{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-2d8fd8cbce8e4855", "name": "TODO/FIXME marker in shipping code \u2014 worker/src/index.js:803", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 worker/src/index.js:803"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2548e23ed26f9f56", "name": "Stray `console.log` in TS/JS \u2014 worker/src/index.js:258", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 worker/src/index.js:258"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-57f62bafdb6f710b", "name": "Stray `console.log` in TS/JS \u2014 web_nexus/static/stats_core.js:5", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 web_nexus/static/stats_core.js:5"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-30782a8bd48d3184", "name": "Icon-only button without accessible name \u2014 web_nexus/static/ai_core.js:1179", "shortDescription": {"text": "Icon-only button without accessible name \u2014 web_nexus/static/ai_core.js:1179"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a37a1c356d5a297", "name": "Stray `console.log` in TS/JS \u2014 web_nexus/static/ai_core.js:69", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 web_nexus/static/ai_core.js:69"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c8a459f95fff21d4", "name": "Icon-only button without accessible name \u2014 web_nexus/static/terminal.js:1490", "shortDescription": {"text": "Icon-only button without accessible name \u2014 web_nexus/static/terminal.js:1490"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a7e18e574b59b01", "name": "Stray `console.log` in TS/JS \u2014 web_nexus/static/terminal.js:14", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 web_nexus/static/terminal.js:14"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e6cdfd15a1de8eef", "name": "Stray `console.log` in TS/JS \u2014 web_nexus/static/nexus_brain.js:12", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 web_nexus/static/nexus_brain.js:12"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a8b70161136025f", "name": "Stray `console.log` in TS/JS \u2014 web_nexus/static/auth_core.js:173", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 web_nexus/static/auth_core.js:173"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3d3e84264ca50e1d", "name": "Stray `console.log` in TS/JS \u2014 web_nexus/static/ai_tools_core.js:330", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 web_nexus/static/ai_tools_core.js:330"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9f2fce93bc1b02f5", "name": "Stray `console.log` in TS/JS \u2014 web_nexus/static/games_core.js:7", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 web_nexus/static/games_core.js:7"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e82d2af56702df36", "name": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/tts_core.js:121", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/tts_core.js:121"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-40d540f017d3a0d4", "name": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/ai_core.js:584", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/ai_core.js:584"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-95f506a6d9c6b5f7", "name": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/terminal.js:72", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/terminal.js:72"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-17f61dcad16731a1", "name": "Insecure pattern 'insert_adjacent_html' in web_nexus/static/terminal.js:641", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in web_nexus/static/terminal.js:641"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7bbcf90ad9c28615", "name": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/crash_core.js:120", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/crash_core.js:120"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8d9a90c49d3f484d", "name": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/index.html:536", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/index.html:536"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6bddb849cd32e83f", "name": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/commands_core.js:61", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/commands_core.js:61"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1dd01cce4a694357", "name": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/leaderboard.html:261", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/leaderboard.html:261"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a380f9df842be022", "name": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/nexus_brain.js:238", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/nexus_brain.js:238"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6c83cc5d183a7eed", "name": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/speedtest.html:369", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/speedtest.html:369"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0f3453805c5ebe47", "name": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/nexus_globals.js:87", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/nexus_globals.js:87"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-41579bbe41da1744", "name": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/auth_core.js:25", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/auth_core.js:25"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0527f1f4c75dcd85", "name": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/typing.html:676", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/typing.html:676"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ee2036bbfe152c63", "name": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/ai_tools_core.js:25", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/ai_tools