv8-6f4r-ffg2: tar 0.4.45 \u2014 Cargo.lock"}, "properties": {"repobilityId": "d4d9c7b5f48ac1de", "scanner": "scanner-primary", "fingerprint": "14f1502ee75e5df4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-3pv8-6f4r-ffg2"]}}, {"ruleId": "scanner-b49aa950d8eccfb4", "level": "error", "message": {"text": "CVE-2026-25580: pydantic-ai 0.2.15 \u2014 backend/requirements.txt"}, "properties": {"repobilityId": "62287b7b3a25d4ad", "scanner": "scanner-primary", "fingerprint": "b49aa950d8eccfb4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-25580"]}}, {"ruleId": "scanner-5514aa234ba2c5da", "level": "warning", "message": {"text": "CVE-2026-28684: python-dotenv 1.1.0 \u2014 backend/requirements.txt"}, "properties": {"repobilityId": "51f40dd17fcfc884", "scanner": "scanner-primary", "fingerprint": "5514aa234ba2c5da", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-28684"]}}, {"ruleId": "scanner-41d07d787aa308d9", "level": "error", "message": {"text": "CVE-2026-24486: python-multipart 0.0.20 \u2014 backend/requirements.txt"}, "properties": {"repobilityId": "4b2cca9838ad9236", "scanner": "scanner-primary", "fingerprint": "41d07d787aa308d9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-24486"]}}, {"ruleId": "scanner-9bdf5a2de92553f9", "level": "error", "message": {"text": "CVE-2026-42561: python-multipart 0.0.20 \u2014 backend/requirements.txt"}, "properties": {"repobilityId": "b857e1d43fa1f4d9", "scanner": "scanner-primary", "fingerprint": "9bdf5a2de92553f9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42561"]}}, {"ruleId": "scanner-429531869356e982", "level": "error", "message": {"text": "CVE-2026-53539: python-multipart 0.0.20 \u2014 backend/requirements.txt"}, "properties": {"repobilityId": "e592e6ff79f5caa9", "scanner": "scanner-primary", "fingerprint": "429531869356e982", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53539"]}}, {"ruleId": "scanner-d62d5798dedaabab", "level": "warning", "message": {"text": "CVE-2026-40347: python-multipart 0.0.20 \u2014 backend/requirements.txt"}, "properties": {"repobilityId": "dae6ce9ecedc99e5", "scanner": "scanner-primary", "fingerprint": "d62d5798dedaabab", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-40347"]}}, {"ruleId": "scanner-8a4fda5e0544583e", "level": "note", "message": {"text": "CVE-2026-53537: python-multipart 0.0.20 \u2014 backend/requirements.txt"}, "properties": {"repobilityId": "974d4e0c6e8ec62f", "scanner": "scanner-primary", "fingerprint": "8a4fda5e0544583e", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53537"]}}, {"ruleId": "scanner-fc27466c3f82e67a", "level": "note", "message": {"text": "CVE-2026-53538: python-multipart 0.0.20 \u2014 backend/requirements.txt"}, "properties": {"repobilityId": "53fd91730330ab6f", "scanner": "scanner-primary", "fingerprint": "fc27466c3f82e67a", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53538"]}}, {"ruleId": "scanner-68dfefffd5aadcac", "level": "note", "message": {"text": "CVE-2026-53540: python-multipart 0.0.20 \u2014 backend/requirements.txt"}, "properties": {"repobilityId": "f0a4b7d5cc81c82d", "scanner": "scanner-primary", "fingerprint": "68dfefffd5aadcac", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-53540"]}}, {"ruleId": "scanner-febbdc86a35b1210", "level": "note", "message": {"text": "CVE-2026-49356: @babel/core 7.29.0 \u2014 frontend/pnpm-lock.yaml"}, "properties": {"repobilityId": "0173e192bace0d07", "scanner": "scanner-primary", "fingerprint": "febbdc86a35b1210", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-49356"]}}, {"ruleId": "scanner-2d36be0e33794978", "level": "error", "message": {"text": "CVE-2026-13149: brace-expansion 2.1.0 \u2014 frontend/pnpm-lock.yaml"}, "properties": {"repobilityId": "fb3513bfc5d4b659", "scanner": "scanner-primary", "fingerprint": "2d36be0e33794978", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13149"]}}, {"ruleId": "scanner-3e8e9fdc8a35927a", "level": "error", "message": {"text": "CVE-2026-48801: linkify-it 5.0.0 \u2014 frontend/pnpm-lock.yaml"}, "properties": {"repobilityId": "29f3a004ec6a5bfd", "scanner": "scanner-primary", "fingerprint": "3e8e9fdc8a35927a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48801"]}}, {"ruleId": "scanner-a720a1cbdcbfddca", "level": "error", "message": {"text": "CVE-2026-59887: linkify-it 5.0.0 \u2014 frontend/pnpm-lock.yaml"}, "properties": {"repobilityId": "3236f2554c2808ba", "scanner": "scanner-primary", "fingerprint": "a720a1cbdcbfddca", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59887"]}}, {"ruleId": "scanner-fcffb21b742a99d8", "level": "warning", "message": {"text": "CVE-2026-48988: markdown-it 14.1.1 \u2014 frontend/pnpm-lock.yaml"}, "properties": {"repobilityId": "1ff25e38c5a2bc99", "scanner": "scanner-primary", "fingerprint": "fcffb21b742a99d8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-48988"]}}, {"ruleId": "scanner-417a083d737dbc7d", "level": "error", "message": {"text": "CVE-2026-44573: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "properties": {"repobilityId": "fdffc3d5ff9f65fd", "scanner": "scanner-primary", "fingerprint": "417a083d737dbc7d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44573"]}}, {"ruleId": "scanner-963b883651c7cf14", "level": "error", "message": {"text": "CVE-2026-44578: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "properties": {"repobilityId": "70be9c9177d227d4", "scanner": "scanner-primary", "fingerprint": "963b883651c7cf14", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44578"]}}, {"ruleId": "scanner-3d72bfcd8fea1ae7", "level": "error", "message": {"text": "CVE-2026-64641: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "properties": {"repobilityId": "a5f7c02a468d6c34", "scanner": "scanner-primary", "fingerprint": "3d72bfcd8fea1ae7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64641"]}}, {"ruleId": "scanner-128331724a227a23", "level": "error", "message": {"text": "CVE-2026-64645: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "properties": {"repobilityId": "e976a4d7ba81a6db", "scanner": "scanner-primary", "fingerprint": "128331724a227a23", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64645"]}}, {"ruleId": "scanner-72f713819eee4350