{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-613d6385a2185559", "name": "Possibly dead Python function: log_message", "shortDescription": {"text": "Possibly dead Python function: log_message"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a1794532e196da0b", "name": "Possibly dead Python function: do_GET", "shortDescription": {"text": "Possibly dead Python function: do_GET"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e27fbddd7a84296", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/makers/maker-dmg.ts:215", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/makers/maker-dmg.ts:215"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-9dc8905e1ee4d5a8", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/main.ts:792", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/main.ts:792"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-a2846cbaf16fce17", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/renderer/main.tsx:81", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/renderer/main.tsx:81"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-cacc38d3f03ea364", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/MigrationSection.tsx:192", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/MigrationSection.tsx:192"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-92a948e6a5170f50", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SessionsBoardAdapters.tsx:40", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SessionsBoardAdapters.tsx:404"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-7b89eb4ebb363c67", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/CommandPalette.tsx:739", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/CommandPalette.tsx:739"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-be66724d8681413f", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/RemoteDirectoryPicker.tsx:39", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/RemoteDirectoryPicker.tsx:39"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-f81560a38ee701ce", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/NotificationCenter.tsx:1030", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/NotificationCenter.tsx:1030"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-937607acf866c774", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/BrowserPanel.tsx:1085", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/BrowserPanel.tsx:1085"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-93f54791bbf6cad3", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SearchablePicker.tsx:163", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SearchablePicker.tsx:163"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-958baa2bd141e0a4", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/OrchestratorChildrenSection.", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/OrchestratorChildrenSection.tsx:93"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-85ba224ca5b67050", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/RestartToUpdateDialog.tsx:16", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/RestartToUpdateDialog.tsx:169"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-00c183d56186c04b", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SessionLinkPreviewCard.tsx:1", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SessionLinkPreviewCard.tsx:118"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-29baec45241be9b0", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/HomePage.tsx:105", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/HomePage.tsx:105"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-2edf7685ca34339b", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SessionFileTabs.tsx:121", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SessionFileTabs.tsx:121"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-6034c22e8cdb9708", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/AutomationsView.tsx:93", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/AutomationsView.tsx:93"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-a5aa70b0125f27f8", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/CoderWorkspaceLinkButton.tsx", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/CoderWorkspaceLinkButton.tsx:75"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-c811c2969102af0a", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/FileContentPane.tsx:289", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/FileContentPane.tsx:289"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-e5ed7a4ef91a6224", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/CenterPane.tsx:721", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/CenterPane.tsx:721"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-6f0e4823e927f762", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/PathRow.tsx:18", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/PathRow.tsx:18"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-3166df5fabd76d77", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/BranchNamingLabel.tsx:15", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/BranchNamingLabel.tsx:15"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-b0aabc9fb9194de4", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SessionInspector.tsx:621", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SessionInspector.tsx:621"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-7717c276d427d293", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/CloudProjectSettingsForm.tsx", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/CloudProjectSettingsForm.tsx:124"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-61e8213b901f8b23", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SessionArtifactsView.tsx:139", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SessionArtifactsView.tsx:139"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-71004c7a2bf91215", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/CuesDialog.tsx:237", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/CuesDialog.tsx:237"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-8f601258e3e9b2f7", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SettingsDialog.tsx:564", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SettingsDialog.tsx:564"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-7e8fa451e9b4f42f", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/CreateProjectFlow.tsx:2440", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/CreateProjectFlow.tsx:2440"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-53cca9f42de320be", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/NewTaskDialog.tsx:152", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/NewTaskDialog.tsx:152"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-6cfa9813dcf757d5", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SessionMemoryPanel.tsx:667", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SessionMemoryPanel.tsx:667"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-5f52d360713c58bc", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/TerminalPane.tsx:1551", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/TerminalPane.tsx:1551"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-c9f83462a675d4ba", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/LinkPreviewCard.tsx:76", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/LinkPreviewCard.tsx:76"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-22d57bc5042da433", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/WorkspaceDiffView.tsx:367", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/WorkspaceDiffView.tsx:367"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-283f8921d2d7b67c", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/HarnessUpdateNotice.tsx:271", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/HarnessUpdateNotice.tsx:271"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-25d0d58985f82b49", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/CreateProjectAgentSheet.tsx:", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/CreateProjectAgentSheet.tsx:496"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-e016b13703f5d96a", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/Sidebar.tsx:980", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/Sidebar.tsx:980"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-e9cf91fe11a895db", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/ShellTerminalTab.tsx:198", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/ShellTerminalTab.tsx:198"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-b7c2617ba2f051ff", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/ReviewerSelect.tsx:310", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/ReviewerSelect.tsx:310"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-2ddadb7a5ccc4e6d", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/TaskComposer.tsx:923", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/TaskComposer.tsx:923"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-426bdadb78bf0f23", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/GitHubOnboardingNotice.tsx:1", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/GitHubOnboardingNotice.tsx:159"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-675e336673f6a6f7", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/BrowserProfileButton.tsx:60", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/BrowserProfileButton.tsx:60"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-fa14d44d3edca083", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SessionBranchSummary.tsx:227", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SessionBranchSummary.tsx:227"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-4a48d9ffee61ab75", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/ShellTopbar.tsx:178", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/ShellTopbar.tsx:178"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-4b0e1f2a53bf0482", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/ArtifactsView.tsx:150", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/ArtifactsView.tsx:150"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-231177e21219bcfd", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SessionsBoard.tsx:256", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SessionsBoard.tsx:256"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-5815f2ec22b774e9", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/CloneRepositoryDialog.tsx:30", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/CloneRepositoryDialog.tsx:303"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-d0bdff5d01e04bc0", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/ImageDiffView.tsx:113", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/ImageDiffView.tsx:113"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-7e0fd130e4db488c", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/RemoteHostsSection.tsx:30", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/RemoteHostsSection.tsx:30"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-8e98d7b0ba106c8b", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/ArtifactHistory.tsx:63", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/ArtifactHistory.tsx:63"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-bbe1b7da2e0f4ee8", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/TitlebarNav.tsx:158", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/TitlebarNav.tsx:158"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-280f06a4e52cd31b", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/BrowserImportDialog", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/BrowserImportDialog.tsx:419"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-9278a1c42a58dd56", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/AgentAccountsSectio", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/AgentAccountsSection.tsx:152"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-4dc771084e003453", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/ConnectMobileConten", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/ConnectMobileContent.tsx:642"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-241c6cae6c97d20c", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/AgentProviderGroup.", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/AgentProviderGroup.tsx:36"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-ee2c0582a52573ad", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/AgentSelectMenuItem", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/AgentSelectMenuItem.tsx:34"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-65fd13ee6d608f09", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/SettingsOptionMenu.", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/SettingsOptionMenu.tsx:115"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-48d57494913e0c37", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/CodexAccountsSectio", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/CodexAccountsSection.tsx:204"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-4682f08a6e39e187", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/CodexAccountRow.tsx", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/CodexAccountRow.tsx:43"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-4916874dac3dbff5", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/AgentModelCombobox.", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/AgentModelCombobox.tsx:308"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-9116b2035d37594b", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/CodexAccountLoginTe", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/CodexAccountLoginTerminalPanel.tsx:46"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-07e0146d3d63cc65", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/UpdatesSection.tsx:", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/UpdatesSection