_core.js:25"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0b51b4dc1d4e3ef7", "name": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/locked.html:351", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/locked.html:351"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4614d9e874e7575b", "name": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/snake.js:33", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/snake.js:33"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-071dd2922cb9a070", "name": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/wordle.js:143", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/wordle.js:143"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-33884465041adf2d", "name": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/flappy.js:14", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/flappy.js:14"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4b1ad50cc6bf8880", "name": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/breakout.js:11", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/breakout.js:11"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e6a71f766b714061", "name": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/mancala.js:45", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/mancala.js:45"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2f2d8d73d2f29ad1", "name": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/mines.js:82", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/mines.js:82"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7dbd64b1acf3dab1", "name": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/_lifecycle.js:89", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/_lifecycle.js:89"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aef541b37387f6c2", "name": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/pong.js:8", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/pong.js:8"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-884418548636ee0c", "name": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/matrix.js:10", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/matrix.js:10"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a48fd0c43e86b7e2", "name": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/typing.js:67", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/typing.js:67"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8bec66f03ab2b6e3", "name": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/core_modules/speedtest_logic.js:9", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/core_modules/speedtest_logic.js:9"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7c6abb908ce52218", "name": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/core_modules/hardware_logic.js:9", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/core_modules/hardware_logic.js:9"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-29fac876e838021a", "name": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/utils/speedtest.js:84", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/utils/speedtest.js:84"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2566a097ee8c2c66", "name": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/utils/maintenance_hub.js:71", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/utils/maintenance_hub.js:71"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ff32e90cad736f31", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/checkout@v5 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-595369c23b08e0fd", "name": "Very large file: worker/src/index.js (1783 lines)", "shortDescription": {"text": "Very large file: worker/src/index.js (1783 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7b86ce3a5c758d14", "name": "Very large file: web_nexus/static/ai_core.js (1276 lines)", "shortDescription": {"text": "Very large file: web_nexus/static/ai_core.js (1276 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8caa8ed05c424b8e", "name": "Very large file: web_nexus/static/terminal.js (2925 lines)", "shortDescription": {"text": "Very large file: web_nexus/static/terminal.js (2925 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "2 test file(s) for 32 source file(s) (ratio 0.06). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-01f96f71d9907a8c", "name": "README lacks setup or run instructions", "shortDescription": {"text": "README lacks setup or run instructions"}, "fullDescription": {"text": "A README exists, but it does not contain common install/setup/run markers. This matches a frequent generated-code pattern: UI is present, operational handoff is thin."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 30 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 52 placeholder/mock markers across 6 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-11825279136b53a3", "name": "CI is configured but no tests are detected", "shortDescription": {"text": "CI is configured but no tests are detected"}, "fullDescription": {"text": "A CI pipeline exists, but the scan found no test files to gate. Opus labeled this generated-code pattern as config theater: release machinery exists, but it has little behavioral signal."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: tests, operator-readme. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-69e756455f9172c2", "name": "Commented-code block (5 lines) in worker/src/index.js:100", "shortDescription": {"text": "Commented-code block (5 lines) in worker/src/index.js:100"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3d46db3638568676", "name": "`fetch()` without try/.catch or AbortSignal \u2014 worker/src/index.js:205", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 worker/src/index.js:205"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e343770594de9fd7", "name": "Legacy-named symbol `nexus_tts_v2` in web_nexus/static/tts_core.js:9", "shortDescription": {"text": "Legacy-named symbol `nexus_tts_v2` in web_nexus/static/tts_core.js:9"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c6ad61a1a675d868", "name": "Commented-code block (6 lines) in web_nexus/static/ai_core.js:12", "shortDescription": {"text": "Commented-code block (6 lines) in web_nexus/static/ai_core.js:12"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-90c22f05bf7f5c0f", "name": "Commented-code block (5 lines) in web_nexus/static/terminal.js:318", "shortDescription": {"text": "Commented-code block (5 lines) in web_nexus/static/terminal.js:318"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8e9963d76864a796", "name": "`fetch()` without try/.catch or AbortSignal \u2014 web_nexus/static/terminal.js:1214", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 web_nexus/static/terminal.js:1214"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-721d177a05c1d6c6", "name": "`fetch()` without try/.catch or AbortSignal \u2014 web_nexus/static/sw.js:74", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 web_nexus/static/sw.js:74"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6a1ea43d9eabfa2a", "name": "Commented-code block (5 lines) in web_nexus/static/uplink_core.js:68", "shortDescription": {"text": "Commented-code block (5 lines) in web_nexus/static/uplink_core.js:68"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a3901bf4c1e2e82a", "name": "`fetch()` without try/.catch or AbortSignal \u2014 web_nexus/static/uplink_core.js:38", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 web_nexus/static/uplink_core.js:38"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5f93cf9c53e4b331", "name": "Commented-code block (5 lines) in web_nexus/static/ai_tools_core.js:312", "shortDescription": {"text": "Commented-code block (5 lines) in web_nexus/static/ai_tools_core.js:312"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4330c75142e97dff", "name": "Commented-code block (6 lines) in web_nexus/static/games_core.js:1", "shortDescription": {"text": "Commented-code block (6 lines) in web_nexus/static/games_core.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4254db3d015542e9", "name": "Commented-code block (9 lines) in web_nexus/static/games/mancala.js:1", "shortDescription": {"text": "Commented-code block (9 lines) in web_nexus/static/games/mancala.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f7f4f27a56d76011", "name": "Commented-code block (7 lines) in web_nexus/static/games/_lifecycle.js:1", "shortDescription": {"text": "Commented-code block (7 lines) in web_nexus/static/games/_lifecycle.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-83bf6557d4a28819", "name": "`fetch()` without try/.catch or AbortSignal \u2014 web_nexus/static/games/_lifecycle.js:503", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 web_nexus/static/games/_lifecycle.js:503"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2930b6f9aff1767b", "name": "Commented-code block (7 lines) in web_nexus/static/utils/speedtest.js:1", "shortDescription": {"text": "Commented-code block (7 lines) in web_nexus/static/utils/speedtest.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/21253"}, "properties": {"repository": "Thyfwx/nexus", "repoUrl": "https://github.com/Thyfwx/nexus", "branch": "main"}, "results": [{"ruleId": "scanner-2d8fd8cbce8e4855", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 worker/src/index.js:803"}, "properties": {"repobilityId": "b2c76def74cac25b", "scanner": "scanner-primary", "fingerprint": "2d8fd8cbce8e4855", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-2548e23ed26f9f56", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 worker/src/index.js:258"}, "properties": {"repobilityId": "8ad4959103668749", "scanner": "scanner-primary", "fingerprint": "2548e23ed26f9f56", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-57f62bafdb6f710b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 web_nexus/static/stats_core.js:5"}, "properties": {"repobilityId": "1969577fa9e62726", "scanner": "scanner-primary", "fingerprint": "57f62bafdb6f710b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-30782a8bd48d3184", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 web_nexus/static/ai_core.js:1179"}, "properties": {"repobilityId": "a02514ec4d45e89e", "scanner": "scanner-primary", "fingerprint": "30782a8bd48d3184", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-2a37a1c356d5a297", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 web_nexus/static/ai_core.js:69"}, "properties": {"repobilityId": "a5e298645e1baff6", "scanner": "scanner-primary", "fingerprint": "2a37a1c356d5a297", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c8a459f95fff21d4", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 web_nexus/static/terminal.js:1490"}, "properties": {"repobilityId": "8f68b49cea4b366b", "scanner": "scanner-primary", "fingerprint": "c8a459f95fff21d4", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-1a7e18e574b59b01", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 web_nexus/static/terminal.js:14"}, "properties": {"repobilityId": "61781e191653831f", "scanner": "scanner-primary", "fingerprint": "1a7e18e574b59b01", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-e6cdfd15a1de8eef", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 web_nexus/static/nexus_brain.js:12"}, "properties": {"repobilityId": "68b4f1ed2a448a4d", "scanner": "scanner-primary", "fingerprint": "e6cdfd15a1de8eef", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2a8b70161136025f", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 