{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "foundry_unresolved_feedback", "name": "Foundry mined unresolved feedback: suzukiyoshihisa/mid-corporate", "shortDescription": {"text": "Foundry mined unresolved feedback: suzukiyoshihisa/mid-corporate"}, "fullDescription": {"text": "Graph query export: Human feedback without linked fix evidence\nQuery id: unresolved_feedback\nQuery type: motif_query\nIntent: Negative/unresolved examples that should not be hallucinated into fixes.\nMotif: unlinked_feedback_needs_evidence\nTraining usage: negative_or_unresolved\nGraph gold label: needs_more_evidence\nRepo: suzukiyoshihisa/mid-corporate\nThread: suzukiyoshihisa/mid-corporate#1\nEvidence:\nGraph motif: Human feedback exists without a linked fix\nMotif id: unlinked_feedback_needs_evidence\nPolarity: bad\nTraining usage: negative_or_unresolved\nSeverity: medium\nRepo: suzukiyoshihisa/mid-corporate\nThread: suzukiyoshihisa/mid-corporate#1\nGraph gold label: needs_more_evidence\nThread graph evidence:\nGitHub issue/PR evidence subgraph\nThread: suzukiyoshihisa/mid-corporate#1\nRepo: suzukiyoshihisa/mid-corporate\nIssue/PR number: 1\nGraph consistency label: needs_more_evidence\nNodes: 14\nEdges: 24\nNode types: {'link_quality': 4, 'comment': 2, 'pr_file': 2, 'comment_chain': 2, 'thread': 1, 'repo'"}, "properties": {"scanner": "foundry_dataset", "category": "practices", "severity": "medium", "confidence": 0.7, "cwe": "", "owasp": ""}}, {"id": "foundry_bad_chain", "name": "Foundry mined bad chains: suzukiyoshihisa/mid-corporate", "shortDescription": {"text": "Foundry mined bad chains: suzukiyoshihisa/mid-corporate"}, "fullDescription": {"text": "Comment chain pattern product: bad_chains\nRepo: suzukiyoshihisa/mid-corporate\nThread: suzukiyoshihisa/mid-corporate#1\nOutcome: not_resolved_or_not_observed\nThread label: thread_has_human_issue_without_fix_context\nSource graph label: source_artifact_without_verification_graph\nReasons: source_graph_has_real_artifacts, link_quality_unresolved, high_risk_human_feedback_label\nChain evidence:\nIssue/PR evidence chain: suzukiyoshihisa/mid-corporate#1\nRepo: suzukiyoshihisa/mid-corporate\nThread label: thread_has_human_issue_without_fix_context\nOutcome: not_resolved_or_not_observed\nComment count: 2\nLinked commit count: 0\nLinked CI commit count: 0\nLinked CI labels: {}\nChanged file count: 2\nLabels: {'security_auth_secret': 1, 'deployment_env_gap': 1}\nPolarities: {'bad': 2}\nChanged file labels: {'dependency_or_build': 2}\nExamples:\n[\n  {\n    \"id\": \"github-feedback-comment-9aafe50081739457\",\n    \"kind\": \"pull_request_body\",\n    \"label\": \"security_auth_secret\",\n    \"polarity\": \"bad\",\n    \"url\": \"https:"}, "properties": {"scanner": "foundry_dataset", "category": "practices", "severity": "high", "confidence": 0.84, "cwe": "", "owasp": ""}}, {"id": "foundry_auth_guardrail_gap", "name": "Foundry mined security auth guardrail gaps: suzukiyoshihisa/mid-corporate", "shortDescription": {"text": "Foundry mined security auth guardrail gaps: suzukiyoshihisa/mid-corporate"}, "fullDescription": {"text": "Graph query export: Security/auth changes without enough guardrails\nQuery id: security_auth_guardrail_gaps\nQuery type: motif_query\nIntent: Assumption-check security/auth examples requiring stronger tests or CI.