", "level": "error", "message": {"text": "CVE-2026-64649: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "properties": {"repobilityId": "67f0b7dc970ef760", "scanner": "scanner-primary", "fingerprint": "72f713819eee4350", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64649"]}}, {"ruleId": "scanner-c98869f79570281c", "level": "error", "message": {"text": "GHSA-8h8q-6873-q5fj: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "properties": {"repobilityId": "fff526ef5d32eba7", "scanner": "scanner-primary", "fingerprint": "c98869f79570281c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-8h8q-6873-q5fj"]}}, {"ruleId": "scanner-73edc2b61f1577f6", "level": "error", "message": {"text": "GHSA-h25m-26qc-wcjf: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "properties": {"repobilityId": "b01bc695aa638048", "scanner": "scanner-primary", "fingerprint": "73edc2b61f1577f6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-h25m-26qc-wcjf"]}}, {"ruleId": "scanner-b917f5a5fd20496a", "level": "error", "message": {"text": "GHSA-q4gf-8mx6-v5v3: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "properties": {"repobilityId": "c717f99c79a02cb7", "scanner": "scanner-primary", "fingerprint": "b917f5a5fd20496a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-q4gf-8mx6-v5v3"]}}, {"ruleId": "scanner-b3b7f75e2de71244", "level": "warning", "message": {"text": "CVE-2025-59471: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "properties": {"repobilityId": "53ab4b38efe11d93", "scanner": "scanner-primary", "fingerprint": "b3b7f75e2de71244", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-59471"]}}, {"ruleId": "scanner-59eb22f11d23a2b1", "level": "warning", "message": {"text": "CVE-2026-27980: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "properties": {"repobilityId": "3f6313df330256a7", "scanner": "scanner-primary", "fingerprint": "59eb22f11d23a2b1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-27980"]}}, {"ruleId": "scanner-ed5f9886404cac4c", "level": "warning", "message": {"text": "CVE-2026-29057: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "properties": {"repobilityId": "e5839e7a1ceefc4e", "scanner": "scanner-primary", "fingerprint": "ed5f9886404cac4c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-29057"]}}, {"ruleId": "scanner-9d903d89d375593a", "level": "warning", "message": {"text": "CVE-2026-44576: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "properties": {"repobilityId": "900009cbc89bdca2", "scanner": "scanner-primary", "fingerprint": "9d903d89d375593a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44576"]}}, {"ruleId": "scanner-824de2883c03c2cf", "level": "warning", "message": {"text": "CVE-2026-44577: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "properties": {"repobilityId": "1d52cdfcb313d426", "scanner": "scanner-primary", "fingerprint": "824de2883c03c2cf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44577"]}}, {"ruleId": "scanner-77682c6389c70a01", "level": "warning", "message": {"text": "CVE-2026-44580: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "properties": {"repobilityId": "f08debb392151567", "scanner": "scanner-primary", "fingerprint": "77682c6389c70a01", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44580"]}}, {"ruleId": "scanner-55f6a73bc5b3ffa8", "level": "warning", "message": {"text": "CVE-2026-44581: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "properties": {"repobilityId": "ee9e75cb319931bf", "scanner": "scanner-primary", "fingerprint": "55f6a73bc5b3ffa8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44581"]}}, {"ruleId": "scanner-bc20e6832f1e576c", "level": "warning", "message": {"text": "CVE-2026-64643: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "properties": {"repobilityId": "496ecdad948c0f29", "scanner": "scanner-primary", "fingerprint": "bc20e6832f1e576c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64643"]}}, {"ruleId": "scanner-63253a8dcec9af9a", "level": "warning", "message": {"text": "CVE-2026-64646: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "properties": {"repobilityId": "667ab78cb817c9da", "scanner": "scanner-primary", "fingerprint": "63253a8dcec9af9a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64646"]}}, {"ruleId": "scanner-7b53a8cfc96eb7ca", "level": "warning", "message": {"text": "CVE-2026-64647: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "properties": {"repobilityId": "c54245a1d86d3fbd", "scanner": "scanner-primary", "fingerprint": "7b53a8cfc96eb7ca", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64647"]}}, {"ruleId": "scanner-8c5b3659d01fad8a", "level": "warning", "message": {"text": "CVE-2026-64648: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "properties": {"repobilityId": "9110ab270351e298", "scanner": "scanner-primary", "fingerprint": "8c5b3659d01fad8a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-64648"]}}, {"ruleId": "scanner-e7e5b63bd429464c", "level": "note", "message": {"text": "CVE-2026-44572: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "properties": {"repobilityId": "e369c2faabbb38db", "scanner": "scanner-primary", "fingerprint": "e7e5b63bd429464c", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44572"]}}, {"ruleId": "scanner-192c87782eed48a1", "level": "note", "message": {"text": "CVE-2026-44582: next 14.2.35 \u2014 frontend/pnpm-lock.yaml"}, "properties": {"repobilityId": "87476dccbbd8786b", "scanner": "scanner-primary", "fingerprint": "192c87782eed48a1", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-44582"]}}, {"ruleId": "scanner-a2543dc3d22eba66", "level": "warning", "message": {"text": "CVE-2026-41305: postcss 8.4.31 \u2014 frontend/pnpm-lock.yaml"}, "properties": {"repobilityId": "493ee9dcd1a4d237", "scanner": "scanner-primary", "fingerprint": "a2543dc3d22eba66", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41305"]}}, {"ruleId": "scanner-ca9b1598cf19a2c9", "level": "warning", "message": {"text": "CVE-2026-41907: uuid 8.3.2 \u2014 frontend/pnpm-lock.yaml"}, "properties": {"repobilityId": "37532eee41d98e1e", "scanner": "scanner-primary", "fingerprint": "ca9b1598cf19a2c9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41907"]}}, {"ruleId": "scanner-e00ba51ffdb0e2bc", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 