web_nexus/static/auth_core.js:173"}, "properties": {"repobilityId": "3226156197e23cb9", "scanner": "scanner-primary", "fingerprint": "2a8b70161136025f", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3d3e84264ca50e1d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 web_nexus/static/ai_tools_core.js:330"}, "properties": {"repobilityId": "1e6817a0be5d32bc", "scanner": "scanner-primary", "fingerprint": "3d3e84264ca50e1d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9f2fce93bc1b02f5", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 web_nexus/static/games_core.js:7"}, "properties": {"repobilityId": "1e5080de22bd5a51", "scanner": "scanner-primary", "fingerprint": "9f2fce93bc1b02f5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-e82d2af56702df36", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/tts_core.js:121"}, "properties": {"repobilityId": "0481bd4713fb3341", "scanner": "scanner-primary", "fingerprint": "e82d2af56702df36", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/tts_core.js"}, "region": {"startLine": 121}}}]}, {"ruleId": "scanner-40d540f017d3a0d4", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/ai_core.js:584"}, "properties": {"repobilityId": "5186932403377672", "scanner": "scanner-primary", "fingerprint": "40d540f017d3a0d4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/ai_core.js"}, "region": {"startLine": 584}}}]}, {"ruleId": "scanner-95f506a6d9c6b5f7", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/terminal.js:72"}, "properties": {"repobilityId": "6bfb00416c2ad076", "scanner": "scanner-primary", "fingerprint": "95f506a6d9c6b5f7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/terminal.js"}, "region": {"startLine": 72}}}]}, {"ruleId": "scanner-17f61dcad16731a1", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in web_nexus/static/terminal.js:641"}, "properties": {"repobilityId": "6e318f21951fe287", "scanner": "scanner-primary", "fingerprint": "17f61dcad16731a1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/terminal.js"}, "region": {"startLine": 641}}}]}, {"ruleId": "scanner-7bbcf90ad9c28615", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/crash_core.js:120"}, "properties": {"repobilityId": "50432f4e67f3575e", "scanner": "scanner-primary", "fingerprint": "7bbcf90ad9c28615", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/crash_core.js"}, "region": {"startLine": 120}}}]}, {"ruleId": "scanner-8d9a90c49d3f484d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/index.html:536"}, "properties": {"repobilityId": "482ef19b7023c9ab", "scanner": "scanner-primary", "fingerprint": "8d9a90c49d3f484d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/index.html"}, "region": {"startLine": 536}}}]}, {"ruleId": "scanner-6bddb849cd32e83f", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/commands_core.js:61"}, "properties": {"repobilityId": "5172eb9c8fc7a638", "scanner": "scanner-primary", "fingerprint": "6bddb849cd32e83f", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/commands_core.js"}, "region": {"startLine": 61}}}]}, {"ruleId": "scanner-1dd01cce4a694357", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/leaderboard.html:261"}, "properties": {"repobilityId": "1f49b90516934cce", "scanner": "scanner-primary", "fingerprint": "1dd01cce4a694357", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/leaderboard.html"}, "region": {"startLine": 261}}}]}, {"ruleId": "scanner-a380f9df842be022", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/nexus_brain.js:238"}, "properties": {"repobilityId": "7ab64148b16ef937", "scanner": "scanner-primary", "fingerprint": "a380f9df842be022", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/nexus_brain.js"}, "region": {"startLine": 238}}}]}, {"ruleId": "scanner-6c83cc5d183a7eed", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/speedtest.html:369"}, "properties": {"repobilityId": "82c771a63c8fffa1", "scanner": "scanner-primary", "fingerprint": "6c83cc5d183a7eed", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/speedtest.html"}, "region": {"startLine": 369}}}]}, {"ruleId": "scanner-0f3453805c5ebe47", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/nexus_globals.js:87"}, "properties": {"repobilityId": "dd0780e1d3bec9c9", "scanner": "scanner-primary", "fingerprint": "0f3453805c5ebe47", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/nexus_globals.js"}, "region": {"startLine": 87}}}]}, {"ruleId": "scanner-41579bbe41da1744", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/auth_core.js:25"}, "properties": {"repobilityId": "9702baeb5ac9ad17", "scanner": "scanner-primary", "fingerprint": "41579bbe41da1744", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/auth_core.js"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-0527f1f4c75dcd85", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/typing.html:676"}, "properties": {"repobilityId": "69f8eccfbe741a4f", "scanner": "scanner-primary", "fingerprint": "0527f1f4c75dcd85", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/typing.html"}, "region": {"startLine": 676}}}]}, {"ruleId": "scanner-ee2036bbfe152c63", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/ai_tools_core.js:25"}, "properties": {"repobilityId": "6866cb876b714b18", "scanner": "scanner-primary", "fingerprint": "ee2036bbfe152c63", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/ai_tools_core.js"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-0b51b4dc1d4e3ef7", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/locked.html:351"}, "properties": {"repobilityId": "a126ecec12d27aa6", "scanner": "scanner-primary", "fingerprint": "0b51b4dc1d4e3ef7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/locked.html"}, "region": {"startLine": 