\nMotif: security_auth_without_guardrails\nTraining usage: assumption_check\nGraph gold label: needs_more_evidence\nRepo: suzukiyoshihisa/mid-corporate\nThread: suzukiyoshihisa/mid-corporate#1\nEvidence:\nGraph motif: Security/auth change without enough guardrails\nMotif id: security_auth_without_guardrails\nPolarity: bad\nTraining usage: assumption_check\nSeverity: critical\nRepo: suzukiyoshihisa/mid-corporate\nThread: suzukiyoshihisa/mid-corporate#1\nGraph gold label: needs_more_evidence\nThread graph evidence:\nGitHub issue/PR evidence subgraph\nThread: suzukiyoshihisa/mid-corporate#1\nRepo: suzukiyoshihisa/mid-corporate\nIssue/PR number: 1\nGraph consistency label: needs_more_evidence\nNodes: 14\nEdges: 24\nNode types: {'link_quality': 4, 'comment': 2, 'pr_file': 2, 'comment_chain': 2, 'thread': 1,"}, "properties": {"scanner": "foundry_dataset", "category": "auth", "severity": "critical", "confidence": 0.78, "cwe": "", "owasp": ""}}, {"id": "scanner-bead75b0f9233e05", "name": "No API endpoints detected", "shortDescription": {"text": "No API endpoints detected"}, "fullDescription": {"text": "The scanner did not find FastAPI/Flask/Express/NestJS/GraphQL/gRPC routes. If this repo exposes APIs, the framework may be unsupported."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e0a609150db5a281", "name": "Stray `console.log` in TS/JS \u2014 app/_actions/contact.ts:99", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 app/_actions/contact.ts:99"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd9ba655b659bb9f", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 app/_components/Article/index.tsx:37", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 app/_components/Article/index.tsx:37"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-705f78d5729fd419", "name": "Insecure pattern 'dangerous_innerhtml' in app/_components/Article/index.tsx:37", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in app/_components/Article/index.tsx:37"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 45 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20581"}, "properties": {"repository": "suzukiyoshihisa/mid-corporate", "repoUrl": "https://github.com/suzukiyoshihisa/mid-corporate", "branch": "main"}, "results": [{"ruleId": "foundry_unresolved_feedback", "level": "warning", "message": {"text": "Foundry mined unresolved feedback: suzukiyoshihisa/mid-corporate"}, "properties": {"repobilityId": 370504, "scanner": "foundry_dataset", "fingerprint": "3e859dbfedcc745ab5cc42ce5603ff29f9081ec563a0ef173fbb8653f5eb8b2a", "category": "practices", "severity": "medium", "confidence": 0.7, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Imported from mined Foundry/Fable5 evidence with real GitHub/source provenance. Review source_id before acting.", "evidence": {"meta": {"kind": "graph_query_record", "title": "Human feedback without linked fix evidence", "intent": "Negative/unresolved examples that should not be hallucinated into fixes.", "labels": {"deployment_env_gap": 1, "dependency_or_build": 2, "security_auth_secret": 1, "issue_or_pull_request_thread": 1, "not_resolved_or_not_observed": 4, "human_reported_issue_no_linked_fix": 2, "thread_has_human_issue_without_fix_context": 2}, "source": "graph_query_export", "motif_id": "unlinked_feedback_needs_evidence", "outcomes": {"not_resolved_or_not_observed": 8}, "polarity": "bad", "query_id": "unresolved_feedback", "severity": "medium", "ci_labels": {}, "synthetic": false, "edge_count": 24, "edge_types": {"repo_has_thread": 1, "comment_has_chain": 2, "thread_has_comment": 2, "thread_touches_file": 2, "chain_has_link_quality": 4, "thread_has_fix_outcome": 1, "thread_has_issue_chain": 1, "issue_chain_touches_file": 2, "thread_has_comment_chain": 2, "comment_chain_touches_file": 4, "issue_chain_has_fix_outcome": 1, "issue_chain_has_comment_chain": 2}, "node_count": 14, "node_types": {"repo": 1, "thread": 1, "comment": 2, "pr_file": 2, "fix_outcome": 1, "issue_chain": 1, "link_quality": 4, "comment_chain": 