.tsx:710"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-9e8c1bcab475e1f1", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/SettingsRow.tsx:25", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/SettingsRow.tsx:25"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-ae0d8712582f81b9", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/EffortPicker.tsx:10", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/EffortPicker.tsx:104"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-59deb6565bf8afb4", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/GeneralSettingsSect", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/GeneralSettingsSection.tsx:178"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-60d0edfa03221ac8", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/harness/HarnessSess", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/harness/HarnessSessionsDialog.tsx:51"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-539206f28f15f4b2", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/harness/HarnessAuth", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/harness/HarnessAuthTerminalPanel.tsx:93"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-8a457220f1e378a8", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/cloud-workspace/CloudWorkspa", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/cloud-workspace/CloudWorkspaceReviewPane.tsx:193"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-6967dd01e6d19d3e", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/cloud-workspace/CloudFileTre", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/cloud-workspace/CloudFileTree.tsx:52"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-43e25b8f7b7dcfc2", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/ui/option-menu.tsx:163", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/ui/option-menu.tsx:163"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-2e553fd3627f9f60", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/ChatAnnotationSummary.t", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/ChatAnnotationSummary.tsx:63"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-a4454751ca1bbadb", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/RenderFrame.tsx:328", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/RenderFrame.tsx:328"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-aa73869571ec4a0d", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/ChatStatusBanners.tsx:3", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/ChatStatusBanners.tsx:373"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-8ab20864c36a619a", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/ComposerEditor.tsx:138", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/ComposerEditor.tsx:138"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-43db08b13dc2b2ba", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/AgentSwitchPicker.tsx:4", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/AgentSwitchPicker.tsx:424"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-c78b36c1341564b2", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/CueRunMenu.tsx:331", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/CueRunMenu.tsx:331"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-64503e17eb93992f", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/src/renderer/components/chat/MermaidBlock.tsx:206", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/src/renderer/components/chat/MermaidBlock.tsx:206"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-64d51eb43711c9ed", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/TurnSettingsBar.tsx:731", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/TurnSettingsBar.tsx:731"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-8bcf5cb194651a5f", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/ComposerSuggestMenu.tsx", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/ComposerSuggestMenu.tsx:159"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-51a72e7198f973c9", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/ChatWorkspace.tsx:2278", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/ChatWorkspace.tsx:2278"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-3cb0c9c5b7cf751a", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/ChatTimelineItems.tsx:3", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/ChatTimelineItems.tsx:362"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-f02245f19ad1ad7d", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/ElicitationDock.tsx:195", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/ElicitationDock.tsx:195"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-a8cdc0c12533a09e", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/ConversationContentItem", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/ConversationContentItems.tsx:58"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-37580b22b2deaeec", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/ConversationBranchNavig", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/ConversationBranchNavigator.tsx:67"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-31caa1ed5c3dc35d", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/diffs/WorkspaceReviewPane.ts", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/diffs/WorkspaceReviewPane.tsx:670"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-b1648e7be47874c7", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/diffs/ReviewChangesMenu.tsx:", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/diffs/ReviewChangesMenu.tsx:160"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-9e3fa8e783190ad8", "name": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/diffs/ReviewBranchMenu.tsx:1", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/diffs/ReviewBranchMenu.tsx:182"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-354d669692126d3a", "name": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/main/remote-proxy.ts:128", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/main/remote-proxy.ts:128"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-fab132269b3f76d8", "name": "Truncated text has no discoverable full-value affordance \u2014 packages/product-ui/src/SessionInspectorView.tsx:388", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 packages/product-ui/src/SessionInspectorView.tsx:388"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-fb6f5b9a34a67cba", "name": "Truncated text has no discoverable full-value affordance \u2014 packages/product-ui/src/PRSummaryDisplay.tsx:357", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 packages/product-ui/src/PRSummaryDisplay.tsx:357"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-299b20f8fbf2b488", "name": "Truncated text has no discoverable full-value affordance \u2014 packages/product-ui/src/SessionsBoardView.tsx:360", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 packages/product-ui/src/SessionsBoardView.tsx:360"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-55f2beecc9560c3d", "name": "Truncated text has no discoverable full-value affordance \u2014 packages/product-ui/src/TaskComposerView.tsx:345", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 packages/product-ui/src/TaskComposerView.tsx:345"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-5a7c7ae0a30552b3", "name": "Truncated text has no discoverable full-value affordance \u2014 packages/product-ui/src/ProjectViews.tsx:200", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 packages/product-ui/src/ProjectViews.tsx:200"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-a5ba69485fcf320c", "name": "Truncated text has no discoverable full-value affordance \u2014 packages/product-ui/src/ExecutionContextView.tsx:88", "shortDescription": {"text": "Truncated text has no discoverable full-value affordance \u2014 packages/product-ui/src/ExecutionContextView.tsx:88"}, "fullDescription": {"text": "A visibly truncated value should expose its full text through an accessible tooltip, description, or equivalent interaction. Native `title=` is one option, but it is not the only valid implementation.\n\nWhy: P2 in CHECKLIST.md \u2014 truncate without hover-reveal.\nRule id: fq.truncate.no-title"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 0.65}}, {"id": "scanner-776b6d806578e692", "name": "Debug `console.log` remains in browser-facing code \u2014 packages/mobile/app/pair.tsx:127", "shortDescription": {"text": "Debug `console.log` remains in browser-facing code \u2014 packages/mobile/app/pair.tsx:127"}, "fullDescription": {"text": "Remove debug output or route intentional diagnostics through the project's structured logger. Browser console output can expose state and create noise; server and CLI output are outside this rule's scope.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-b1c18ebd80b5c283", "name": "React Flow <Controls> without dark theming \u2014 packages/mobile/lib/worker-controls-sheet.icons.test.tsx:77", "shortDescription": {"text": "React Flow <Controls> without dark theming \u2014 packages/mobile/lib/worker-controls-sheet.icons.test.tsx:77"}, "fullDescription": {"text": "`<Controls>` ships with white buttons. Override `.react-flow__controls` and `.react-flow__controls-button` in your stylesheet or pass a styled wrapper.\n\nWhy: P1 in CHECKLIST.md \u2014 vendor defaults bleed light through.\nRule id: fq.controls.no-bg"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 0.85}}, {"id": "scanner-29ad8d148e99346b", "name": "use of unsafe block \u2014 backend/internal/adapters/chatdriver/codexappserver/account_home_windows.go:96", "shortDescription": {"text": "use of unsafe block \u2014 backend/internal/adapters/chatdriver/codexappserver/account_home_windows.go:96"}, "fullDescription": {"text": "Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing.\n\nRule: go.lang.security.audit.unsafe.use-of-unsafe-block\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-242: Use of Inherently Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-521a2073856b9134", "name": "use of unsafe block \u2014 backend/internal/adapters/chatdriver/persistenthost/child_windows.go:39", "shortDescription": {"text": "use of unsafe block \u2014 backend/internal/adapters/chatdriver/persistenthost/child_windows.go:39"}, "fullDescription": {"text": "Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing.\n\nRule: go.lang.security.audit.unsafe.use-of-unsafe-block\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-242: Use of Inherently Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-ef0f88e39ccebffe", "name": "math random used \u2014 backend/internal/pricing/refresher.go:7", "shortDescription": {"text": "math random used \u2014 backend/internal/pricing/refresher.go:7"}, "fullDescription": {"text": "Do not use `math/rand`. Use `crypto/rand` instead.\n\nRule: go.lang.security.audit.crypto.math_random.math-random-used\nSeverity: WARNING\nOWASP: A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-38552d3e2c138818", "name": "use of unsafe block \u2014 backend/internal/procmem/snapshot_windows.go:39", "shortDescription": {"text": "use of unsafe block \u2014 backend/internal/procmem/snapshot_windows.go:39"}, "fullDescription": {"text": "Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing.\n\nRule: go.lang.security.audit.unsafe.use-of-unsafe-block\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-242: Use of Inherently Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-a291d9467981a269", "name": "use of unsafe block \u2014 backend/internal/procmem/system_windows.go:54", "shortDescription": {"text": "use of unsafe block \u2014 backend/internal/procmem/system_windows.go:54"}, "fullDescription": {"text": "Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing.\n\nRule: go.lang.security.audit.unsafe.use-of-unsafe-block\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-242: Use of Inherently Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-b6b462afb9491147", "name": "use of unsafe block \u2014 backend/internal/runfile/rename_windows.go:33", "shortDescription": {"text": "use of unsafe block \u2014 backend/internal/runfile/rename_windows.go:33"}, "fullDescription": {"text": "Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing.\n\nRule: go.lang.security.audit.unsafe.use-of-unsafe-block\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-242: Use of Inherently Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-2473661dcb74b1bb", "name": "use of unsafe block \u2014 backend/internal/service/agent/codex_secure_fs_windows.go:300", "shortDescription": {"text": "use of unsafe block \u2014 backend/internal/service/agent/codex_secure_fs_windows.go:300"}, "fullDescription": {"text": "Using the unsafe package in Go gives you low-level memory management and many of the strengths of the C language, but also steps around the type safety of Go and can lead to buffer overflows and possible arbitrary code execution by an attacker. Only use this package if you absolutely know what you're doing.\n\nRule: go.lang.security.audit.unsafe.use-of-unsafe-block\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-242: Use of Inherently Dangerous Function\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-fd27c08bbea78d68", "name": "use of md5 \u2014 backend/internal/service/chat/handoff_history_files.go:36", "shortDescription": {"text": "use of md5 \u2014 backend/internal/service/chat/handoff_history_files.go:36"}, "fullDescription": {"text": "Detected MD5 hash algorithm which is considered insecure. MD5 is not collision resistant and is therefore not suitable as a cryptographic signature. Use SHA256 or SHA3 instead.\n\nRule: go.lang.security.audit.crypto.use_of_weak_crypto.use-of-md5\nSeverity: WARNING\nOWASP: A03:2017 - Sensitive Data Exposure, A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-328: Use of Weak Hash\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-bdec18ae294a6034", "name": "string formatted query \u2014 backend/internal/storage/sqlite/db.go:1255", "shortDescription": {"text": "string formatted query \u2014 backend/internal/storage/sqlite/db.go:1255"}, "fullDescription": {"text": "String-formatted SQL query detected. This could lead to SQL injection if the string is not sanitized properly. Audit this call to ensure the SQL is not manipulable by external data.