351}}}]}, {"ruleId": "scanner-4614d9e874e7575b", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/snake.js:33"}, "properties": {"repobilityId": "85dc280ba35f60f6", "scanner": "scanner-primary", "fingerprint": "4614d9e874e7575b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/games/snake.js"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-071dd2922cb9a070", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/wordle.js:143"}, "properties": {"repobilityId": "4f77404c8c1e243e", "scanner": "scanner-primary", "fingerprint": "071dd2922cb9a070", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/games/wordle.js"}, "region": {"startLine": 143}}}]}, {"ruleId": "scanner-33884465041adf2d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/flappy.js:14"}, "properties": {"repobilityId": "279e2b3ac36aaf26", "scanner": "scanner-primary", "fingerprint": "33884465041adf2d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/games/flappy.js"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-4b1ad50cc6bf8880", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/breakout.js:11"}, "properties": {"repobilityId": "34aee0403c921284", "scanner": "scanner-primary", "fingerprint": "4b1ad50cc6bf8880", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/games/breakout.js"}, "region": {"startLine": 11}}}]}, {"ruleId": "scanner-e6a71f766b714061", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/mancala.js:45"}, "properties": {"repobilityId": "fa6e785f9e550ef2", "scanner": "scanner-primary", "fingerprint": "e6a71f766b714061", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/games/mancala.js"}, "region": {"startLine": 45}}}]}, {"ruleId": "scanner-2f2d8d73d2f29ad1", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/mines.js:82"}, "properties": {"repobilityId": "db3d4e4cbda058b2", "scanner": "scanner-primary", "fingerprint": "2f2d8d73d2f29ad1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/games/mines.js"}, "region": {"startLine": 82}}}]}, {"ruleId": "scanner-7dbd64b1acf3dab1", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/_lifecycle.js:89"}, "properties": {"repobilityId": "7f2efe9f49f3fdcc", "scanner": "scanner-primary", "fingerprint": "7dbd64b1acf3dab1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/games/_lifecycle.js"}, "region": {"startLine": 89}}}]}, {"ruleId": "scanner-aef541b37387f6c2", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/pong.js:8"}, "properties": {"repobilityId": "2a2045864c9a7bad", "scanner": "scanner-primary", "fingerprint": "aef541b37387f6c2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/games/pong.js"}, "region": {"startLine": 8}}}]}, {"ruleId": "scanner-884418548636ee0c", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/matrix.js:10"}, "properties": {"repobilityId": "ea29ad8966c891e2", "scanner": "scanner-primary", "fingerprint": "884418548636ee0c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/games/matrix.js"}, "region": {"startLine": 10}}}]}, {"ruleId": "scanner-a48fd0c43e86b7e2", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/games/typing.js:67"}, "properties": {"repobilityId": "d9feecfedd907512", "scanner": "scanner-primary", "fingerprint": "a48fd0c43e86b7e2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/games/typing.js"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-8bec66f03ab2b6e3", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/core_modules/speedtest_logic.js:9"}, "properties": {"repobilityId": "26a79cb52da04220", "scanner": "scanner-primary", "fingerprint": "8bec66f03ab2b6e3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/core_modules/speedtest_logic.js"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-7c6abb908ce52218", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/core_modules/hardware_logic.js:9"}, "properties": {"repobilityId": "b31980a73936f143", "scanner": "scanner-primary", "fingerprint": "7c6abb908ce52218", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/core_modules/hardware_logic.js"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-29fac876e838021a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/utils/speedtest.js:84"}, "properties": {"repobilityId": "ccb81271fef4dea5", "scanner": "scanner-primary", "fingerprint": "29fac876e838021a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/utils/speedtest.js"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-2566a097ee8c2c66", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in web_nexus/static/utils/maintenance_hub.js:71"}, "properties": {"repobilityId": "b482720c6a506570", "scanner": "scanner-primary", "fingerprint": "2566a097ee8c2c66", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_nexus/static/utils/maintenance_hub.js"}, "region": {"startLine": 71}}}]}, {"ruleId": "scanner-ff32e90cad736f31", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "f3f7f29753bad7e4", "scanner": "scanner-primary", "fingerprint": "ff32e90cad736f31", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-worker.yml"}, "region": {"startLine": 22}}}]}, {"ruleId": "scanner-ff32e90cad736f31", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b612e2f50bf8d677", "scanner": "scanner-primary", "fingerprint": "ff32e90cad736f31", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-worker.yml"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-ff32e90cad736f31", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "b05258fd7dfc25f1", "scanner": "scanner-primary", "fingerprint": "ff32e90cad736f31", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-worker.yml"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-595369c23b08e0fd", "level": "note", "message": {"text": "Very large file: worker/src/index.js (1783 lines)"}, "properties": {"repobilityId": "d8b57300a0d0dedf", "scanner": "scanner-primary", "fingerprint": "595369c23b08e0fd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7b86ce3a5c758d14", "level": "note", "message": {"text": "Very large file: web_nexus/static/ai_core.js (1276 