backend/Dockerfile.app"}, "properties": {"repobilityId": "eb06530f99fa0f2d", "scanner": "scanner-primary", "fingerprint": "e00ba51ffdb0e2bc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-62c588d517c8f5c6", "level": "error", "message": {"text": "DS-0029: 'apt-get' missing '--no-install-recommends' \u2014 backend/Dockerfile.app"}, "properties": {"repobilityId": "65435c4f6ec7b9c7", "scanner": "scanner-primary", "fingerprint": "62c588d517c8f5c6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-feb76d8c8f785250", "level": "error", "message": {"text": "DS-0029: 'apt-get' missing '--no-install-recommends' \u2014 backend/Dockerfile.server-cpu"}, "properties": {"repobilityId": "07d3cafd2e6aed72", "scanner": "scanner-primary", "fingerprint": "feb76d8c8f785250", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-62bf32276cc4596d", "level": "error", "message": {"text": "DS-0029: 'apt-get' missing '--no-install-recommends' \u2014 backend/Dockerfile.server-gpu"}, "properties": {"repobilityId": "0fc60be450e200af", "scanner": "scanner-primary", "fingerprint": "62bf32276cc4596d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-0f842d787ac002d0", "level": "error", "message": {"text": "DS-0029: 'apt-get' missing '--no-install-recommends' \u2014 backend/Dockerfile.server-macos"}, "properties": {"repobilityId": "4e32c51baf63aa24", "scanner": "scanner-primary", "fingerprint": "0f842d787ac002d0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-00f762e952a7fdee", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in frontend/scripts/auto-detect-gpu.js:7"}, "properties": {"repobilityId": "ece18a36577be281", "scanner": "scanner-primary", "fingerprint": "00f762e952a7fdee", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/auto-detect-gpu.js"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-2d1a8f9c9ff96291", "level": "error", "message": {"text": "Insecure pattern 'node_child_process' in frontend/scripts/tauri-auto.js:6"}, "properties": {"repobilityId": "eadc8b5e9b656232", "scanner": "scanner-primary", "fingerprint": "2d1a8f9c9ff96291", "layer": "security", "severity": "high", "confidence": 0.9, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/tauri-auto.js"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-75da38780fda9a93", "level": "error", "message": {"text": "Possible secret in frontend/src-tauri/src/lib_old_complex.rs"}, "properties": {"repobilityId": "0ce214ea7dd6440c", "scanner": "scanner-primary", "fingerprint": "75da38780fda9a93", "layer": "security", "severity": "high", "confidence": 0.72, "tags": ["secrets", "generic_api_key"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src-tauri/src/lib_old_complex.rs"}, "region": {"startLine": 1818}}}]}, {"ruleId": "scanner-a801cd3442de9d2d", "level": "error", "message": {"text": "Possible secret in frontend/src-tauri/src/analytics/commands.rs"}, "properties": {"repobilityId": "9558fe7f9ded5fd1", "scanner": "scanner-primary", "fingerprint": "a801cd3442de9d2d", "layer": "security", "severity": "high", "confidence": 0.72, "tags": ["secrets", "generic_api_key"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src-tauri/src/analytics/commands.rs"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-067758e72d298deb", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/src/app/notes/[id]/page.tsx:174"}, "properties": {"repobilityId": "e149d582f91078be", "scanner": "scanner-primary", "fingerprint": "067758e72d298deb", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/app/notes/[id]/page.tsx"}, "region": {"startLine": 174}}}]}, {"ruleId": "scanner-4f724a257c5083a9", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in scripts/test-update-locally.js:64"}, "properties": {"repobilityId": "143ef35dbf099899", "scanner": "scanner-primary", "fingerprint": "4f724a257c5083a9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/test-update-locally.js"}, "region": {"startLine": 64}}}]}, {"ruleId": "scanner-94934be055b74668", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in backend/app/main.py:46"}, "properties": {"repobilityId": "1a4affa5fa498eb7", "scanner": "scanner-primary", "fingerprint": "94934be055b74668", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-54f10efc48351923", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in .github/workflows/build-windows.yml:374"}, "properties": {"repobilityId": "a8295b85f623d08a", "scanner": "scanner-primary", "fingerprint": "54f10efc48351923", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-windows.yml"}, "region": {"startLine": 374}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-e3d76b90742c18c8", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "ee3882ca6f5d40d3", "scanner": "scanner-primary", "fingerprint": "e3d76b90742c18c8", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-macos.yml"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-a8fe4d106191eff7", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "c1d5a8075631a8aa", "scanner": "scanner-primary", "fingerprint": "a8fe4d106191eff7", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-macos.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cf880af02cdc7559", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "0b2e653653f74962", "scanner": "scanner-primary", "fingerprint": "cf880af02cdc7559", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-devtest.yml"}, "region": {"startLine": 55}}}]}, {"ruleId": "scanner-ddc00f9f9d305e77", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "452b1d0b3b1086b6", "scanner": "scanner-primary", "fingerprint": "ddc00f9f9d305e77", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-devtest.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9d1bab6ae48e5872", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "d25b0ae58a456726", "scanner": "scanner-primary", "fingerprint": "9d1bab6ae48e5872", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-linux.yml"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-e91838cee6739c63", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "091e95aa7c286b2b", "scanner": "scanner-primary", "fingerprint": "e91838cee6739c63", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-linux.