\n\nRule: go.lang.security.audit.database.string-formatted-query.string-formatted-query\nSeverity: WARNING\nOWASP: A01:2017 - Injection, A03:2021 - Injection, A05:2025 - Injection\nCWE: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-e6a679c606f6e556", "name": "use tls \u2014 cloud/internal/agentbrowser/host/main.go:342", "shortDescription": {"text": "use tls \u2014 cloud/internal/agentbrowser/host/main.go:342"}, "fullDescription": {"text": "Found an HTTP server without TLS. Use 'http.ListenAndServeTLS' instead. See https://golang.org/pkg/net/http/#ListenAndServeTLS for more information.\n\nRule: go.lang.security.audit.net.use-tls.use-tls\nSeverity: WARNING\nOWASP: A03:2017 - Sensitive Data Exposure, A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-319: Cleartext Transmission of Sensitive Information\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-7816f865f0a1ec02", "name": "math random used \u2014 cloud/internal/notification/service.go:9", "shortDescription": {"text": "math random used \u2014 cloud/internal/notification/service.go:9"}, "fullDescription": {"text": "Do not use `math/rand`. Use `crypto/rand` instead.\n\nRule: go.lang.security.audit.crypto.math_random.math-random-used\nSeverity: WARNING\nOWASP: A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-116dea1916f47a62", "name": "math random used \u2014 cloud/internal/notificationoutbox/flusher.go:7", "shortDescription": {"text": "math random used \u2014 cloud/internal/notificationoutbox/flusher.go:7"}, "fullDescription": {"text": "Do not use `math/rand`. Use `crypto/rand` instead.\n\nRule: go.lang.security.audit.crypto.math_random.math-random-used\nSeverity: WARNING\nOWASP: A02:2021 - Cryptographic Failures, A04:2025 - Cryptographic Failures\nCWE: CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-7920ae41e2c37054", "name": "potential dos via decompression bomb \u2014 cloud/internal/workertransport/harness.go:145", "shortDescription": {"text": "potential dos via decompression bomb \u2014 cloud/internal/workertransport/harness.go:145"}, "fullDescription": {"text": "Detected a possible denial-of-service via a zip bomb attack. By limiting the max bytes read, you can mitigate this attack. `io.CopyN()` can specify a size.\n\nRule: go.lang.security.decompression_bomb.potential-dos-via-decompression-bomb\nSeverity: WARNING\nOWASP: \u2014\nCWE: CWE-400: Uncontrolled Resource Consumption\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-dc4bc8275fe47b0f", "name": "dynamic urllib use detected \u2014 cloud/scripts/dev-connect-agent-credential.py:117", "shortDescription": {"text": "dynamic urllib use detected \u2014 cloud/scripts/dev-connect-agent-credential.py:117"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A01:2017 - Injection\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-8020b442d860aae0", "name": "dynamic urllib use detected \u2014 cloud/scripts/workos-copy-environment.py:54", "shortDescription": {"text": "dynamic urllib use detected \u2014 cloud/scripts/workos-copy-environment.py:54"}, "fullDescription": {"text": "Detected a dynamic value being used with urllib. urllib supports 'file://' schemes, so a dynamic value controlled by a malicious actor may allow them to read arbitrary files. Audit uses of urllib calls to ensure user data cannot control the URLs, or consider using the 'requests' library instead.\n\nRule: python.lang.security.audit.dynamic-urllib-use-detected.dynamic-urllib-use-detected\nSeverity: WARNING\nOWASP: A01:2017 - Injection\nCWE: CWE-939: Improper Authorization in Handler for Custom URL Scheme\nCategory: security\nContext: production"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.55}}, {"id": "scanner-a02c2e9d2dd985a6", "name": "CVE-2025-71405: github.com/go-chi/chi/v5 v5.1.0 \u2014 backend/go.mod", "shortDescription": {"text": "CVE-2025-71405: github.com/go-chi/chi/v5 v5.1.0 \u2014 backend/go.mod"}, "fullDescription": {"text": "github.com/go-chi/chi: go-chi/chi: Open Redirect vulnerability via RedirectSlashes middleware\n\nchi versions before v5.2.2 contain an open redirect vulnerability in the RedirectSlashes middleware function that uses the Host header to construct redirect URLs. Attackers can manipulate the Host header to redirect users to arbitrary hosts, enabling phishing attacks and credential theft.\n\nPackage: github.com/go-chi/chi/v5\nInstalled: v5.1.0\nFixed in: 5.2.2\nSeverity: MEDIUM\nFix: Upgrade github.com/go-chi/chi/v5 to 5.2.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e965c194c131cf0c", "name": "CVE-2026-39828: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod", "shortDescription": {"text": "CVE-2026-39828: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Unauthorized command execution via discarded SSH permissions\n\nWhen an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.\n\nPackage: golang.org/x/crypto\nInstalled: v0.51.0\nFixed in: 0.52.0\nSeverity: HIGH\nFix: Upgrade golang.org/x/crypto to 0.52.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cf751f6a9ff6ad01", "name": "CVE-2026-39829: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod", "shortDescription": {"text": "CVE-2026-39829: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters\n\nThe RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.\n\nPackage: golang.org/x/crypto\nInstalled: v0.51.0\nFixed in: 0.52.0\nSeverity: HIGH\nFix: Upgrade golang.org/x/crypto to 0.52.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a979915c1a9d5998", "name": "CVE-2026-39830: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod", "shortDescription": {"text": "CVE-2026-39830: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses\n\nA malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.\n\nPackage: golang.org/x/crypto\nInstalled: v0.51.0\nFixed in: 0.52.0\nSeverity: HIGH\nFix: Upgrade golang.org/x/crypto to 0.52.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cbe37bc552828d42", "name": "CVE-2026-39831: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod", "shortDescription": {"text": "CVE-2026-39831: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Security key bypass due to missing user presence check\n\nThe Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a \"no-touch-required\" extension in Permissions.Extensions from PublicKeyCallback.\n\nPackage: golang.org/x/crypto\nInstalled: v0.51.0\nFixed in: 0.52.0\nSeverity: HIGH\nFix: Upgrade golang.org/x/crypto to 0.52.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-21077b7e36b9fb2f", "name": "CVE-2026-39832: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod", "shortDescription": {"text": "CVE-2026-39832: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions\n\nWhen adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.\n\nPackage: golang.org/x/crypto\nInstalled: v0.51.0\nFixed in: 0.52.0\nSeverity: HIGH\nFix: Upgrade golang.org/x/crypto to 0.52.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-732eab092f014e94", "name": "CVE-2026-39835: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod", "shortDescription": {"text": "CVE-2026-39835: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate\n\nSSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.\n\nPackage: golang.org/x/crypto\nInstalled: v0.51.0\nFixed in: 0.52.0\nSeverity: HIGH\nFix: Upgrade golang.org/x/crypto to 0.52.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-57f475a12eebc033", "name": "CVE-2026-42508: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod", "shortDescription": {"text": "CVE-2026-42508: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey\n\nPreviously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.\n\nPackage: golang.org/x/crypto\nInstalled: v0.51.0\nFixed in: 0.52.0\nSeverity: HIGH\nFix: Upgrade golang.org/x/crypto to 0.52.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-eb809a6a53c849f6", "name": "CVE-2026-46595: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod", "shortDescription": {"text": "CVE-2026-46595: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authorization bypass due to skipped source-address validation\n\nPreviously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.\n\nPackage: golang.org/x/crypto\nInstalled: v0.51.0\nFixed in: 0.52.0\nSeverity: HIGH\nFix: Upgrade golang.org/x/crypto to 0.52.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e8f5d81c827ce216", "name": "CVE-2026-46597: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod", "shortDescription": {"text": "CVE-2026-46597: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted AES-GCM packet decoder inputs\n\nAn incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.\n\nPackage: golang.org/x/crypto\nInstalled: v0.51.0\nFixed in: 0.52.0\nSeverity: HIGH\nFix: Upgrade golang.org/x/crypto to 0.52.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-afac6ed8b8213fa0", "name": "CVE-2026-56854: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod", "shortDescription": {"text": "CVE-2026-56854: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions\n\nThe source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is \n\nPackage: golang.org/x/crypto\nInstalled: v0.51.0\nFixed in: 0.55.0\nSeverity: HIGH\nFix: Upgrade golang.org/x/crypto to 0.55.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-86bfcf7f285ddab5", "name": "CVE-2026-39827: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod", "shortDescription": {"text": "CVE-2026-39827: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via repeated rejected channel openings\n\nAn authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection's internal state and released for garbage collection.\n\nPackage: golang.org/x/crypto\nInstalled: v0.51.0\nFixed in: 0.52.0\nSeverity: MEDIUM\nFix: Upgrade golang.org/x/crypto to 0.52.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d9d377500a5d89dd", "name": "CVE-2026-39833: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod", "shortDescription": {"text": "CVE-2026-39833: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to unenforced key confirmation\n\nThe in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.\n\nPackage: golang.org/x/crypto\nInstalled: v0.51.0\nFixed in: 0.52.0\nSeverity: MEDIUM\nFix: Upgrade golang.org/x/crypto to 0.52.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6fa2456892f8a46e", "name": "CVE-2026-39834: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod", "shortDescription": {"text": "CVE-2026-39834: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service due to integer overflow in SSH channel write\n\nWhen writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.\n\nPackage: golang.org/x/crypto\nInstalled: v0.51.0\nFixed in: 0.52.0\nSeverity: MEDIUM\nFix: Upgrade golang.org/x/crypto to 0.52.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8846bdeb5eaaccca", "name": "CVE-2026-46598: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod", "shortDescription": {"text": "CVE-2026-46598: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh/agent: golang: golang.org/x/crypto/ssh/agent: Denial of Service via malformed input\n\nFor certain crafted inputs, a 'ed25519.PrivateKey' was created by casting malformed wire bytes, leading to a panic when used.\n\nPackage: golang.org/x/crypto\nInstalled: v0.51.0\nFixed in: 0.52.0\nSeverity: MEDIUM\nFix: Upgrade golang.org/x/crypto to 0.52.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-39e91f6d5f16d066", "name": "CVE-2026-56855: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod", "shortDescription": {"text": "CVE-2026-56855: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages\n\nPreviously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.\n\nPackage: golang.org/x/crypto\nInstalled: v0.51.0\nFixed in: 0.56.0\nSeverity: MEDIUM\nFix: Upgrade golang.org/x/crypto to 0.56.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-213e87d52c9b38a6", "name": "CVE-2026-78662: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod", "shortDescription": {"text": "CVE-2026-78662: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via channel request flooding\n\nPreviously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.\n\nPackage: golang.org/x/crypto\nInstalled: v0.51.0\nFixed in: 0.56.0\nSeverity: MEDIUM\nFix: Upgrade golang.org/x/crypto to 0.56.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-53d0922e83763946", "name": "GO-2026-5932: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod", "shortDescription": {"text": "GO-2026-5932: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "fullDescription": {"text": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues\n\nThe golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.\n\nPackage: golang.org/x/crypto\nInstalled: v0.51.0\nFixed in: \u2014\nSeverity: UNKNOWN\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a4529f3e85973e15", "name": "CVE-2026-56854: golang.org/x/crypto v0.54.0 \u2014 cloud/go.mod", "shortDescription": {"text": "CVE-2026-56854: golang.org/x/crypto v0.54.0 \u2014 cloud/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions\n\nThe source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is \n\nPackage: golang.org/x/crypto\nInstalled: v0.54.0\nFixed in: 0.55.0\nSeverity: HIGH\nFix: Upgrade golang.org/x/crypto to 0.55.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0483a0ccefeb20d6", "name": "CVE-2026-56855: golang.org/x/crypto v0.54.0 \u2014 cloud/go.mod", "shortDescription": {"text": "CVE-2026-56855: golang.org/x/crypto v0.54.0 \u2014 cloud/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages\n\nPreviously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.\n\nPackage: golang.org/x/crypto\nInstalled: v0.54.0\nFixed in: 0.56.0\nSeverity: MEDIUM\nFix: Upgrade golang.org/x/crypto to 0.56.