lines)"}, "properties": {"repobilityId": "e8f597e4182ce723", "scanner": "scanner-primary", "fingerprint": "7b86ce3a5c758d14", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8caa8ed05c424b8e", "level": "note", "message": {"text": "Very large file: web_nexus/static/terminal.js (2925 lines)"}, "properties": {"repobilityId": "25412b2d65956b4b", "scanner": "scanner-primary", "fingerprint": "8caa8ed05c424b8e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-01f96f71d9907a8c", "level": "note", "message": {"text": "README lacks setup or run instructions"}, "properties": {"repobilityId": "62efd5b57e1d0aaf", "scanner": "scanner-primary", "fingerprint": "01f96f71d9907a8c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["docs", "readme", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "f853c270cb5d0c5b", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "82a980385c6a3455", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "c86e40575361d786", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-11825279136b53a3", "level": "warning", "message": {"text": "CI is configured but no tests are detected"}, "properties": {"repobilityId": "dfe671702d8fe2aa", "scanner": "scanner-primary", "fingerprint": "11825279136b53a3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "ci", "config-theater", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "fd3a36e191bd7921", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "da0a4311c5d92dc9", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "b42f30d156b13bdf", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-69e756455f9172c2", "level": "none", "message": {"text": "Commented-code block (5 lines) in worker/src/index.js:100"}, "properties": {"repobilityId": "00b6349bd101a498", "scanner": "scanner-primary", "fingerprint": "69e756455f9172c2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3d46db3638568676", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 worker/src/index.js:205"}, "properties": {"repobilityId": "3d252b3225b6abd2", "scanner": "scanner-primary", "fingerprint": "3d46db3638568676", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e343770594de9fd7", "level": "note", "message": {"text": "Legacy-named symbol `nexus_tts_v2` in web_nexus/static/tts_core.js:9"}, "properties": {"repobilityId": "737d5b0abd59b3b7", "scanner": "scanner-primary", "fingerprint": "e343770594de9fd7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c6ad61a1a675d868", "level": "none", "message": {"text": "Commented-code block (6 lines) in web_nexus/static/ai_core.js:12"}, "properties": {"repobilityId": "2201568c79b7ff4d", "scanner": "scanner-primary", "fingerprint": "c6ad61a1a675d868", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-90c22f05bf7f5c0f", "level": "none", "message": {"text": "Commented-code block (5 lines) in web_nexus/static/terminal.js:318"}, "properties": {"repobilityId": "41d3da8f9ac2841a", "scanner": "scanner-primary", "fingerprint": "90c22f05bf7f5c0f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8e9963d76864a796", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 web_nexus/static/terminal.js:1214"}, "properties": {"repobilityId": "e45534439ed16a65", "scanner": "scanner-primary", "fingerprint": "8e9963d76864a796", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-721d177a05c1d6c6", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 web_nexus/static/sw.js:74"}, "properties": {"repobilityId": "7dfdad00f16af86d", "scanner": "scanner-primary", "fingerprint": "721d177a05c1d6c6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6a1ea43d9eabfa2a", "level": "none", "message": {"text": "Commented-code block (5 lines) in web_nexus/static/uplink_core.js:68"}, "properties": {"repobilityId": "34ba241f0aae0367", "scanner": "scanner-primary", "fingerprint": "6a1ea43d9eabfa2a", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a3901bf4c1e2e82a", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 web_nexus/static/uplink_core.js:38"}, "properties": {"repobilityId": "a7ac718bcc97d94e", "scanner": "scanner-primary", "fingerprint": "a3901bf4c1e2e82a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-5f93cf9c53e4b331", "level": "none", "message": {"text": "Commented-code block (5 lines) in web_nexus/static/ai_tools_core.js:312"}, "properties": {"repobilityId": "3bd180b961866aaf", "scanner": "scanner-primary", "fingerprint": "5f93cf9c53e4b331", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4330c75142e97dff", "level": "none", "message": {"text": "Commented-code block (6 lines) in web_nexus/static/games_core.js:1"}, "properties": {"repobilityId": "bb496e7509c7e603", "scanner": "scanner-primary", "fingerprint": "4330c75142e97dff", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4254db3d015542e9", "level": "none", "message": {"text": "Commented-code block (9 lines) in web_nexus/static/games/mancala.js:1"}, "properties": {"repobilityId": "89c168930e196739", "scanner": "scanner-primary", "fingerprint": "4254db3d015542e9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f7f4f27a56d76011", "level": "none", "message": {"text": "Commented-code block (7 lines) in web_nexus/static/games/_lifecycle.js:1"}, "properties": {"repobilityId": "f095c20e97264fbe", "scanner": "scanner-primary", "fingerprint": "f7f4f27a56d76011", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-83bf6557d4a28819", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 web_nexus/static/games/_lifecycle.js:503"}, "properties": {"repobilityId": "385298bf61227e8f", "scanner": "scanner-primary", "fingerprint": "83bf6557d4a28819", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2930b6f9aff1767b", "level": "none", "message": {"text": "Commented-code block (7 lines) in web_nexus/static/utils/speedtest.js:1"}, "properties": {"repobilityId": "cdad19d8efd4f019", "scanner": "scanner-primary", "fingerprint": "2930b6f9aff1767b", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}]}]}