2}, "query_type": "motif_query", "thread_key": "suzukiyoshihisa/mid-corporate#1", "issue_number": "1", "quality_tiers": {"unresolved": 4}, "repo_full_name": "suzukiyoshihisa/mid-corporate", "training_usage": "negative_or_unresolved", "source_motif_id": "graph-pattern-motif-thread-c603b9e030ac9fcd", "graph_gold_label": "needs_more_evidence", "changed_file_labels": {"dependency_or_build": 10}}, "text": "Graph query export: Human feedback without linked fix evidence\nQuery id: unresolved_feedback\nQuery type: motif_query\nIntent: Negative/unresolved examples that should not be hallucinated into fixes.\nMotif: unlinked_feedback_needs_evidence\nTraining usage: negative_or_unresolved\nGraph gold label: needs_more_evidence\nRepo: suzukiyoshihisa/mid-corporate\nThread: suzukiyoshihisa/mid-corporate#1\nEvidence:\nGraph motif: Human feedback exists without a linked fix\nMotif id: unlinked_feedback_needs_evidence\nPolarity: bad\nTraining usage: negative_or_unresolved\nSeverity: medium\nRepo: suzukiyoshihisa/mid-corporate\nThread: suzukiyoshihisa/mid-corporate#1\nGraph gold label: needs_more_evidence\nThread graph evidence:\nGitHub issue/PR evidence subgraph\nThread: suzukiyoshihisa/mid-corporate#1\nRepo: suzukiyoshihisa/mid-corporate\nIssue/PR number: 1\nGraph consistency label: needs_more_evidence\nNodes: 14\nEdges: 24\nNode types: {'link_quality': 4, 'comment': 2, 'pr_file': 2, 'comment_chain': 2, 'thread': 1, 'repo': 1, 'issue_chain': 1, 'fix_outcome': 1}\nEdge types: {'comment_chain_touches_file': 4, 'chain_has_link_quality': 4, 'thread_has_comment': 2, 'thread_touches_file': 2, 'thread_has_comment_chain': 2, 'comment_has_chain': 2, 'issue_chain_has_comment_chain': 2, 'issue_chain_touches_file': 2, 'repo_has_thread': 1, 'thread_has_issue_chain': 1, 'thread_has_fix_outcome': 1, 'issue_chain_has_fix_outcome': 1}\nLabels: {'not_resolved_or_not_observed': 4, 'dependency_or_build': 2, 'human_reported_issue_no_linked_fix': 2, 'thread_has_human_issue_without_fix_context': 2, 'issue_or_pull_request_thread': 1, 'security_auth_secret': 1, 'deployment_env_gap': 1}\nOutcomes: {'not_resolved_or_not_observed': 8}\nQuality tiers: {'unresolved': 4}\nCI labels: {}\nCurriculum targets:\n- Teach models to preserve unresolved human feedback instead of hallucinating fixes.\n- Build issue-to-regression examples where no accepted fix exists yet.\nAssumption checks:\n- Can a commit be linked by issue number, SHA, changed path, or time window?\n- If no link exists, is this explicitly labelled unresolved?", "source": "foundry_mined_dataset", "repo_url": "https://github.com/suzukiyoshihisa/mid-corporate", "source_id": "graph-query-motif_query-61e12d18219253ad", "synthetic": false, "gold_label": "", "graph_label": "", "source_path": "/data/distillate/foundry_data/graph_queries/unresolved_feedback/shard-0.jsonl", "bundle_label": "", "priority_band": "", "priority_score": 0, "repo_full_name": "suzukiyoshihisa/mid-corporate", "source_dataset": "graph_queries/unresolved_feedback", "training_usage": "negative_or_unresolved"}}}, {"ruleId": "foundry_bad_chain", "level": "error", "message": {"text": "Foundry mined bad chains: suzukiyoshihisa/mid-corporate"}, "properties": {"repobilityId": 323129, "scanner": "foundry_dataset", "fingerprint": "ff919ad6edbbce17410926a376f034839e380d29f9f12a420cf2108197bf5ef0", "category": "practices", "severity": "high", "confidence": 0.84, "triageState": "open", "verdict": "confirmed", "isResolved": false, "reason": "Imported from mined Foundry/Fable5 evidence with real GitHub/source provenance. Review source_id before