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-46c644c6227e4d4a", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "2644034c718fb80d", "scanner": "scanner-primary", "fingerprint": "46c644c6227e4d4a", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-1838a141491ce38c", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "b8fd4f5048f96576", "scanner": "scanner-primary", "fingerprint": "1838a141491ce38c", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/release.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-360cb263256aacfa", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "31f598a2284a91ad", "scanner": "scanner-primary", "fingerprint": "360cb263256aacfa", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-windows.yml"}, "region": {"startLine": 48}}}]}, {"ruleId": "scanner-6e61fb60af308a45", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "25ed9c052ad5a584", "scanner": "scanner-primary", "fingerprint": "6e61fb60af308a45", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-windows.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-67cb8bcad9284f7b", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "295b5d7958d2950c", "scanner": "scanner-primary", "fingerprint": "67cb8bcad9284f7b", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/pr-main-check.yml"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-6ba9bfab5f283202", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "1bf0fd1430c42e23", "scanner": "scanner-primary", "fingerprint": "6ba9bfab5f283202", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yml"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-b769174c9fcf8ea8", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "e34b6cb9b56931d2", "scanner": "scanner-primary", "fingerprint": "b769174c9fcf8ea8", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e587fd4cfccc926d", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "542b1c7656a1f2d5", "scanner": "scanner-primary", "fingerprint": "e587fd4cfccc926d", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-test.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3d9895df4231ea7f", "level": "note", "message": {"text": "Very large file: frontend/src-tauri/src/lib_old_complex.rs (2437 lines)"}, "properties": {"repobilityId": "af99b4eeee481e06", "scanner": "scanner-primary", "fingerprint": "3d9895df4231ea7f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-af09ecd370355721", "level": "note", "message": {"text": "Very large file: frontend/src/components/ModelSettingsModal.tsx (1408 lines)"}, "properties": {"repobilityId": "e430e3a7020ad899", "scanner": "scanner-primary", "fingerprint": "af09ecd370355721", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3ef596331ac43260", "level": "note", "message": {"text": "Very large file: backend/run-docker.sh (2008 lines)"}, "properties": {"repobilityId": "6307ab6a4c052888", "scanner": "scanner-primary", "fingerprint": "3ef596331ac43260", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "4ad4203c5f8769e2", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "743a18039b09532f", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "61fbf20f0dbe6262", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-58bedf14d559c6f9", "level": "note", "message": {"text": "Legacy-named symbol `eleven_multilingual_v2` in frontend/src/components/TranscriptSettings.tsx:57"}, "properties": {"repobilityId": "deaee988523fa6dc", "scanner": "scanner-primary", "fingerprint": "58bedf14d559c6f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-539374dcc5622cef", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/src/components/Sidebar/index.tsx:97"}, "properties": {"repobilityId": "9dc649da45a62b6f", "scanner": "scanner-primary", "fingerprint": "539374dcc5622cef", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/components/Sidebar/index.tsx"}, "region": {"startLine": 97}}}]}, {"ruleId": "scanner-6348b763eaf09ef5", "level": "note", "message": {"text": "Legacy-named symbol `daysOld` in frontend/src/services/indexedDBService.ts:326"}, "properties": {"repobilityId": "94368799f426855b", "scanner": "scanner-primary", "fingerprint": "6348b763eaf09ef5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-af022f937dd5b7fd", "level": "note", "message": {"text": "9 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "5597384795dea7a4", "scanner": "scanner-primary", "fingerprint": "af022f937dd5b7fd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-ebe08a58f15297e7", "level": "error", "message": {"text": "FastAPI POST `save_meeting_title` without auth dependency \u2014 backend/app/main.py:196"}, "properties": {"repobilityId": "867055aa2e445ac6", "scanner": "scanner-primary", "fingerprint": "ebe08a58f15297e7", "layer": "security", "severity": "high", "confidence": 0.75, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py"}, "region": {"startLine": 196}}}]}, {"ruleId": "scanner-888a519a8f0cee1c", "level": "error", "message": {"text": "FastAPI POST `delete_meeting` without auth dependency \u2014 backend/app/main.py:206"}, "properties": {"repobilityId": "6d39a73f820f8e45", "scanner": "scanner-primary", "fingerprint": "888a519a8f0cee1c", "layer": "security", "severity": "high", "confidence": 0.75, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py"}, "region": {"startLine": 206}}}]}, {"ruleId": "scanner-66d5fb7adfdd84ac", "level": "error", "message": {"text": "FastAPI POST `process_transcript_api` without auth dependency \u2014 backend/app/main.py:329"}, "properties": {"repobilityId": "1e325ee0d6015981", "scanner": "scanner-primary", "fingerprint": "66d5fb7adfdd84ac", "layer": "security", "severity": "high", "confidence": 0.75, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py"}, "region": {"startLine": 329}}}]}, {"ruleId": "scanner-04ff5814b5a2de41", "level": "error", "message": {"text": "FastAPI POST `save_transcript` without auth dependency \u2014 backend/app/main.py:511"}, "properties": {"repobilityId": "f79e47d860ecff43", "scanner": "scanner-primary", "fingerprint": "04ff5814b5a2de41", "layer": "security", "severity": "high", "confidence": 