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-21266a6e48432871", "name": "CVE-2026-78662: golang.org/x/crypto v0.54.0 \u2014 cloud/go.mod", "shortDescription": {"text": "CVE-2026-78662: golang.org/x/crypto v0.54.0 \u2014 cloud/go.mod"}, "fullDescription": {"text": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via channel request flooding\n\nPreviously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.\n\nPackage: golang.org/x/crypto\nInstalled: v0.54.0\nFixed in: 0.56.0\nSeverity: MEDIUM\nFix: Upgrade golang.org/x/crypto to 0.56.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-925b90f9d4028ad1", "name": "GO-2026-5932: golang.org/x/crypto v0.54.0 \u2014 cloud/go.mod", "shortDescription": {"text": "GO-2026-5932: golang.org/x/crypto v0.54.0 \u2014 cloud/go.mod"}, "fullDescription": {"text": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues\n\nThe golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package.\n\nPackage: golang.org/x/crypto\nInstalled: v0.54.0\nFixed in: \u2014\nSeverity: UNKNOWN\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-291da55ea1e8a9ea", "name": "CVE-2026-104850: @modelcontextprotocol/sdk 1.30.0 \u2014 frontend/acp-runtime/package-lock.json", "shortDescription": {"text": "CVE-2026-104850: @modelcontextprotocol/sdk 1.30.0 \u2014 frontend/acp-runtime/package-lock.json"}, "fullDescription": {"text": "@modelcontextprotocol/sdk: @modelcontextprotocol/client: MCP TypeScript SDK: Information disclosure via unbound OAuth credentials\n\nMCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and prior to versions 1.31.0 and 2.2.0, the SDK's OAuth client support let the MCP server a client connected to decide which authorization server received the client's OAuth credentials. Stored and pre-provisioned credentials were not bound to the authorization server they belong to. A malicious or compromised MCP server could name its own authorization server in its prote\n\nPackage: @modelcontextprotocol/sdk\nInstalled: 1.30.0\nFixed in: 1.31.0\nSeverity: HIGH\nFix: Upgrade @modelcontextprotocol/sdk to 1.31.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9c197a8656406f8b", "name": "CVE-2026-111767: @modelcontextprotocol/sdk 1.30.0 \u2014 frontend/acp-runtime/package-lock.json", "shortDescription": {"text": "CVE-2026-111767: @modelcontextprotocol/sdk 1.30.0 \u2014 frontend/acp-runtime/package-lock.json"}, "fullDescription": {"text": "@modelcontextprotocol/sdk: @modelcontextprotocol/sdk: Unauthorized cross-session task access via taskStore\n\nMCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel each other's tasks. This issue has been patched in version 1.32.0.\n\nPackage: @modelcontextprotocol/sdk\nInstalled: 1.30.0\nFixed in: 1.32.0\nSeverity: HIGH\nFix: Upgrade @modelcontextprotocol/sdk to 1.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7ab8d38dda01ac2d", "name": "CVE-2026-111768: @modelcontextprotocol/sdk 1.30.0 \u2014 frontend/acp-runtime/package-lock.json", "shortDescription": {"text": "CVE-2026-111768: @modelcontextprotocol/sdk 1.30.0 \u2014 frontend/acp-runtime/package-lock.json"}, "fullDescription": {"text": "MCP TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation\n\n### Summary\nIn affected versions, servers put no limit on how many array elements and object keys they validated in one request. One HTTP request within the default 4 MiB size limit could exhaust the server's memory, and the process aborted with `JavaScript heap out of memory`.\n\nNo credentials are needed, unless you authenticate requests before they reach the SDK.\n\n### Am I affected?\nYes, if clients you do not fully trust can reach your server over HTTP. The risk is highest for `McpServer` tools\n\nPackage: @modelcontextprotocol/sdk\nInstalled: 1.30.0\nFixed in: 1.32.0\nSeverity: HIGH\nFix: Upgrade @modelcontextprotocol/sdk to 1.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e6a3ec701d7b9fd4", "name": "CVE-2026-111769: @modelcontextprotocol/sdk 1.30.0 \u2014 frontend/acp-runtime/package-lock.json", "shortDescription": {"text": "CVE-2026-111769: @modelcontextprotocol/sdk 1.30.0 \u2014 frontend/acp-runtime/package-lock.json"}, "fullDescription": {"text": "MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies\n\n### Summary\nIn affected versions, the SDK's HTTP client transports and OAuth requests followed redirects to any origin.\n\nIf an MCP server or authorization server redirected a request to another origin, that origin received custom request headers (such as an `X-API-Key` set in `requestInit.headers`) and the `mcp-session-id` header. On a `307` or `308` it also received the request body, including OAuth token requests with their `refresh_token` and `client_secret`.\n\nOn current runtimes `fetch` alre\n\nPackage: @modelcontextprotocol/sdk\nInstalled: 1.30.0\nFixed in: 1.32.0\nSeverity: MEDIUM\nFix: Upgrade @modelcontextprotocol/sdk to 1.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-10217ce7ff7e93e3", "name": "CVE-2026-111771: @modelcontextprotocol/sdk 1.30.0 \u2014 frontend/acp-runtime/package-lock.json", "shortDescription": {"text": "CVE-2026-111771: @modelcontextprotocol/sdk 1.30.0 \u2014 frontend/acp-runtime/package-lock.json"}, "fullDescription": {"text": "MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service\n\n### Summary\nIn affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server.\n\n### Am I affected?\nYes, if your HTTP server uses `requireBearerAuth()` or `verifyBearerToken()`, its authorization server also issues tokens for other services, and your `verifyAccessToken()` does not check\n\nPackage: @modelcontextprotocol/sdk\nInstalled: 1.30.0\nFixed in: 1.32.0\nSeverity: MEDIUM\nFix: Upgrade @modelcontextprotocol/sdk to 1.32.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27172a5f900e3314", "name": "CVE-2026-84292: fast-uri 3.1.6 \u2014 frontend/acp-runtime/package-lock.json", "shortDescription": {"text": "CVE-2026-84292: fast-uri 3.1.6 \u2014 frontend/acp-runtime/package-lock.json"}, "fullDescription": {"text": "fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization\n\nfast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are escaped but the port is concatenated verbatim, so a port value that is not a sequence of digits can inject authority delimiters, demoting the intended host to userinfo and pointing the authority at an attacker-controlled host. Both fast-uri and Node's URL read the result back as the attacker's host with no error, so re-validating the built URI does not catch\n\nPackage: fast-uri\nInstalled: 3.1.6\nFixed in: 2.4.6, 3.1.7, 4.1.4\nSeverity: HIGH\nFix: Upgrade fast-uri to 2.4.6, 3.1.7, 4.1.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4bc694944476d6b9", "name": "CVE-2026-84394: fast-uri 3.1.6 \u2014 frontend/acp-runtime/package-lock.json", "shortDescription": {"text": "CVE-2026-84394: fast-uri 3.1.6 \u2014 frontend/acp-runtime/package-lock.json"}, "fullDescription": {"text": "fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies\n\nfast-uri accepts a host that contains an unbalanced or misplaced authority bracket without reporting an error. A host that starts with an opening bracket but does not end with a closing bracket is neither validated as an IP literal nor canonicalized as a domain name, so parse() returns it as the host with error undefined, while Node's URL and the HTTP clients built on it resolve the same string to a different host. An application that reads the parsed host to make a host decision, such as an SSR\n\nPackage: fast-uri\nInstalled: 3.1.6\nFixed in: 2.4.6, 3.1.7, 4.1.4\nSeverity: HIGH\nFix: Upgrade fast-uri to 2.4.6, 3.1.7, 4.1.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-08cb8ccb160f44ab", "name": "CVE-2026-86472: fast-uri 3.1.6 \u2014 frontend/acp-runtime/package-lock.json", "shortDescription": {"text": "CVE-2026-86472: fast-uri 3.1.6 \u2014 frontend/acp-runtime/package-lock.json"}, "fullDescription": {"text": "fast-uri: fast-uri: Security bypass due to inconsistent host case normalization\n\nfast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decodes to a literal A that is never folded. For a scheme-relative reference such as //host there is no scheme, so the host canonicalization that would normally repair this does not run, and parse, normalize,\n\nPackage: fast-uri\nInstalled: 3.1.6\nFixed in: 2.4.7, 3.1.8, 4.1.5\nSeverity: MEDIUM\nFix: Upgrade fast-uri to 2.4.7, 3.1.8, 4.1.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0b6cedbe60e2f89b", "name": "CVE-2026-111757: hono 4.13.5 \u2014 frontend/acp-runtime/package-lock.json", "shortDescription": {"text": "CVE-2026-111757: hono 4.13.5 \u2014 frontend/acp-runtime/package-lock.json"}, "fullDescription": {"text": "hono: hono: Information disclosure via malformed percent-encoded paths in serveStatic\n\nHono is a Web application framework that provides support for any JavaScript runtime. From 4.12.4 until 4.13.11, serveStatic can interpret a malformed percent-encoded path differently from upstream routing middleware and bypass protection for a static prefix. The root cause is serveStatic decodes a routed request path a second time before filesystem lookup. The attack mechanism is malformed percent encoding survives the first routing interpretation and becomes a protected path only during the la\n\nPackage: hono\nInstalled: 4.13.5\nFixed in: 4.13.11\nSeverity: MEDIUM\nFix: Upgrade hono to 4.13.11"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7b8096abef8251d2", "name": "CVE-2026-93981: hono 4.13.5 \u2014 frontend/acp-runtime/package-lock.json", "shortDescription": {"text": "CVE-2026-93981: hono 4.13.5 \u2014 frontend/acp-runtime/package-lock.json"}, "fullDescription": {"text": "hono: hono/jsx: Cross-Site Scripting via Unescaped Strings\n\nhono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBoundary alongside an asynchronous sibling, as the single child of a Context.Provider, or as the root value passed to renderToString() or renderToReadableStream() from hono/jsx/dom/server. These paths stringify their input and treat the result as already-escaped markup, so an attacker who controls such a string during server-side rendering can inject arbitrary \n\nPackage: hono\nInstalled: 4.13.5\nFixed in: 4.13.7\nSeverity: MEDIUM\nFix: Upgrade hono to 4.13.7"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e278f7201207ff33", "name": "CVE-2026-101910: ip-address 10.5.0 \u2014 frontend/acp-runtime/package-lock.json", "shortDescription": {"text": "CVE-2026-101910: ip-address 10.5.0 \u2014 frontend/acp-runtime/package-lock.json"}, "fullDescription": {"text": "ip-address: ip-address: Security boundary bypass via unclassified NAT64 local-use address range\n\nip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate classifier in src/ipv6.ts does not recognize the NAT64 local-use range 64:ff9b:1::/48. Applications that combine isPrivate, isLoopback, and isLinkLocal for a trust-boundary decision can treat an internal IPv4 destination encoded through that range as external. Exploitation depends on a server network using an operator-selected NAT64 prefix within the local-\n\nPackage: ip-address\nInstalled: 10.5.0\nFixed in: 10.5.1\nSeverity: MEDIUM\nFix: Upgrade ip-address to 10.5.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ece97f0bba1c6b73", "name": "CVE-2026-101911: ip-address 10.5.0 \u2014 frontend/acp-runtime/package-lock.json", "shortDescription": {"text": "CVE-2026-101911: ip-address 10.5.0 \u2014 frontend/acp-runtime/package-lock.json"}, "fullDescription": {"text": "ip-address: ip-address: Denial of Service via unbounded IPv6 address parsing\n\nip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Address6.isValid, and parse code in src/ipv6.ts accept unbounded strings and expand invalid characters through RE_BAD_CHARACTERS into large diagnostics. Material impact occurs only when an application accepts a very large attacker-controlled field and passes it to Address6 parsing without an earlier length bound. Common URL and header limits, and common body-pars\n\nPackage: ip-address\nInstalled: 10.5.0\nFixed in: 10.7.1\nSeverity: MEDIUM\nFix: Upgrade ip-address to 10.7.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3c7110bd8372cbda", "name": "CVE-2026-101912: ip-address 10.5.0 \u2014 frontend/acp-runtime/package-lock.json", "shortDescription": {"text": "CVE-2026-101912: ip-address 10.5.0 \u2014 frontend/acp-runtime/package-lock.json"}, "fullDescription": {"text": "ip-address: ip-address: Access control bypass via cross-family subnet comparison\n\nip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubnet methods in src/common.ts compare masked binary strings without validating that both operands use the same IP family. A cross-family containment check whose leading address bits match makes the masked strings compare equal even though IPv4 and IPv6 do not share an address space. An allowlist or denylist decision can therefore classify an address outside th\n\nPackage: ip-address\nInstalled: 10.5.0\nFixed in: 10.7.1\nSeverity: MEDIUM\nFix: Upgrade ip-address to 10.7.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e17f35ca416357d7", "name": "CVE-2026-101913: ip-address 10.5.0 \u2014 frontend/acp-runtime/package-lock.json", "shortDescription": {"text": "CVE-2026-101913: ip-address 10.5.0 \u2014 frontend/acp-runtime/package-lock.json"}, "fullDescription": {"text": "ip-address: ip-address: Security bypass via incomplete IPv6 link-local address validation\n\nip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method in src/ipv6.ts recognizes only fe80::/64 instead of the complete fe80::/10 IPv6 link-local range. An attacker-controlled address elsewhere in fe80::/10 can therefore pass a trust-boundary check that relies on isLinkLocal. The same address is identified as link-local by getType and getScope, exposing the inconsistent classification. A successful bypass can r\n\nPackage: ip-address\nInstalled: 10.5.0\nFixed in: 10.5.1\nSeverity: MEDIUM\nFix: Upgrade ip-address to 10.5.