acting.", "evidence": {"meta": {"kind": "comment_chain_pattern_product", "source": "comment_chain_pattern_miner", "product": "bad_chains", "synthetic": false, "thread_key": "suzukiyoshihisa/mid-corporate#1", "human_labels": ["dependency_or_build", "deployment_env_gap", "security_auth_secret"], "issue_number": "1", "thread_label": "thread_has_human_issue_without_fix_context", "outcome_label": "not_resolved_or_not_observed", "source_backed": true, "max_confidence": 0.0, "repo_full_name": "suzukiyoshihisa/mid-corporate", "training_usage": "negative_or_unresolved", "confidence_tier": "unresolved", "source_chain_id": "evidence-chain-issue_chain-020bd8f0a53f0765", "helicopter_views": {}, "artifact_families": {"docs": 1}, "source_chain_kind": "issue_chain", "changed_file_count": 2, "source_graph_label": "source_artifact_without_verification_graph", "changed_file_labels": {"dependency_or_build": 2}, "linked_commit_count": 0, "helicopter_view_count": 0, "source_artifact_count": 1, "classification_reasons": ["source_graph_has_real_artifacts", "link_quality_unresolved", "high_risk_human_feedback_label"], "linked_ci_commit_count": 0, "verification_artifact_count": 0, "design_schema_api_artifact_count": 0}, "text": "Comment chain pattern product: bad_chains\nRepo: suzukiyoshihisa/mid-corporate\nThread: suzukiyoshihisa/mid-corporate#1\nOutcome: not_resolved_or_not_observed\nThread label: thread_has_human_issue_without_fix_context\nSource graph label: source_artifact_without_verification_graph\nReasons: source_graph_has_real_artifacts, link_quality_unresolved, high_risk_human_feedback_label\nChain evidence:\nIssue/PR evidence chain: suzukiyoshihisa/mid-corporate#1\nRepo: suzukiyoshihisa/mid-corporate\nThread label: thread_has_human_issue_without_fix_context\nOutcome: not_resolved_or_not_observed\nComment count: 2\nLinked commit count: 0\nLinked CI commit count: 0\nLinked CI labels: {}\nChanged file count: 2\nLabels: {'security_auth_secret': 1, 'deployment_env_gap': 1}\nPolarities: {'bad': 2}\nChanged file labels: {'dependency_or_build': 2}\nExamples:\n[\n  {\n    \"id\": \"github-feedback-comment-9aafe50081739457\",\n    \"kind\": \"pull_request_body\",\n    \"label\": \"security_auth_secret\",\n    \"polarity\": \"bad\",\n    \"url\": \"https://github.com/suzukiyoshihisa/mid-corporate/pull/1\",\n    \"text\": \"GitHub feedback: security_auth_secret\\nPolarity: bad\\nKind: pull_request_body\\nRepo: suzukiyoshihisa/mid-corporate\\nAuthor: vercel[bot] (Bot)\\nURL: https://github.com/suzukiyoshihisa/mid-corporate/pull/1\\nTitle: Fix React Server Components CVE vulnerabilities\\nBody:\\n> [!IMPORTANT]\\n> This is an automatic PR generated by Vercel to help you with patching efforts. We can't guarantee it's comprehensive, and it may contain mistakes. Please review our [guidance](https://vercel.link/additional-checks) before merging these changes.\\n\\nA critical remote code execution (RCE) vulnerability in React Server Components, impacting frameworks such as Next.js, was identified in the project [mid-corporate](https://vercel.com/y-suzukis-projects/mid-corporate). The vulnerability enables unauthenticated RCE on the server via insecure deserialization in the React Flight protocol.\\n\\nThis issue is tracked under:\\n\\n- GitHub Security Advisory: [GHSA-9qr9-h5gf-34mp](https://github.com/vercel/next.js/security/advisories/GHSA-9qr9-h5gf-34mp)\\n- React Advisory: [CVE-2025-55182](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components)\\n- Next.js Advisory: [CVE-2025-66478](https://nextjs.or\"\n  },\n  {\n    \"id\": \"github-feedback-comment-6738de7b9db8f32c\",\n    \"kind\": \"issue_comment\",\n    \"label\": \"deployment_env_gap\",\n    \"polarity\": \"bad\",\n    \"url\": \"https://github.com/suzukiyoshihisa/mid-corporate/pull/1#issuecomment-3758845199\",\n    \"text\": \"GitHub