0.75, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py"}, "region": {"startLine": 511}}}]}, {"ruleId": "scanner-a52f3e6baf3a2ca8", "level": "error", "message": {"text": "FastAPI POST `save_model_config` without auth dependency \u2014 backend/app/main.py:560"}, "properties": {"repobilityId": "72d3d4e20235af03", "scanner": "scanner-primary", "fingerprint": "a52f3e6baf3a2ca8", "layer": "security", "severity": "high", "confidence": 0.75, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py"}, "region": {"startLine": 560}}}]}, {"ruleId": "scanner-32b75008a78f9a81", "level": "error", "message": {"text": "FastAPI POST `save_transcript_config` without auth dependency \u2014 backend/app/main.py:578"}, "properties": {"repobilityId": "5d2e967dcf5a974a", "scanner": "scanner-primary", "fingerprint": "32b75008a78f9a81", "layer": "security", "severity": "high", "confidence": 0.75, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py"}, "region": {"startLine": 578}}}]}, {"ruleId": "scanner-4d6a8719f140bc14", "level": "error", "message": {"text": "FastAPI POST `get_api_key` without auth dependency \u2014 backend/app/main.py:589"}, "properties": {"repobilityId": "45afd9d1471f26fb", "scanner": "scanner-primary", "fingerprint": "4d6a8719f140bc14", "layer": "security", "severity": "high", "confidence": 0.75, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py"}, "region": {"startLine": 589}}}]}, {"ruleId": "scanner-1d71af6ec9a90b58", "level": "error", "message": {"text": "FastAPI POST `get_transcript_api_key` without auth dependency \u2014 backend/app/main.py:596"}, "properties": {"repobilityId": "87f0378ca17c1696", "scanner": "scanner-primary", "fingerprint": "1d71af6ec9a90b58", "layer": "security", "severity": "high", "confidence": 0.75, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py"}, "region": {"startLine": 596}}}]}, {"ruleId": "scanner-645b932051f7e8be", "level": "error", "message": {"text": "FastAPI POST `save_meeting_summary` without auth dependency \u2014 backend/app/main.py:607"}, "properties": {"repobilityId": "eaaff54529d18dc0", "scanner": "scanner-primary", "fingerprint": "645b932051f7e8be", "layer": "security", "severity": "high", "confidence": 0.75, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py"}, "region": {"startLine": 607}}}]}, {"ruleId": "scanner-38446bac3cb30438", "level": "error", "message": {"text": "FastAPI POST `search_transcripts` without auth dependency \u2014 backend/app/main.py:623"}, "properties": {"repobilityId": "ad5036b16c6c628e", "scanner": "scanner-primary", "fingerprint": "38446bac3cb30438", "layer": "security", "severity": "high", "confidence": 0.75, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py"}, "region": {"startLine": 623}}}]}, {"ruleId": "scanner-13f24b5d2689e542", "level": "warning", "message": {"text": "Vulnerable dependency anyhow 1.0.102: RUSTSEC-2026-0190"}, "properties": {"repobilityId": "b0f8e201981c9769", "scanner": "scanner-primary", "fingerprint": "13f24b5d2689e542", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0190"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-514f0913b7f28acb", "level": "warning", "message": {"text": "Vulnerable dependency tar 0.4.45: GHSA-3pv8-6f4r-ffg2"}, "properties": {"repobilityId": "7f508ff5725663f2", "scanner": "scanner-primary", "fingerprint": "514f0913b7f28acb", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3pv8-6f4r-ffg2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src-tauri/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c87a8512ea3042b2", "level": "error", "message": {"text": "Vulnerable dependency next 14.2.35: GHSA-36qx-fr4f-26g5"}, "properties": {"repobilityId": "daba51e4a16b23a4", "scanner": "scanner-primary", "fingerprint": "c87a8512ea3042b2", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-36qx-fr4f-26g5"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9a736a7379f85384", "level": "note", "message": {"text": "Vulnerable dependency next 14.2.35: GHSA-3g8h-86w9-wvmq"}, "properties": {"repobilityId": "01ddfa4f7d28f1c6", "scanner": "scanner-primary", "fingerprint": "9a736a7379f85384", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3g8h-86w9-wvmq"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b2ba659e4c9a6745", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.35: GHSA-3x4c-7xq6-9pq8"}, "properties": {"repobilityId": "8310c72f9cd38b1b", "scanner": "scanner-primary", "fingerprint": "b2ba659e4c9a6745", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-3x4c-7xq6-9pq8"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3412b90e10aef24b", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.35: GHSA-4633-3j49-mh5q"}, "properties": {"repobilityId": "b1ccda3dec1710fd", "scanner": "scanner-primary", "fingerprint": "3412b90e10aef24b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-4633-3j49-mh5q"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ea6cbd7b05c03f41", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.35: GHSA-4c39-4ccg-62r3"}, "properties": {"repobilityId": "a3aa401c98f6d997", "scanner": "scanner-primary", "fingerprint": "ea6cbd7b05c03f41", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-4c39-4ccg-62r3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-41370549236bb650", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.35: GHSA-68g3-v927-f742"}, "properties": {"repobilityId": "af07cad35c67aa3c", "scanner": "scanner-primary", "fingerprint": "41370549236bb650", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-68g3-v927-f742"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e3c401d45669b619", "level": "error", "message": {"text": "Vulnerable dependency next 14.2.35: GHSA-89xv-2m56-2m9x"}, "properties": {"repobilityId": "86be1ccee45aa799", "scanner": "scanner-primary", "fingerprint": "e3c401d45669b619", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-89xv-2m56-2m9x"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-13d5e13e178bd9df", "level": "error", "message": {"text": "Vulnerable dependency next 14.2.35: GHSA-8h8q-6873-q5fj"}, "properties": {"repobilityId": "bdcca184ade63d0b", "scanner": "scanner-primary", "fingerprint": "13d5e13e178bd9df", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-8h8q-6873-q5fj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5b0f55ea725048fc", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.35: GHSA-955p-x3mx-jcvp"}, "properties": {"repobilityId": "f49141d2dc2e05fd", "scanner": "scanner-primary", "fingerprint": "5b0f55ea725048fc", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-955p-x3mx-jcvp"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a2f228c086d05c6e", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.35: GHSA-9g9p-9gw9-jx7f"}, "properties": {"repobilityId": "eb49541888369225", "scanner": "scanner-primary", "fingerprint": "a2f228c086d05c6e", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-9g9p-9gw9-jx7f"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-912ce012da1a0187", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.35: GHSA-c4j6-fc7j-m34r"}, "properties": {"repobilityId": "5fa1a61088825b55", "scanner": "scanner-primary", "fingerprint": "912ce012da1a0187", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-c4j6-fc7j-m34r"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8aec7d5f059eb153", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.35: GHSA-ffhc-5mcf-pf4q"}, "properties": {"repobilityId": "5d2e9d06d87f1934", "scanner": "scanner-primary", "fingerprint": "8aec7d5f059eb153", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-ffhc-5mcf-pf4q"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-47128876c5d93b4a", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.35: GHSA-ggv3-7p47-pfv8"}, "properties": {"repobilityId": "143bb93e201d2036", "scanner": "scanner-primary", "fingerprint": "47128876c5d93b4a", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-ggv3-7p47-pfv8"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bfa5974b09b49798", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.35: GHSA-gx5p-jg67-6x7h"}, "properties": {"repobilityId": "00f705eac13b2b56", "scanner": "scanner-primary", "fingerprint": "bfa5974b09b49798", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-gx5p-jg67-6x7h"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-79bb0648b1947926", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.35: GHSA-h25m-26qc-wcjf"}, "properties": {"repobilityId": "4a7ea04dbf775e0b", "scanner": "scanner-primary", "fingerprint": "79bb0648b1947926", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-h25m-26qc-wcjf"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0aaee7cc5c1564b4", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.35: GHSA-h64f-5h5j-jqjh"}, "properties": {"repobilityId": "a771fe1159016566", "scanner": "scanner-primary", "fingerprint": "0aaee7cc5c1564b4", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-h64f-5h5j-jqjh"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1dc7657b180df1f3", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.35: GHSA-m99w-x7hq-7vfj"}, "properties": {"repobilityId": "ae3774cb18e27e87", "scanner": "scanner-primary", "fingerprint": "1dc7657b180df1f3", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-m99w-x7hq-7vfj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8b891581e2f8b889", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.35: GHSA-p9j2-gv94-2wf4"}, "properties": {"repobilityId": "620e320728575c87", "scanner": "scanner-primary", "fingerprint": "8b891581e2f8b889", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-p9j2-gv94-2wf4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-86e9dd0d1ded9582", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.35: GHSA-q4gf-8mx6-v5v3"}, "properties": {"repobilityId": "2d2fb0aa22c60c6b", "scanner": "scanner-primary", "fingerprint": "86e9dd0d1ded9582", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-q4gf-8mx6-v5v3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d0a842edd6970113", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.35: GHSA-vfv6-92ff-j949"}, "properties": {"repobilityId": "27d45518cc9c81df", "scanner": "scanner-primary", "fingerprint": "d0a842edd6970113", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-vfv6-92ff-j949"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-41b07cb44379fe84", "level": "warning", "message": {"text": "Vulnerable dependency next 14.2.35: GHSA-wfc6-r584-vfw7"}, "properties": {"repobilityId": "3ecd436f8d87bf7b", "scanner": "scanner-primary", "fingerprint": "41b07cb44379fe84", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-wfc6-r584-vfw7"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fcdcb2c3148fa4f0", "level": "error", "message": {"text": "Vulnerable dependency postcss 8.4.31: GHSA-6g55-p6wh-862q"}, "properties": {"repobilityId": "86c312e6e8a1e925", "scanner": "scanner-primary", "fingerprint": "fcdcb2c3148fa4f0", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-6g55-p6wh-862q"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-32216f200e4c4a7c", "level": "warning", "message": {"text": "Vulnerable dependency postcss 8.4.31: GHSA-qx2v-qp2m-jg93"}, "properties": {"repobilityId": "00a7666aebb4f6a3", "scanner": "scanner-primary", "fingerprint": "32216f200e4c4a7c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-qx2v-qp2m-jg93"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fabf28a748c3ccb7", "level": "error", "message": {"text": "Vulnerable dependency pydantic-ai 0.2.15: GHSA-2jrp-274c-jhv3"}, "properties": {"repobilityId": "25fd19c51af95d1e", "scanner": "scanner-primary", "fingerprint": "fabf28a748c3ccb7", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-2jrp-274c-jhv3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e8a7c173f2eb294f", "level": "warning", "message": {"text": "Vulnerable dependency python-dotenv 1.1.0: GHSA-mf9w-mj56-hr94"}, "properties": {"repobilityId": "3e03b643522545a5", "scanner": "scanner-primary", "fingerprint": "e8a7c173f2eb294f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-mf9w-mj56-hr94"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bef6d2d0d434389c", "level": "warning", "message": {"text": "Vulnerable dependency python-dotenv 1.1.0: PYSEC-2026-2270"}, "properties": {"repobilityId": "0cdc16801a64514b", "scanner": "scanner-primary", "fingerprint": "bef6d2d0d434389c", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-2270"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a90136eba1162087", "level": "error", "message": {"text": "Vulnerable dependency python-multipart 0.0.20: GHSA-5rvq-cxj2-64vf"}, "properties": {"repobilityId": "4cfe05f96ba224ee", "scanner": "scanner-primary", "fingerprint": "a90136eba1162087", "layer": "dependencies", "severity": "high", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-5rvq-cxj2-64vf"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-025e5bfadee63a94", "level": "warning", "message": {"text": "Vulnerable dependency python-multipart 0.0.20: GHSA-6jv3-5f52-599m"}, "properties": {"repobilityId": "079067cd48403c10", "scanner": "scanner-primary", "fingerprint": "025e5bfadee63a94", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-6jv3-5f52-599m"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4440181654e3aeb5", "level": "warning", "message": {"text": "Vulnerable dependency python-multipart 0.0.20: GHSA-mj87-hwqh-73pj"}, "properties": {"repobilityId": "19b8d00eb6ecce32", "scanner": "scanner-primary", "fingerprint": "4440181654e3aeb5", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-mj87-hwqh-73pj"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-67f67a873073fea1", "level": "warning", "message": {"text": "Vulnerable dependency python-multipart 0.0.20: GHSA-pp6c-gr5w-3c5g"}, "properties": {"repobilityId": "1b3b056f6c9692e5", "scanner": "scanner-primary", "fingerprint": "67f67a873073fea1", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-pp6c-gr5w-3c5g"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f016b67dd55a75f1", "level": "warning", "message": {"text": "Vulnerable dependency python-multipart 0.0.20: GHSA-v9pg-7xvm-68hf"}, "properties": {"repobilityId": "89a90e5211533db0", "scanner": "scanner-primary", "fingerprint": "f016b67dd55a75f1", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-v9pg-7xvm-68hf"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-934fd0dda9948de8", "level": "warning", "message": {"text": "Vulnerable dependency python-multipart 0.0.20: GHSA-vffw-93wf-4j4q"}, "properties": {"repobilityId": "a680b45cdc8b2830", "scanner": "scanner-primary", "fingerprint": "934fd0dda9948de8", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-vffw-93wf-4j4q"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4c498ed65c43d9bd", "level": "warning", "message": {"text": "Vulnerable dependency python-multipart 0.0.20: GHSA-wp53-j4wj-2cfg"}, "properties": {"repobilityId": "768b787b8b6b4499", "scanner": "scanner-primary", "fingerprint": "4c498ed65c43d9bd", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-wp53-j4wj-2cfg"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-473b84af3fa3cf2b", "level": "warning", "message": {"text": "Vulnerable dependency python-multipart 0.0.20: PYSEC-2026-1852"}, "properties": {"repobilityId": "28de226d83f85ff7", "scanner": "scanner-primary", "fingerprint": "473b84af3fa3cf2b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-1852"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-78e8a1a0dd993fb3", "level": "warning", "message": {"text": "Vulnerable dependency python-multipart 0.0.20: PYSEC-2026-3038"}, "properties": {"repobilityId": "dd5319567f4e520e", "scanner": "scanner-primary", "fingerprint": "78e8a1a0dd993fb3", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3038"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-981ea6297a37ed9b", "level": "warning", "message": {"text": "Vulnerable dependency python-multipart 0.0.20: PYSEC-2026-3039"}, "properties": {"repobilityId": "14d68246136c894c", "scanner": "scanner-primary", "fingerprint": "981ea6297a37ed9b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3039"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-83a8367ef19acded", "level": "warning", "message": {"text": "Vulnerable dependency python-multipart 0.0.20: PYSEC-2026-3040"}, "properties": {"repobilityId": "626c9e9858f7d80e", "scanner": "scanner-primary", "fingerprint": "83a8367ef19acded", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3040"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e27c483569d7e04e", "level": "warning", "message": {"text": "Vulnerable dependency python-multipart 0.0.20: PYSEC-2026-3041"}, "properties": {"repobilityId": "aa1048d489c9f9bb", "scanner": "scanner-primary", "fingerprint": "e27c483569d7e04e", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "PYSEC-2026-3041"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/requirements.txt"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-41eb3c70b4d39b98", "level": "warning", "message": {"text": "Vulnerable dependency bytes 1.9.0: GHSA-434x-w66g-qw3r"}, "properties": {"repobilityId": "7c3ecbf6a4548d5c", "scanner": "scanner-primary", "fingerprint": "41eb3c70b4d39b98", "layer": "dependencies", "severity": "medium", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-434x-w66g-qw3r"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src-tauri/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b5dd9d71a80f9c12", "level": "error", "message": {"text": "Vulnerable dependency tauri 2.6.2: GHSA-7gmj-67g7-phm9"}, "properties": {"repobilityId": "3645ea1115294388", "scanner": "scanner-primary", "fingerprint": "b5dd9d71a80f9c12", "layer": "dependencies", "severity": "high", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-7gmj-67g7-phm9"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src-tauri/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-edc156d17650a78f", "level": "error", "message": {"text": "Vulnerable dependency zip 2.2: GHSA-94vh-gphv-8pm8"}, "properties": {"repobilityId": "bb5e6cdfe46e2362", "scanner": "scanner-primary", "fingerprint": "edc156d17650a78f", "layer": "dependencies", "severity": "high", "confidence": 0.7, "tags": ["dependency", "sca", "osv", "GHSA-94vh-gphv-8pm8"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src-tauri/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c4ac8e6d271c9885", "level": "warning", "message": {"text": "Vulnerable dependency atk 0.18.2: RUSTSEC-2024-0413"}, "properties": {"repobilityId": "e8b78fb4e93005a6", "scanner": "scanner-primary", "fingerprint": "c4ac8e6d271c9885", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2024-0413", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-842c917ae827e02e", "level": "warning", "message": {"text": "Vulnerable dependency atk-sys 0.18.2: RUSTSEC-2024-0416"}, "properties": {"repobilityId": "ac1b3966bac55e1d", "scanner": "scanner-primary", "fingerprint": "842c917ae827e02e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2024-0416", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5c552332a3cd6edd", "level": "warning", "message": {"text": "Vulnerable dependency atty 0.2.14: GHSA-g98v-hv3f-hcfr"}, "properties": {"repobilityId": "96aa51426f30e53a", "scanner": "scanner-primary", "fingerprint": "5c552332a3cd6edd", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-g98v-hv3f-hcfr", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1c0ace4497525c92", "level": "warning", "message": {"text": "Vulnerable dependency atty 0.2.14: RUSTSEC-2021-0145"}, "properties": {"repobilityId": "206848c94629ddb1", "scanner": "scanner-primary", "fingerprint": "1c0ace4497525c92", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2021-0145", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1b2e9e59514e0a9f", "level": "warning", "message": {"text": "Vulnerable dependency atty 0.2.14: RUSTSEC-2024-0375"}, "properties": {"repobilityId": "6e4e15e52d1c4631", "scanner": "scanner-primary", "fingerprint": "1b2e9e59514e0a9f", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2024-0375", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1395070335461b7b", "level": "warning", "message": {"text": "Vulnerable dependency crossbeam-epoch 0.9.18: RUSTSEC-2026-0204"}, "properties": {"repobilityId": "6ea139e316193f24", "scanner": "scanner-primary", "fingerprint": "1395070335461b7b", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2026-0204", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d7bceec8201184d3", "level": "warning", "message": {"text": "Vulnerable dependency gdk 0.18.2: RUSTSEC-2024-0412"}, "properties": {"repobilityId": "c728e23bdf0113ed", "scanner": "scanner-primary", "fingerprint": "d7bceec8201184d3", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2024-0412", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2bbf2c9378af6d99", "level": "warning", "message": {"text": "Vulnerable dependency gdk-sys 0.18.2: RUSTSEC-2024-0418"}, "properties": {"repobilityId": "4c14d5de9f41f175", "scanner": "scanner-primary", "fingerprint": "2bbf2c9378af6d99", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2024-0418", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-03a30a94eacf0291", "level": "warning", "message": {"text": "Vulnerable dependency gdkwayland-sys 0.18.2: RUSTSEC-2024-0411"}, "properties": {"repobilityId": "d6d2038250b2fa0e", "scanner": "scanner-primary", "fingerprint": "03a30a94eacf0291", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2024-0411", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-413ce96b314f8dfd", "level": "warning", "message": {"text": "Vulnerable dependency gdkx11 0.18.2: RUSTSEC-2024-0417"}, "properties": {"repobilityId": "518ffd4ae91e2892", "scanner": "scanner-primary", "fingerprint": "413ce96b314f8dfd", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2024-0417", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-02f8a0023c26a1d1", "level": "warning", "message": {"text": "Vulnerable dependency gdkx11-sys 0.18.2: RUSTSEC-2024-0414"}, "properties": {"repobilityId": "c3ab549fe20f3692", "scanner": "scanner-primary", "fingerprint": "02f8a0023c26a1d1", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2024-0414", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aba37c4b23d91a38", "level": "warning", "message": {"text": "Vulnerable dependency glib 0.18.5: GHSA-wrw7-89jp-8q8g"}, "properties": {"repobilityId": "8978c40f3dddabe8", "scanner": "scanner-primary", "fingerprint": "aba37c4b23d91a38", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-wrw7-89jp-8q8g", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-246ba79c5452e2a4", "level": "warning", "message": {"text": "Vulnerable dependency glib 0.18.5: RUSTSEC-2024-0429"}, "properties": {"repobilityId": "c611cfbc05528cf3", "scanner": "scanner-primary", "fingerprint": "246ba79c5452e2a4", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2024-0429", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6fcf2fefb1ab0dd5", "level": "warning", "message": {"text": "Vulnerable dependency gtk 0.18.2: RUSTSEC-2024-0415"}, "properties": {"repobilityId": "843c9e63340a6157", "scanner": "scanner-primary", "fingerprint": "6fcf2fefb1ab0dd5", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2024-0415", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-23623b1c14069ecc", "level": "warning", "message": {"text": "Vulnerable dependency gtk-sys 0.18.2: RUSTSEC-2024-0420"}, "properties": {"repobilityId": "995bc752165865b1", "scanner": "scanner-primary", "fingerprint": "23623b1c14069ecc", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2024-0420", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-15f346314b4a2018", "level": "warning", "message": {"text": "Vulnerable dependency gtk3-macros 0.18.2: RUSTSEC-2024-0419"}, "properties": {"repobilityId": "7f585010aa2606a7", "scanner": "scanner-primary", "fingerprint": "15f346314b4a2018", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "RUSTSEC-2024-0419", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Cargo.lock"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e0b75641babbcb4f", "level": "note", "message": {"text": "Dependency dirs is a major version behind"}, "properties": {"repobilityId": "50904d1e10d542e6", "scanner": "scanner-primary", "fingerprint": "e0b75641babbcb4f", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src-tauri/Cargo.toml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-49b3ea44153b3018", "level": "warning", "message": {"text": "Dependency rubato is two or more major versions behind"}, "properties": {"repobilityId": "3fbf613b5cbdde7e", "scanner": "scanner-primary", "fingerprint": "49b3ea44153b3018", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src-tauri/Cargo.toml"}, "region": {"startLine": 1}}}]}]}]}