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c5b4dc46c8ba2243", "name": "CVE-2026-90711: proxy-addr 2.0.7 \u2014 frontend/acp-runtime/package-lock.json", "shortDescription": {"text": "CVE-2026-90711: proxy-addr 2.0.7 \u2014 frontend/acp-runtime/package-lock.json"}, "fullDescription": {"text": "proxy-addr: proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet\n\nproxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and req.ips. In versions 1.1.0 through 2.0.7, a trust subnet written in IPv4-mapped IPv6 notation with an IPv4-sized prefix, such as ::ffff:10.0.0.0/8 instead of the correct ::ffff:10.0.0.0/104, is accepted without error but trusts every IPv4 address on the internet rather than the block it names. Because the socket peer then becomes trusted at hop 0, any unauthen\n\nPackage: proxy-addr\nInstalled: 2.0.7\nFixed in: 2.0.8\nSeverity: CRITICAL\nFix: Upgrade proxy-addr to 2.0.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-7e488ec134e7a320", "name": "CVE-2026-82417: qs 6.15.3 \u2014 frontend/acp-runtime/package-lock.json", "shortDescription": {"text": "CVE-2026-82417: qs 6.15.3 \u2014 frontend/acp-runtime/package-lock.json"}, "fullDescription": {"text": "qs: qs: Denial of Service via improper validation in stringify function\n\n### Summary\n\n\n\n`qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable `isBuffer` member. `utils.isBuffer` duck-types buffers by calling `obj.constructor.isBuffer(obj)` after checking only that the property is truthy, so a value such as `{ constructor: { isBuffer: \"x\" } }` makes the call throw `TypeError: obj.constructor.isBuffer is not a function`.\n\n\n\n### Details\n\n\n\n`lib/stringify.js:127` calls `utils.isBuffer` on every non-pr\n\nPackage: qs\nInstalled: 6.15.3\nFixed in: 6.16.0\nSeverity: MEDIUM\nFix: Upgrade qs to 6.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-15f8a14152a6e940", "name": "CVE-2026-82562: qs 6.15.3 \u2014 frontend/acp-runtime/package-lock.json", "shortDescription": {"text": "CVE-2026-82562: qs 6.15.3 \u2014 frontend/acp-runtime/package-lock.json"}, "fullDescription": {"text": "qs: qs: Denial of Service via array limit bypass in query string parsing\n\n### Summary\n\n\n\nWhen `qs.parse` is called with `comma: true` and `throwOnLimitExceeded: true`, a comma-separated value under a bracket-push key (`a[]=1,2,3,4`) is split into an array without being compared against `arrayLimit`, while the same value under a flat key (`a=1,2,3,4`), an indexed key (`a[0]=`), a nested key (`a[b]=`), or a dotted key (`a.b=` with `allowDots`) throws the documented `RangeError`. A single parameter such as `a[]=1,2,2,...` therefore produces an inner array of arbitrary le\n\nPackage: qs\nInstalled: 6.15.3\nFixed in: 6.16.0\nSeverity: MEDIUM\nFix: Upgrade qs to 6.16.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f9fbfe0dc2bf231a", "name": "CVE-2026-102276: brace-expansion 1.1.15 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-102276: brace-expansion 1.1.15 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array trigger\n\nPackage: brace-expansion\nInstalled: 1.1.15\nFixed in: 5.0.10, 3.0.7, 2.1.5, 1.1.19\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.10, 3.0.7, 2.1.5, 1.1.19"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8dbb3c200dcfab17", "name": "CVE-2026-102278: brace-expansion 1.1.15 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-102278: brace-expansion 1.1.15 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied a\n\nPackage: brace-expansion\nInstalled: 1.1.15\nFixed in: 5.0.11, 3.0.8, 2.1.6, 1.1.20\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.11, 3.0.8, 2.1.6, 1.1.20"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0fad124590577689", "name": "CVE-2026-13149: brace-expansion 1.1.15 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-13149: brace-expansion 1.1.15 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity\n\nbrace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.\n\nPackage: brace-expansion\nInstalled: 1.1.15\nFixed in: 5.0.7, 1.1.16, 2.1.2\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.7, 1.1.16, 2.1.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-810431c46b2b9cc1", "name": "CVE-2026-14257: brace-expansion 1.1.15 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-14257: brace-expansion 1.1.15 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "brace-expansion: Brace-expansion: Denial of Service via memory exhaustion in expand() function\n\nbrace-expansion through 5.0.7 is vulnerable to denial of service via memory exhaustion. The expand() function limits the number of results with a max option (default 100,000) but does not bound the length of each result string. By chaining multiple brace groups, an attacker keeps the result count under the limit while making each result progressively longer, so total memory scales with both count and string length until the process hits a fatal, uncatchable out-of-memory error. About 7.5 KB of i\n\nPackage: brace-expansion\nInstalled: 1.1.15\nFixed in: 5.0.8, 3.0.3, 2.1.3, 1.1.17\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.8, 3.0.3, 2.1.3, 1.1.17"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-00469d75f7b7e3c0", "name": "CVE-2026-69152: brace-expansion 1.1.15 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-69152: brace-expansion 1.1.15 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.\n\nPackage: brace-expansion\nInstalled: 1.1.15\nFixed in: 1.1.18, 2.1.4, 3.0.6, 5.0.9\nSeverity: HIGH\nFix: Upgrade brace-expansion to 1.1.18, 2.1.4, 3.0.6, 5.0.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a13e0c555b1ed992", "name": "CVE-2026-102277: brace-expansion 1.1.15 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-102277: brace-expansion 1.1.15 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service via crafted brace patterns\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a r\n\nPackage: brace-expansion\nInstalled: 1.1.15\nFixed in: 5.0.12, 3.0.9, 2.1.7, 1.1.21\nSeverity: MEDIUM\nFix: Upgrade brace-expansion to 5.0.12, 3.0.9, 2.1.7, 1.1.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5f16dcdf33a036bf", "name": "GHSA-6688-9rhm-gjv2: dompurify 3.4.14 \u2014 frontend/package-lock.json", "shortDescription": {"text": "GHSA-6688-9rhm-gjv2: dompurify 3.4.14 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "DOMPurify: IN_PLACE returns a force-removed rawtext root whose text carries attacker markup \u2014 pure HTML reparse executes\n\n## Environment\n\n- dompurify 3.4.15 (current npm release); reproduced independently on jsdom 30.0.1 and 29.1.1 (Node.js 20.x / 26.x)\n- Config: `DOMPurify.sanitize(node, { IN_PLACE: true })` on a Node input; `SAFE_FOR_XML` at its default (`true`)\n\n## Summary\n\nThe 3.4.9 fix for the IN_PLACE detached-root class added two protections on the IN_PLACE return path: a fail-closed `TypeError` in `_forceRemove` when a node selected for removal cannot be detached, and a `_neutralizeSubtree` pass (`dist/puri\n\nPackage: dompurify\nInstalled: 3.4.14\nFixed in: 3.4.16\nSeverity: LOW\nFix: Upgrade dompurify to 3.4.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be98f72722d74cd9", "name": "GHSA-p98j-92pf-mc4p: dompurify 3.4.14 \u2014 frontend/package-lock.json", "shortDescription": {"text": "GHSA-p98j-92pf-mc4p: dompurify 3.4.14 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS\n\n## Summary\n\nIn `IN_PLACE` mode DOMPurify sanitizes the caller's live DOM subtree directly. To close a known hazard (GHSA-55q2-fjhq-7xh7), the library neutralizes any node a hook detaches during sanitization by stripping its subtree's non-allow-listed attributes, but this neutralization is wired only into the `beforeSanitizeElements` and `uponSanitizeElement` hook sites. An `afterSanitizeElements` or `afterSanitizeAttributes` hook that removes a non-root element (a documented, supported pattern) \n\nPackage: dompurify\nInstalled: 3.4.14\nFixed in: 3.4.16\nSeverity: LOW\nFix: Upgrade dompurify to 3.4.16"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-431d8b6ba442560b", "name": "CVE-2026-45820: fflate 0.4.8 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-45820: fflate 0.4.8 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "fflate: fflate: Denial of Service via crafted ZIP archives\n\nfflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring compressed_size=0xFFFFFFFF (ZIP64 sentinel) but missing the required ZIP64 extra field tag 0x0001 causes z64e() to loop indefinitely due to out-of-bounds reads returning undefined, which coerces to 0, keeping the loop condition permanently true.\n\nPackage: fflate\nInstalled: 0.4.8\nFixed in: 0.4.9, 0.5.4, 0.6.11, 0.7.5, 0.8.3\nSeverity: MEDIUM\nFix: Upgrade fflate to 0.4.9, 0.5.4, 0.6.11, 0.7.5, 0.8.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4c2cef1864fbbab7", "name": "CVE-2026-59869: js-yaml 4.2.0 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-59869: js-yaml 4.2.0 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "js-yaml: js-yaml: Denial of Service via crafted YAML documents\n\njs-yaml is a JavaScript YAML parser and dumper. From 3.0.0 before 3.15.0 and from 4.0.0 before 4.3.0, js-yaml can spend quadratic CPU time parsing a document whose size grows only linearly when a chain of mappings uses merge keys where each mapping merges the previous one. This issue is fixed in versions 3.15.0 and 4.3.0.\n\nPackage: js-yaml\nInstalled: 4.2.0\nFixed in: 3.15.0, 4.3.0\nSeverity: HIGH\nFix: Upgrade js-yaml to 3.15.0, 4.3.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-78efb48e2aa68c70", "name": "CVE-2026-84375: js-yaml 4.2.0 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-84375: js-yaml 4.2.0 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing\n\njs-yaml is a JavaScript YAML parser and dumper. From 3.0.0 until 3.15.2, 4.3.2, and 5.4.1, maxTotalMergeKeys in lib/js-yaml/loader.js and lib/loader.js does not count empty mapping sources while processing the merge key <<. An attacker can alias a large sequence of empty mappings into many merge targets, causing O(N * K) processing while totalMergeKeys remains unchanged and the configured resource limit is never reached. A relatively small YAML document can therefore cause prolonged CPU consumpt\n\nPackage: js-yaml\nInstalled: 4.2.0\nFixed in: 4.3.2, 3.15.2\nSeverity: HIGH\nFix: Upgrade js-yaml to 4.3.2, 3.15.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-19ff5bf354bcc374", "name": "GHSA-5p4m-2wfm-xmqj: js-yaml 4.2.0 \u2014 frontend/package-lock.json", "shortDescription": {"text": "GHSA-5p4m-2wfm-xmqj: js-yaml 4.2.0 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) \u2014 CVE-2026-59870 fix not backported\n\n# Quadratic CPU consumption in `!!omap` resolution (js-yaml 3.x and 4.x)\n\n## Summary\n\n`resolveYamlOmap()` enforces key uniqueness for `!!omap` sequences with a linear\nscan (`objectKeys.indexOf(...)`) inside the per-element loop, making resolution\n**O(n\u00b2)** in the number of entries. A modestly sized YAML document therefore\nconsumes disproportionate CPU inside `yaml.load()`, giving a denial of service\nagainst any consumer that parses untrusted YAML.\n\n`!!omap` is registered in the **default schema*\n\nPackage: js-yaml\nInstalled: 4.2.0\nFixed in: 4.3.1, 3.15.1\nSeverity: HIGH\nFix: Upgrade js-yaml to 4.3.1, 3.15.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-72c1ea1b378fa792", "name": "CVE-2026-103923: katex 0.16.47 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-103923: katex 0.16.47 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "katex: katex: Cross-site scripting via prototype pollution inheritance\n\nKaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration, allowing inherited properties to be treated as explicitly supplied values. When Object.prototype is already polluted or an attacker controls the options object's prototype, attacker-controlled mathematical ex\n\nPackage: katex\nInstalled: 0.16.47\nFixed in: 0.18.2\nSeverity: LOW\nFix: Upgrade katex to 0.18.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-335ec22c74c42d35", "name": "CVE-2026-104846: seroval 1.5.4 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-104846: seroval 1.5.4 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "seroval: Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)\n\nSeroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenable assimilation then invokes the callable unexpectedly, allowing attacker-controlled JSON to trigger code in applications using plugin-capable Seroval releases. This path bypasses the Promise resolver ty\n\nPackage: seroval\nInstalled: 1.5.4\nFixed in: 1.6.2\nSeverity: CRITICAL\nFix: Upgrade seroval to 1.6.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-e246572371104fd6", "name": "CVE-2026-104845: seroval 1.5.4 \u2014 frontend/package-lock.json", "shortDescription": {"text": "CVE-2026-104845: seroval 1.5.4 \u2014 frontend/package-lock.json"}, "fullDescription": {"text": "seroval: seroval: Denial of Service via unbounded memory allocation during deserialization\n\nSeroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.3, deserializeTypedArray in fromJSON and fromCrossJSON trusts a deserialized source value as an ArrayBuffer and does not bound the serialized element count. An attacker can provide a small untrusted JSON object with a large length value, causing the array-like TypedArray constructor to synchronously allocate the selected number of elements and exhaust CPU or memory while st\n\nPackage: seroval\nInstalled: 1.5.4\nFixed in: 1.6.3\nSeverity: HIGH\nFix: Upgrade seroval to 1.6.