feedback: deployment_env_gap\\nPolarity: bad\\nKind: issue_comment\\nRepo: suzukiyoshihisa/mid-corporate\\nAuthor: vercel[bot] (Bot)\\nURL: https://github.com/suzukiyoshihisa/mid-corporate/pull/1#issuecomment-3758845199\\nTitle: \\nBody:\\n[vc]: #Ns3oKGwB1pRDm+6nFwQ1DTaJ51pxOSBgXjPbImcJyGo=:eyJpc01vbm9yZXBvIjp0cnVlLCJ0eXBlIjoiZ2l0aHViIiwicHJvamVjdHMiOlt7Im5hbWUiOiJtaWQtY29ycG9yYXRlIiwiaW5zcGVjdG9yVXJsIjoiaHR0cHM6Ly92ZXJjZWwu\n[truncated by importer]", "source": "foundry_mined_dataset", "repo_url": "https://github.com/suzukiyoshihisa/mid-corporate", "source_id": "comment-chain-pattern-bad_chains-1c7cfd41285b15bc", "synthetic": false, "gold_label": "", "graph_label": "source_artifact_without_verification_graph", "source_path": "/data/distillate/foundry_data/comment_chain_patterns/bad_chains/shard-0.jsonl", "bundle_label": "", "priority_band": "", "priority_score": 0, "repo_full_name": "suzukiyoshihisa/mid-corporate", "source_dataset": "comment_chain_patterns/bad_chains", "training_usage": "negative_or_unresolved"}}}, {"ruleId": "foundry_auth_guardrail_gap", "level": "error", "message": {"text": "Foundry mined security auth guardrail gaps: suzukiyoshihisa/mid-corporate"}, "properties": {"repobilityId": 335003, "scanner": "foundry_dataset", "fingerprint": "5e3f16463bd3ab89ae5856b449da595f8ed12428f5bdd94ea4a87db270e30677", "category": "auth", "severity": "critical", "confidence": 0.78, "triageState": "open", "verdict": "needs_review", "isResolved": false, "reason": "Imported from mined Foundry/Fable5 evidence with real GitHub/source provenance. Review source_id before acting.", "evidence": {"meta": {"kind": "graph_query_record", "title": "Security/auth changes without enough guardrails", "intent": "Assumption-check security/auth examples requiring stronger tests or CI.", "labels": {"deployment_env_gap": 1, "dependency_or_build": 2, "security_auth_secret": 1, "issue_or_pull_request_thread": 1, "not_resolved_or_not_observed": 4, "human_reported_issue_no_linked_fix": 2, "thread_has_human_issue_without_fix_context": 2}, "source": "graph_query_export", "motif_id": "security_auth_without_guardrails", "outcomes": {"not_resolved_or_not_observed": 8}, "polarity": "bad", "query_id": "security_auth_guardrail_gaps", "severity": "critical", "ci_labels": {}, "synthetic": false, "edge_count": 24, "edge_types": {"repo_has_thread": 1, "comment_has_chain": 2, "thread_has_comment": 2, "thread_touches_file": 2, "chain_has_link_quality": 4, "thread_has_fix_outcome": 1, "thread_has_issue_chain": 1, "issue_chain_touches_file": 2, "thread_has_comment_chain": 2, "comment_chain_touches_file": 4, "issue_chain_has_fix_outcome": 1, "issue_chain_has_comment_chain": 2}, "node_count": 14, "node_types": {"repo": 1, "thread": 1, "comment": 2, "pr_file": 2, "fix_outcome": 1, "issue_chain": 1, "link_quality": 4, "comment_chain": 2}, "query_type": "motif_query", "thread_key": "suzukiyoshihisa/mid-corporate#1", "issue_number": "1", "quality_tiers": {"unresolved": 4}, "repo_full_name": "suzukiyoshihisa/mid-corporate", "training_usage": "assumption_check", "source_motif_id": "graph-pattern-motif-thread-54e10e0dbe0c2894", "graph_gold_label": "needs_more_evidence", "changed_file_labels": {"dependency_or_build": 10}}, "text": "Graph query export: Security/auth changes without enough guardrails\nQuery id: security_auth_guardrail_gaps\nQuery type: motif_query\nIntent: Assumption-check security/auth examples requiring stronger tests or CI.