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-68d57f608e6db8c8", "name": "CVE-2026-102276: brace-expansion 5.0.8 \u2014 frontend/src/docs/package-lock.json", "shortDescription": {"text": "CVE-2026-102276: brace-expansion 5.0.8 \u2014 frontend/src/docs/package-lock.json"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array trigger\n\nPackage: brace-expansion\nInstalled: 5.0.8\nFixed in: 5.0.10, 3.0.7, 2.1.5, 1.1.19\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.10, 3.0.7, 2.1.5, 1.1.19"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2577194b99ccc442", "name": "CVE-2026-102278: brace-expansion 5.0.8 \u2014 frontend/src/docs/package-lock.json", "shortDescription": {"text": "CVE-2026-102278: brace-expansion 5.0.8 \u2014 frontend/src/docs/package-lock.json"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied a\n\nPackage: brace-expansion\nInstalled: 5.0.8\nFixed in: 5.0.11, 3.0.8, 2.1.6, 1.1.20\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.11, 3.0.8, 2.1.6, 1.1.20"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-843a384a28763e10", "name": "CVE-2026-69152: brace-expansion 5.0.8 \u2014 frontend/src/docs/package-lock.json", "shortDescription": {"text": "CVE-2026-69152: brace-expansion 5.0.8 \u2014 frontend/src/docs/package-lock.json"}, "fullDescription": {"text": "brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9, expand() does not apply maxLength while constructing comma-alternative intermediate arrays or padded sequences, allowing attacker-controlled input to exhaust memory or block the event loop. The fix for CVE-2026-14257 is bypassed by the vulnerability. This issue is fixed in versions 1.1.18, 2.1.4, 3.0.6, and 5.0.9.\n\nPackage: brace-expansion\nInstalled: 5.0.8\nFixed in: 1.1.18, 2.1.4, 3.0.6, 5.0.9\nSeverity: HIGH\nFix: Upgrade brace-expansion to 1.1.18, 2.1.4, 3.0.6, 5.0.9"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1b0eed3ac43fb54e", "name": "CVE-2026-102277: brace-expansion 5.0.8 \u2014 frontend/src/docs/package-lock.json", "shortDescription": {"text": "CVE-2026-102277: brace-expansion 5.0.8 \u2014 frontend/src/docs/package-lock.json"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service via crafted brace patterns\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a r\n\nPackage: brace-expansion\nInstalled: 5.0.8\nFixed in: 5.0.12, 3.0.9, 2.1.7, 1.1.21\nSeverity: MEDIUM\nFix: Upgrade brace-expansion to 5.0.12, 3.0.9, 2.1.7, 1.1.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-5e2894d488148107", "name": "CVE-2025-71329: image-size 2.0.2 \u2014 frontend/src/docs/package-lock.json", "shortDescription": {"text": "CVE-2025-71329: image-size 2.0.2 \u2014 frontend/src/docs/package-lock.json"}, "fullDescription": {"text": "image-size: image-size: Denial of Service via crafted image buffer with zero-valued size field\n\nimage-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted image buffer with a zero-valued size field in a recognized box-type. Attackers can trigger an infinite loop in the JXL or HEIF image parsers by providing a crafted image containing a box with a size of zero, causing the offset to never advance and permanently hanging the application.\n\nPackage: image-size\nInstalled: 2.0.2\nFixed in: 2.0.3\nSeverity: HIGH\nFix: Upgrade image-size to 2.0.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c90e9f63c0032c04", "name": "CVE-2025-71330: image-size 2.0.2 \u2014 frontend/src/docs/package-lock.json", "shortDescription": {"text": "CVE-2025-71330: image-size 2.0.2 \u2014 frontend/src/docs/package-lock.json"}, "fullDescription": {"text": "image-size: image-size: Denial of Service via crafted ICNS image buffer\n\nimage-size through 2.0.2 contains a denial of service vulnerability that allows remote attackers to permanently block the Node.js event loop by supplying a specially crafted ICNS image buffer. Attackers can craft an ICNS buffer containing valid magic bytes and a zero-valued entry length field to trigger an infinite loop in the ICNS parser, as the offset is never incremented when the entry length field is 0, causing the while loop condition to remain true indefinitely.\n\nPackage: image-size\nInstalled: 2.0.2\nFixed in: 2.0.3\nSeverity: HIGH\nFix: Upgrade image-size to 2.0.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-60fe8ba83b09c6b6", "name": "CVE-2026-103923: katex 0.18.1 \u2014 frontend/src/docs/package-lock.json", "shortDescription": {"text": "CVE-2026-103923: katex 0.18.1 \u2014 frontend/src/docs/package-lock.json"}, "fullDescription": {"text": "katex: katex: Cross-site scripting via prototype pollution inheritance\n\nKaTeX is a fast, easy-to-use JavaScript library for TeX math rendering on the web. From 0.11.0 until 0.18.2, KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration, allowing inherited properties to be treated as explicitly supplied values. When Object.prototype is already polluted or an attacker controls the options object's prototype, attacker-controlled mathematical ex\n\nPackage: katex\nInstalled: 0.18.1\nFixed in: 0.18.2\nSeverity: LOW\nFix: Upgrade katex to 0.18.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b80b65646ce417aa", "name": "CVE-2026-67213: nanoid 3.3.16 \u2014 frontend/src/docs/package-lock.json", "shortDescription": {"text": "CVE-2026-67213: nanoid 3.3.16 \u2014 frontend/src/docs/package-lock.json"}, "fullDescription": {"text": "nanoid: nanoid: Denial of Service via infinite loop in random ID generation\n\nnanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.\n\nPackage: nanoid\nInstalled: 3.3.16\nFixed in: 3.3.18, 5.1.6\nSeverity: HIGH\nFix: Upgrade nanoid to 3.3.18, 5.1.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4b2dc1eb3b760539", "name": "CVE-2026-75604: next 16.2.11 \u2014 frontend/src/docs/package-lock.json", "shortDescription": {"text": "CVE-2026-75604: next 16.2.11 \u2014 frontend/src/docs/package-lock.json"}, "fullDescription": {"text": "next: Next.js: Unauthenticated Remote Code Execution on windows-hosted servers\n\nNext.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing incremental-cache paths. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts, a remote request can supply encoded Wind\n\nPackage: next\nInstalled: 16.2.11\nFixed in: 15.5.24, 16.3.3\nSeverity: CRITICAL\nFix: Upgrade next to 15.5.24, 16.3.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-b6d673a6e68a305b", "name": "GHSA-2xp9-vwfh-vxw4: next 16.2.11 \u2014 frontend/src/docs/package-lock.json", "shortDescription": {"text": "GHSA-2xp9-vwfh-vxw4: next 16.2.11 \u2014 frontend/src/docs/package-lock.json"}, "fullDescription": {"text": "Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used\n\nA vulnerability in the underlying `libheif` library used by `sharp` which Next.js uses for image optimization can lead to remote code execution when AVIF files are optimized.\n\nUntil a fix has propagated, optimization of AVIF files is disabled.\n\nPackage: next\nInstalled: 16.2.11\nFixed in: 15.5.24, 16.3.3\nSeverity: CRITICAL\nFix: Upgrade next to 15.5.24, 16.3.3"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-c2c4315b8a9370f7", "name": "GHSA-vcvr-r3jv-pc5j: next 16.2.11 \u2014 frontend/src/docs/package-lock.json", "shortDescription": {"text": "GHSA-vcvr-r3jv-pc5j: next 16.2.11 \u2014 frontend/src/docs/package-lock.json"}, "fullDescription": {"text": "Next.js: Remote Code Execution in next/og ImageResponse\n\n## Impact\n\nThe Node.js `ImageResponse` implementation from `next/og` is affected by an upstream vulnerability. This can lead to remote code execution.\n\nAffected applications pass attacker-controlled values into SVG content, attributes, or styles during image generation:\n\n```tsx\nimport { ImageResponse } from 'next/og'\n\nexport async function GET(request: Request) {\n  const value = new URL(request.url).searchParams.get('value') ?? ''\n\n  return new ImageResponse(\n    <svg width=\"1200\" height=\"630\">\n\n\nPackage: next\nInstalled: 16.2.11\nFixed in: 16.3.6\nSeverity: CRITICAL\nFix: Upgrade next to 16.3.6"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-0e23ae98f67deb01", "name": "CVE-2026-94483: next 16.2.11 \u2014 frontend/src/docs/package-lock.json", "shortDescription": {"text": "CVE-2026-94483: next 16.2.11 \u2014 frontend/src/docs/package-lock.json"}, "fullDescription": {"text": "next: Next.js: Information disclosure via SSRF in Image Optimization\n\nNext.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-controlled DNS resolution for a remote URL that matches images.remotePatterns, allowing the optimized image fetch to reach private IP addresses after the URL passes the allow-list check. Applications without images.remotePatterns are not affected. Administrators unable to upgrade should audit allow-listed hosts and avoid entries whose DNS records are not trusted\n\nPackage: next\nInstalled: 16.2.11\nFixed in: 16.3.8\nSeverity: HIGH\nFix: Upgrade next to 16.3.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4df3fc2c5e37c94a", "name": "CVE-2026-94484: next 16.2.11 \u2014 frontend/src/docs/package-lock.json", "shortDescription": {"text": "CVE-2026-94484: next 16.2.11 \u2014 frontend/src/docs/package-lock.json"}, "fullDescription": {"text": "next: Next.js: Denial of Service via response cache poisoning\n\nNext.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level catch-all page and statically generated or Incremental Static Regeneration routes can use a shared response cache key that is insufficiently scoped to the source route. A single unauthenticated crafted request can poison that cache, causing cross-user content substitution or persistent denial of service until the poisoned entry is revalidated or replaced. Th\n\nPackage: next\nInstalled: 16.2.11\nFixed in: 16.3.8, 15.5.27\nSeverity: MEDIUM\nFix: Upgrade next to 16.3.8, 15.5.27"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f72db35c3868ced8", "name": "CVE-2026-94485: next 16.2.11 \u2014 frontend/src/docs/package-lock.json", "shortDescription": {"text": "CVE-2026-94485: next 16.2.11 \u2014 frontend/src/docs/package-lock.json"}, "fullDescription": {"text": "next: Next.js: Information disclosure via unrestricted cross-site requests on development server\n\nNext.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev` development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.\n\nPackage: next\nInstalled: 16.2.11\nFixed in: 16.3.8\nSeverity: MEDIUM\nFix: Upgrade next to 16.3.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d01d7e6228611282", "name": "CVE-2026-94543: next 16.2.11 \u2014 frontend/src/docs/package-lock.json", "shortDescription": {"text": "CVE-2026-94543: next 16.2.11 \u2014 frontend/src/docs/package-lock.json"}, "fullDescription": {"text": "next: Next.js: Response cache poisoning via improper route binding\n\nNext.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using the Pages Router with statically generated or Incremental Static Regeneration pages can key a response cache entry without sufficiently binding it to the source route. A request can replace one page's cache entry with content from a different route, causing the affected page to serve incorrect content to every visitor until revalidation. Applications deploye\n\nPackage: next\nInstalled: 16.2.11\nFixed in: 15.5.27, 16.3.8\nSeverity: MEDIUM\nFix: Upgrade next to 15.5.27, 16.3.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-270f3a826528455a", "name": "CVE-2026-94486: next 16.2.11 \u2014 frontend/src/docs/package-lock.json", "shortDescription": {"text": "CVE-2026-94486: next 16.2.11 \u2014 frontend/src/docs/package-lock.json"}, "fullDescription": {"text": "next: Next.js: Information disclosure via unrestricted cross-site requests\n\nNext.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a developer can reach the endpoint and read the project's disk location, source code snippets from error reports, route inventory, and development logs. Production deployments do not serve this endpoint. This issue is fixed in version 16.3.8.\n\nPackage: next\nInstalled: 16.2.11\nFixed in: 16.3.8\nSeverity: LOW\nFix: Upgrade next to 16.3.8"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c1cea267a160f24", "name": "CVE-2026-45623: postcss 8.4.31 \u2014 frontend/src/docs/package-lock.json", "shortDescription": {"text": "CVE-2026-45623: postcss 8.4.31 \u2014 frontend/src/docs/package-lock.json"}, "fullDescription": {"text": "postcss: PostCSS: Information disclosure and denial of service via crafted CSS input\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. In versions 8.5.11 and prior, the PreviousMap parses the /*# sourceMappingURL=PATH */ comment from any CSS string passed to process() and dereferences PATH against the local filesystem with no scheme, allowlist, or traversal check. An attacker who controls the CSS input can cause the host process to read any file readable by Node and leak the first ~10 bytes of its\n\nPackage: postcss\nInstalled: 8.4.31\nFixed in: 8.5.12\nSeverity: HIGH\nFix: Upgrade postcss to 8.5.12"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-236c6e996a429d32", "name": "CVE-2026-73646: postcss 8.4.31 \u2014 frontend/src/docs/package-lock.json", "shortDescription": {"text": "CVE-2026-73646: postcss 8.4.31 \u2014 frontend/src/docs/package-lock.json"}, "fullDescription": {"text": "postcss: PostCSS: Information disclosure via path traversal in source map auto-loading\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap() passes attacker-controlled sourceMappingURL values to join(dirname(opts.from), annotation), and loadFile() permits traversed or absolute .map paths, allowing untrusted CSS processed without map: false to disclose sourcesContent from arbitrary reachable .map files through result.map. This issue is fixed in version 8.5.1\n\nPackage: postcss\nInstalled: 8.4.31\nFixed in: 8.5.18\nSeverity: HIGH\nFix: Upgrade postcss to 8.5.18"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cd570d83531d8fb4", "name": "CVE-2026-41305: postcss 8.4.31 \u2014 frontend/src/docs/package-lock.json", "shortDescription": {"text": "CVE-2026-41305: postcss 8.4.31 \u2014 frontend/src/docs/package-lock.json"}, "fullDescription": {"text": "postcss: PostCSS: Cross-Site Scripting (XSS) via improper escaping of style closing tags\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Versions prior to 8.5.10 do not escape `</style>` sequences when stringifying CSS ASTs. When user-submitted CSS is parsed and re-stringified for embedding in HTML `<style>` tags, `</style>` in CSS values breaks out of the style context, enabling XSS. Version 8.5.10 fixes the issue.\n\nPackage: postcss\nInstalled: 8.4.31\nFixed in: 8.5.10\nSeverity: MEDIUM\nFix: Upgrade postcss to 8.5.10"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-86b7136815586b5b", "name": "CVE-2026-69153: postcss 8.4.31 \u2014 frontend/src/docs/package-lock.json", "shortDescription": {"text": "CVE-2026-69153: postcss 8.4.31 \u2014 frontend/src/docs/package-lock.json"}, "fullDescription": {"text": "postcss: PostCSS: Information disclosure via crafted sourceMappingURL\n\nPostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.19, if from is unset, an attacker can cause PreviousMap.loadFile() to read an unintended source-map file by supplying an absolute or directory-traversal sourceMappingURL. The resulting map\u2019s sources and sourcesContent may then be exposed to the application. This issue is fixed in version 8.5.19.\n\nPackage: postcss\nInstalled: 8.4.31\nFixed in: 8.5.23\nSeverity: MEDIUM\nFix: Upgrade postcss to 8.5.23"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-43e9d2a24a437c8d", "name": "GHSA-f88m-g3jw-g9cj: sharp 0.34.5 \u2014 frontend/src/docs/package-lock.json", "shortDescription": {"text": "GHSA-f88m-g3jw-g9cj: sharp 0.34.5 \u2014 frontend/src/docs/package-lock.json"}, "fullDescription": {"text": "sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591\n\n### Impact\n\nA number of vulnerabilities, two rated as \"High\" severity using CVSSv4, have been discovered and fixed in the upstream libvips dependency.\n\nThose processing untrusted input with versions of sharp prior to 0.35.0 are affected.\n\n### Patches\n\n#### Using prebuilt binaries provided by sharp?\n\nMost people rely on the prebuilt binaries provided by sharp.\n\nPlease upgrade sharp to the latest version, currently 0.35.3, which provides libvips 8.18.3.\n\n#### Using a globally-installed libvips?\n\nP\n\nPackage: sharp\nInstalled: 0.34.5\nFixed in: 0.35.0\nSeverity: HIGH\nFix: Upgrade sharp to 0.35.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-be8591bfe241726b", "name": "GHSA-rgj7-g3m4-5g8c: sharp 0.34.5 \u2014 frontend/src/docs/package-lock.json", "shortDescription": {"text": "GHSA-rgj7-g3m4-5g8c: sharp 0.34.5 \u2014 frontend/src/docs/package-lock.json"}, "fullDescription": {"text": "sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545\n\n### Impact\nA number of vulnerabilities, two rated as \"Critical\" severity using CVSSv3, have been discovered and fixed in the upstream libheif dependency. These can lead to possible remote code execution (RCE) on glibc-based Linux when run under certain conditions.\n\nThe attack vector for these claims to be \"network\" however sharp does not provide any networking features so this vulnerability is down-rated to a \"High\" severity using CVSSv4 but please note its Subsequent System Impact.\n\nThose proce\n\nPackage: sharp\nInstalled: 0.34.5\nFixed in: 0.35.4\nSeverity: HIGH\nFix: Upgrade sharp to 0.35.4"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5b9e9bde7657f9b0", "name": "GHSA-wq5f-xc86-pv6w: sharp 0.34.5 \u2014 frontend/src/docs/package-lock.json", "shortDescription": {"text": "GHSA-wq5f-xc86-pv6w: sharp 0.34.5 \u2014 frontend/src/docs/package-lock.json"}, "fullDescription": {"text": "sharp : Vulnerability in librsvg dependency CVE-2026-96889\n\n### Impact\n\nA memory-related vulnerability has been discovered and fixed in the upstream librsvg dependency. When certain runtime-specific conditions apply, this vulnerability can lead to possible remote code execution (RCE) on glibc-based Linux.\n\n### Patches\n\n#### Using prebuilt binaries provided by sharp?\n\nMost people rely on the prebuilt binaries provided by sharp.\n\nPlease upgrade sharp to the latest version, currently 0.35.5, which provides librsvg 2.63.2.\n\n#### Using a globally-installed li\n\nPackage: sharp\nInstalled: 0.34.5\nFixed in: 0.35.5\nSeverity: HIGH\nFix: Upgrade sharp to 0.35.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bce566c304796077", "name": "CVE-2026-93749: source-map-js 1.2.1 \u2014 frontend/src/docs/package-lock.json", "shortDescription": {"text": "CVE-2026-93749: source-map-js 1.2.1 \u2014 frontend/src/docs/package-lock.json"}, "fullDescription": {"text": "source-map-js: source-map-js: Denial of Service via malformed indexed source maps\n\nsource-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.\n\nPackage: source-map-js\nInstalled: 1.2.1\nFixed in: 1.2.2\nSeverity: HIGH\nFix: Upgrade source-map-js to 1.2.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9459a7ff0e1c14c5", "name": "CVE-2026-102276: brace-expansion 5.0.9 \u2014 packages/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-102276: brace-expansion 5.0.9 \u2014 packages/mobile/package-lock.json"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, crafted brace patterns can exhaust the native stack in parseCommaParts because parseCommaParts recursively processes the remainder once per brace group and uses push.apply to pass every element of a very large comma-part array as a function argument. Patterns containing many comma-separated brace groups trigger the recursive path, while the large array trigger\n\nPackage: brace-expansion\nInstalled: 5.0.9\nFixed in: 5.0.10, 3.0.7, 2.1.5, 1.1.19\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.10, 3.0.7, 2.1.5, 1.1.19"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-13a6b7c921c0e760", "name": "CVE-2026-102278: brace-expansion 5.0.9 \u2014 packages/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-102278: brace-expansion 5.0.9 \u2014 packages/mobile/package-lock.json"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, deeply nested brace groups cause expand_() to recurse once per nesting level at comma-member and single-set expansion sites, exhausting the native stack before output limits can apply and potentially terminating the Node.js process. expand_ performs uncontrolled recursion for nested brace alternatives and single-part sets. deeply nested brace groups supplied a\n\nPackage: brace-expansion\nInstalled: 5.0.9\nFixed in: 5.0.11, 3.0.8, 2.1.6, 1.1.20\nSeverity: HIGH\nFix: Upgrade brace-expansion to 5.0.11, 3.0.8, 2.1.6, 1.1.20"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2fd67f314f4b8d75", "name": "CVE-2026-102277: brace-expansion 5.0.9 \u2014 packages/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-102277: brace-expansion 5.0.9 \u2014 packages/mobile/package-lock.json"}, "fullDescription": {"text": "brace-expansion: brace-expansion: Denial of Service via crafted brace patterns\n\nThe brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, the expand function handles untrusted {a},b}-shaped patterns with many trailing closing braces by restarting its scan once for each trailing closing brace. The successive full-input rescans with linear working-string growth cause quadratic CPU time and memory pressure that can block the Node.js event loop. The process eventually recovers, making the impact a r\n\nPackage: brace-expansion\nInstalled: 5.0.9\nFixed in: 5.0.12, 3.0.9, 2.1.7, 1.1.21\nSeverity: MEDIUM\nFix: Upgrade brace-expansion to 5.0.12, 3.0.9, 2.1.7, 1.1.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-32f6f5ba198c9b0c", "name": "CVE-2026-93687: braces 3.0.3 \u2014 packages/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-93687: braces 3.0.3 \u2014 packages/mobile/package-lock.json"}, "fullDescription": {"text": "braces: braces: Denial of Service via Stack Overflow from Deeply Nested Patterns\n\nbraces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.\n\nPackage: braces\nInstalled: 3.0.3\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-054c77d63c740554", "name": "CVE-2026-87776: compression 1.8.1 \u2014 packages/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-87776: compression 1.8.1 \u2014 packages/mobile/package-lock.json"}, "fullDescription": {"text": "compression: compression: Denial of Service via memory leak on premature response close\n\ncompression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compressed response is still being sent, the zlib stream created to compress that response is never destroyed, so each aborted compressed response leaks its native zlib memory. A remote unauthenticated attacker can repeatedly open requests and disconnect early, exhausting the available memory and crashing the server. All applications using compression are affected. T\n\nPackage: compression\nInstalled: 1.8.1\nFixed in: 1.8.2\nSeverity: HIGH\nFix: Upgrade compression to 1.8.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9fb4a90ae923f6aa", "name": "CVE-2026-45822: decode-uri-component 0.2.2 \u2014 packages/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-45822: decode-uri-component 0.2.2 \u2014 packages/mobile/package-lock.json"}, "fullDescription": {"text": "decode-uri-component: decode-uri-component: Denial of Service via crafted input\n\ndecode-uri-component through 0.4.1 is vulnerable to denial of service. The decode() function splits input on '%' producing N tokens and calls decodeComponents(), exhibiting super-linear parsing time: 200 '%ab' tokens takes approximately 0.7s, 700 tokens approximately 6s, and 1400 tokens approximately 33s. An attacker can cause significant CPU consumption and event-loop blocking via crafted input.\n\nPackage: decode-uri-component\nInstalled: 0.2.2\nFixed in: 0.5.0\nSeverity: MEDIUM\nFix: Upgrade decode-uri-component to 0.5.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a92b6dbb48e51062", "name": "CVE-2026-85393: node-forge 1.4.0 \u2014 packages/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-85393: node-forge 1.4.0 \u2014 packages/mobile/package-lock.json"}, "fullDescription": {"text": "node-forge: node-forge: Signature forgery vulnerability in RSA PKCS#1 v1.5 verification\n\nnode-forge through 1.4.0 fails to validate element count in nested DigestAlgorithm sequences during RSA PKCS#1 v1.5 signature verification. Attackers can embed garbage bytes inside the DigestAlgorithm sequence to forge valid signatures for arbitrary messages using low-exponent RSA keys. This is an incomplete fix for CVE-2026-33894.\n\nPackage: node-forge\nInstalled: 1.4.0\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e35886ed7ff5e5fe", "name": "CVE-2026-102422: shell-quote 1.10.0 \u2014 packages/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-102422: shell-quote 1.10.0 \u2014 packages/mobile/package-lock.json"}, "fullDescription": {"text": "shell-quote: shell-quote: Arbitrary command execution via improper line terminator handling\n\nshell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator (\\n, \\r, U+2028, U+2029) in that later string therefore ends the comment, and the rest of the string is parsed as shell input: `quote(['echo', 'ok', { comment: 'x' }, 'a\\nid;#'])` runs `id` in sh, bash, dash, ksh and zsh. `parse()` emits a comment token for a `#` in the middle of a word (f\n\nPackage: shell-quote\nInstalled: 1.10.0\nFixed in: 1.11.0\nSeverity: CRITICAL\nFix: Upgrade shell-quote to 1.11.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-64463e87e9d21096", "name": "CVE-2026-93749: source-map-js 1.2.1 \u2014 packages/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-93749: source-map-js 1.2.1 \u2014 packages/mobile/package-lock.json"}, "fullDescription": {"text": "source-map-js: source-map-js: Denial of Service via malformed indexed source maps\n\nsource-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitrary numeric values. Attackers can supply extremely large offset line values that cause synchronous event loop blocking for extended periods, preventing the service from handling other requests.\n\nPackage: source-map-js\nInstalled: 1.2.1\nFixed in: 1.2.2\nSeverity: HIGH\nFix: Upgrade source-map-js to 1.2.2"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8a4aecbb5aa6ca9d", "name": "CVE-2026-41907: uuid 7.0.3 \u2014 packages/mobile/package-lock.json", "shortDescription": {"text": "CVE-2026-41907: uuid 7.0.3 \u2014 packages/mobile/package-lock.json"}, "fullDescription": {"text": "uuid: uuid: Out-of-bounds write vulnerability impacts data integrity and confidentiality\n\nuuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.\n\nPackage: uuid\nInstalled: 7.0.3\nFixed in: 11.1.1, 12.0.1, 13.0.1\nSeverity: MEDIUM\nFix: Upgrade uuid to 11.1.1, 12.0.1, 13.0.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-304c7ba1aa9979d0", "name": "CVE-2026-101916: @grpc/grpc-js 1.14.4 \u2014 scripts/package-lock.json", "shortDescription": {"text": "CVE-2026-101916: @grpc/grpc-js 1.14.4 \u2014 scripts/package-lock.json"}, "fullDescription": {"text": "grpc-js: grpc-js: Authentication bypass via improper peer certificate validation\n\n@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContext does not distinguish authorized from unauthorized peer certificates when server credentials set requireClientCertificate to false. When applications use the returned authentication context, they can treat an unauthorized certificate as authorized, causing improper authentication. @grpc/grpc-js-xds can reach this condition when RBAC authentication is enable\n\nPackage: @grpc/grpc-js\nInstalled: 1.14.4\nFixed in: 1.13.6, 1.14.5\nSeverity: HIGH\nFix: Upgrade @grpc/grpc-js to 1.13.6, 1.14.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d4d2d19f5660a025", "name": "CVE-2026-101915: @grpc/grpc-js 1.14.4 \u2014 scripts/package-lock.json", "shortDescription": {"text": "CVE-2026-101915: @grpc/grpc-js 1.14.4 \u2014 scripts/package-lock.json"}, "fullDescription": {"text": "@grpc/grpc-js: The server transmits some error messages thrown by method handlers to the client in status messages\n\n@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an application method handler throws an uncaught error, the server includes its error message in the status message sent to the client. The thrown error message is transmitted to the client, causing sensitive information disclosure when the message contains sensitive data. This issue is fixed in versions 1.13.6 and 1.14.5.\n\nPackage: @grpc/grpc-js\nInstalled: 1.14.4\nFixed in: 1.13.6, 1.14.5\nSeverity: LOW\nFix: Upgrade @grpc/grpc-js to 1.13.6, 1.14.5"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-32a9ae39b8dbee47", "name": "CVE-2026-59892: @opentelemetry/propagator-jaeger 2.8.0 \u2014 scripts/package-lock.json", "shortDescription": {"text": "CVE-2026-59892: @opentelemetry/propagator-jaeger 2.8.0 \u2014 scripts/package-lock.json"}, "fullDescription": {"text": "@opentelemetry/propagator-jaeger: OpenTelemetry JavaScript: Denial of Service via malformed HTTP header decoding\n\nOpenTelemetry JavaScript is the OpenTelemetry JavaScript client. Prior to 2.9.0, @opentelemetry/propagator-jaeger decodes incoming uber-trace-id and uberctx-* HTTP header values with decodeURIComponent() without handling decode errors, allowing an unauthenticated remote attacker to send a malformed percent-encoded value that throws an uncaught URIError and terminates a Node.js process using JaegerPropagator as the active propagator. This issue is fixed in version 2.9.0.