\nMotif: security_auth_without_guardrails\nTraining usage: assumption_check\nGraph gold label: needs_more_evidence\nRepo: suzukiyoshihisa/mid-corporate\nThread: suzukiyoshihisa/mid-corporate#1\nEvidence:\nGraph motif: Security/auth change without enough guardrails\nMotif id: security_auth_without_guardrails\nPolarity: bad\nTraining usage: assumption_check\nSeverity: critical\nRepo: suzukiyoshihisa/mid-corporate\nThread: suzukiyoshihisa/mid-corporate#1\nGraph gold label: needs_more_evidence\nThread graph evidence:\nGitHub issue/PR evidence subgraph\nThread: suzukiyoshihisa/mid-corporate#1\nRepo: suzukiyoshihisa/mid-corporate\nIssue/PR number: 1\nGraph consistency label: needs_more_evidence\nNodes: 14\nEdges: 24\nNode types: {'link_quality': 4, 'comment': 2, 'pr_file': 2, 'comment_chain': 2, 'thread': 1, 'repo': 1, 'issue_chain': 1, 'fix_outcome': 1}\nEdge types: {'comment_chain_touches_file': 4, 'chain_has_link_quality': 4, 'thread_has_comment': 2, 'thread_touches_file': 2, 'thread_has_comment_chain': 2, 'comment_has_chain': 2, 'issue_chain_has_comment_chain': 2, 'issue_chain_touches_file': 2, 'repo_has_thread': 1, 'thread_has_issue_chain': 1, 'thread_has_fix_outcome': 1, 'issue_chain_has_fix_outcome': 1}\nLabels: {'not_resolved_or_not_observed': 4, 'dependency_or_build': 2, 'human_reported_issue_no_linked_fix': 2, 'thread_has_human_issue_without_fix_context': 2, 'issue_or_pull_request_thread': 1, 'security_auth_secret': 1, 'deployment_env_gap': 1}\nOutcomes: {'not_resolved_or_not_observed': 8}\nQuality tiers: {'unresolved': 4}\nCI labels: {}\nCurriculum targets:\n- Train auth boundary repair with tests, permission matrices, and secret-handling checks.\n- Keep risky auth changes separate from ordinary bug-fix examples.\nAssumption checks:\n- Are auth/permission paths covered by tests?\n- Are secrets, CORS, or access rules verified rather than summarized?", "source": "foundry_mined_dataset", "repo_url": "https://github.com/suzukiyoshihisa/mid-corporate", "source_id": "graph-query-motif_query-68f5427eb9e2bcfe", "synthetic": false, "gold_label": "", "graph_label": "", "source_path": "/data/distillate/foundry_data/graph_queries/security_auth_guardrail_gaps/shard-0.jsonl", "bundle_label": "", "priority_band": "", "priority_score": 0, "repo_full_name": "suzukiyoshihisa/mid-corporate", "source_dataset": "graph_queries/security_auth_guardrail_gaps", "training_usage": "assumption_check"}}}, {"ruleId": "scanner-bead75b0f9233e05", "level": "none", "message": {"text": "No API endpoints detected"}, "properties": {"repobilityId": "0f8bb852027c38f8", "scanner": "scanner-primary", "fingerprint": "bead75b0f9233e05", "layer": "api", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-e0a609150db5a281", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 app/_actions/contact.ts:99"}, "properties": {"repobilityId": "3debec11ca5fea84", "scanner": "scanner-primary", "fingerprint": "e0a609150db5a281", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-fd9ba655b659bb9f", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 app/_components/Article/index.tsx:37"}, "properties": {"repobilityId": "31b7350da51581ad", "scanner": "scanner-primary", "fingerprint": "fd9ba655b659bb9f", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-705f78d5729fd419", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in app/_components/Article/index.tsx:37"}, "properties": {"repobilityId": "13d1acd8d0432fab", "scanner": "scanner-primary", "fingerprint": "705f78d5729fd419", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app/_components/Article/index.tsx"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "a151d2e76c4c1399", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "be4f2adfc1d6d839", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "0456a88426801bcd", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "dfe79c1dc5ec6558", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}]}]}