\n\nPackage: @opentelemetry/propagator-jaeger\nInstalled: 2.8.0\nFixed in: 2.9.0\nSeverity: HIGH\nFix: Upgrade @opentelemetry/propagator-jaeger to 2.9.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ffa5d2eab9129d81", "name": "CVE-2026-101898: axios 1.18.1 \u2014 scripts/package-lock.json", "shortDescription": {"text": "CVE-2026-101898: axios 1.18.1 \u2014 scripts/package-lock.json"}, "fullDescription": {"text": "axios: axios: Security control bypass via unapplied HTTP/2 proxy and DNS settings\n\nAxios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently apply proxy settings and caller-supplied DNS lookup policy. An HTTPS request uses httpVersion: 2 with explicit config.proxy or environment-derived proxy settings, or relies on caller-supplied config.lookup DNS policy. The HTTP/2 path can connect without the configured proxy behavior or without applying the caller-supplied config.lookup policy before http2.c\n\nPackage: axios\nInstalled: 1.18.1\nFixed in: 1.20.0\nSeverity: HIGH\nFix: Upgrade axios to 1.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-474db2193150a063", "name": "CVE-2026-101901: axios 1.18.1 \u2014 scripts/package-lock.json", "shortDescription": {"text": "CVE-2026-101901: axios 1.18.1 \u2014 scripts/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Denial of Service via unhandled error in HTTP/2 session initialization\n\nAxios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error handling for a ClientHttp2Session during Axios HTTP/2 session initialization or reuse. A request uses httpVersion: 2 and the ClientHttp2Session emits an error during session initialization or reuse. The unhandled session error escapes normal Promise rejection handling. The uncaught error can terminate the Node.js process and cause denial of service. This issue\n\nPackage: axios\nInstalled: 1.18.1\nFixed in: 1.20.0\nSeverity: HIGH\nFix: Upgrade axios to 1.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-296e92244a94853a", "name": "CVE-2026-101903: axios 1.18.1 \u2014 scripts/package-lock.json", "shortDescription": {"text": "CVE-2026-101903: axios 1.18.1 \u2014 scripts/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Denial of Service via malformed data URLs\n\nAxios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash characters on both sides of the media-type separator. An application passes an attacker-controlled malformed data URL containing many slash characters and no comma. the JavaScript regular-expression engine explores many separator placements before rejecting the URL. Synchronous excessive backtracking can block the Node.js event loop and cause denial of service.\n\nPackage: axios\nInstalled: 1.18.1\nFixed in: 1.20.0\nSeverity: HIGH\nFix: Upgrade axios to 1.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ff37546c8ab2bd69", "name": "CVE-2026-101905: axios 1.18.1 \u2014 scripts/package-lock.json", "shortDescription": {"text": "CVE-2026-101905: axios 1.18.1 \u2014 scripts/package-lock.json"}, "fullDescription": {"text": "axios: axios: Request socket hijacking via inherited createConnection property\n\nAxios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on Object.prototype.createConnection. Node resolves and invokes the inherited createConnection socket factory, allowing the attacker-controlled function to select the transport endpoint. The attacker endpoint can receive request he\n\nPackage: axios\nInstalled: 1.18.1\nFixed in: 1.20.0\nSeverity: HIGH\nFix: Upgrade axios to 1.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9bdfb0d6ec07b039", "name": "CVE-2026-101906: axios 1.18.1 \u2014 scripts/package-lock.json", "shortDescription": {"text": "CVE-2026-101906: axios 1.18.1 \u2014 scripts/package-lock.json"}, "fullDescription": {"text": "axios: axios: Denial of Service via crafted redirect hostname\n\nAxios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy applies a quadratic trailing-dot regular expression to redirect hostnames. HTTP_PROXY or HTTPS_PROXY is configured, NO_PROXY or no_proxy is non-empty, redirects are followed, and a crafted redirect Location contains many dots followed by a non-dot character. Hostname.replace(/.+$/, '') backtracks quadratically while processing the crafted redirect hostname. Synchronous regular-expr\n\nPackage: axios\nInstalled: 1.18.1\nFixed in: 1.20.0\nSeverity: HIGH\nFix: Upgrade axios to 1.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fe21c8e8dd3dc2c2", "name": "CVE-2026-101907: axios 1.18.1 \u2014 scripts/package-lock.json", "shortDescription": {"text": "CVE-2026-101907: axios 1.18.1 \u2014 scripts/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Server-Side Request Forgery via bypassed redirect restrictions in fetch adapter\n\nAxios is a promise-based HTTP client for the browser and Node.js. From 1.17.0 until 1.20.0, the fetch adapter bypasses the maxRedirects: 0 redirect policy. An Axios request uses the fetch adapter with maxRedirects set to zero and receives a redirect response. The underlying fetch implementation follows the redirect instead of returning the redirect response unchanged. The redirected request can access internal responses or reach state-changing internal endpoints despite redirects being disabled.\n\nPackage: axios\nInstalled: 1.18.1\nFixed in: 1.20.0\nSeverity: HIGH\nFix: Upgrade axios to 1.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-56f8c535ed2294a3", "name": "CVE-2026-101909: axios 1.18.1 \u2014 scripts/package-lock.json", "shortDescription": {"text": "CVE-2026-101909: axios 1.18.1 \u2014 scripts/package-lock.json"}, "fullDescription": {"text": "axios: axios: Denial of Service via prototype pollution gadget in form serialization\n\nAxios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inherited serialization options and visitor properties supplied through prototype pollution. A separate same-process prototype-pollution flaw supplies inherited dots, indexes, metaTokens, maxDepth, visitor, or Blob values before object serialization. The inherited options alter toFormData field naming and data interpretation, maxDepth can force request failure,\n\nPackage: axios\nInstalled: 1.18.1\nFixed in: 0.34.0, 1.20.0\nSeverity: HIGH\nFix: Upgrade axios to 0.34.0, 1.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-189e46ff8a2913ea", "name": "CVE-2026-101899: axios 1.18.1 \u2014 scripts/package-lock.json", "shortDescription": {"text": "CVE-2026-101899: axios 1.18.1 \u2014 scripts/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Information disclosure via improper CIDR proxy bypass handling\n\nAxios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a CIDR entry in NO_PROXY while a proxy is configured. The CIDR bypass rule is not matched, so the request is sent through the configured proxy. For plaintext HTTP, the proxy can observe and modify URLs, headers, and bodies; for HTTPS, it can ob\n\nPackage: axios\nInstalled: 1.18.1\nFixed in: 1.20.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0437850624d67f09", "name": "CVE-2026-101900: axios 1.18.1 \u2014 scripts/package-lock.json", "shortDescription": {"text": "CVE-2026-101900: axios 1.18.1 \u2014 scripts/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter\n\nAxios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag, append, and getHeaders properties while resolving FormData headers. A separate same-process prototype-pollution flaw supplies an array or non-plain class instance whose inherited properties make it appear FormData-like; plain objects are blocked. The inherited getHeaders function can return attacker-controlled headers that resolveConfig merges into a fetch\n\nPackage: axios\nInstalled: 1.18.1\nFixed in: 1.20.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0f9a373ebe61f492", "name": "CVE-2026-101902: axios 1.18.1 \u2014 scripts/package-lock.json", "shortDescription": {"text": "CVE-2026-101902: axios 1.18.1 \u2014 scripts/package-lock.json"}, "fullDescription": {"text": "axios: axios: Unintended HTTP method override via prototype pollution gadget\n\nAxios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that omit an explicit method can read an inherited method value from Object.prototype. If another vulnerability in the same process pollutes Object.prototype.method, calls such as axios.request({ url }) and axios({ url }) can send a state-changing HTTP method instead of the expected default GET. Axios does not create the prototype pollution source. This is a read\n\nPackage: axios\nInstalled: 1.18.1\nFixed in: 0.34.0, 1.20.0\nSeverity: MEDIUM\nFix: Upgrade axios to 0.34.0, 1.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c73e3697e1839905", "name": "CVE-2026-101904: axios 1.18.1 \u2014 scripts/package-lock.json", "shortDescription": {"text": "CVE-2026-101904: axios 1.18.1 \u2014 scripts/package-lock.json"}, "fullDescription": {"text": "axios: Axios: HTTP header injection via inherited prototype properties\n\nAxios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function normalizes inherited Object.prototype.headers from a replacement request configuration. A separate same-process prototype-pollution flaw sets Object.prototype.headers, and trusted request interceptors return a new ordinary configuration without an own headers property. After the interceptor chain, dispatchRequest resolves the inherited headers during normalization. Downstream r\n\nPackage: axios\nInstalled: 1.18.1\nFixed in: 1.20.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-99a11ec31c6935e2", "name": "CVE-2026-101908: axios 1.18.1 \u2014 scripts/package-lock.json", "shortDescription": {"text": "CVE-2026-101908: axios 1.18.1 \u2014 scripts/package-lock.json"}, "fullDescription": {"text": "axios: Axios: Outbound HTTP request manipulation via fetch adapter prototype pollution\n\nAxios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanitized resolvedOptions but then calls fetch with the original fetchOptions. A separate same-process prototype-pollution flaw populates Object.prototype.headers so fetchOptions.headers resolves through inheritance. The inherited fetchOptions.headers value overrides the sanitized Request headers through the second argument to fetch after Request construction. At\n\nPackage: axios\nInstalled: 1.18.1\nFixed in: 1.20.0\nSeverity: MEDIUM\nFix: Upgrade axios to 1.20.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b0cdeaf586712a24", "name": "CVE-2026-93687: braces 3.0.3 \u2014 scripts/package-lock.json", "shortDescription": {"text": "CVE-2026-93687: braces 3.0.3 \u2014 scripts/package-lock.json"}, "fullDescription": {"text": "braces: braces: Denial of Service via Stack Overflow from Deeply Nested Patterns\n\nbraces through 3.0.3 contains a stack overflow vulnerability in the recursive AST walkers that lack depth guards. Attackers can supply deeply nested brace patterns under the character limit to exhaust the call stack and terminate the Node.js process with an uncaught RangeError.\n\nPackage: braces\nInstalled: 3.0.3\nFixed in: \u2014\nSeverity: HIGH\nFix: No fix version published yet"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-37fbff9b8e3c46dc", "name": "CVE-2026-111755: follow-redirects 1.16.0 \u2014 scripts/package-lock.json", "shortDescription": {"text": "CVE-2026-111755: follow-redirects 1.16.0 \u2014 scripts/package-lock.json"}, "fullDescription": {"text": "follow-redirects: follow-redirects: Information disclosure via improper regular expression escaping in sensitive header filtering\n\nfollow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a cross-origin or HTTPS-to-HTTP redirect, unescaped regular-expression metacharacters prevent the generated filter from matching the declared header name, and the credential header is forwarded to an attack\n\nPackage: follow-redirects\nInstalled: 1.16.0\nFixed in: 1.16.1\nSeverity: HIGH\nFix: Upgrade follow-redirects to 1.16.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-37e2a7f48a94a47c", "name": "CVE-2026-111756: follow-redirects 1.16.0 \u2014 scripts/package-lock.json", "shortDescription": {"text": "CVE-2026-111756: follow-redirects 1.16.0 \u2014 scripts/package-lock.json"}, "fullDescription": {"text": "follow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects\n\nfollow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From version 1.16.0 to before version 1.16.1, follow-redirects removes sensitive credential headers (Authorization, Proxy-Authorization, Cookie, and any caller-declared sensitiveHeaders) before following a redirect that crosses to a different host or downgrades to a less secure protocol. The removal routine iterates the caller's headers container with for...in and matches header names against a filt\n\nPackage: follow-redirects\nInstalled: 1.16.0\nFixed in: 1.16.1\nSeverity: HIGH\nFix: Upgrade follow-redirects to 1.16.1"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b8b6e5e6857579e4", "name": "CVE-2026-102422: shell-quote 1.10.0 \u2014 scripts/package-lock.json", "shortDescription": {"text": "CVE-2026-102422: shell-quote 1.10.0 \u2014 scripts/package-lock.json"}, "fullDescription": {"text": "shell-quote: shell-quote: Arbitrary command execution via improper line terminator handling\n\nshell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, including the opening quote of any later string token. A line terminator (\\n, \\r, U+2028, U+2029) in that later string therefore ends the comment, and the rest of the string is parsed as shell input: `quote(['echo', 'ok', { comment: 'x' }, 'a\\nid;#'])` runs `id` in sh, bash, dash, ksh and zsh. `parse()` emits a comment token for a `#` in the middle of a word (f\n\nPackage: shell-quote\nInstalled: 1.10.0\nFixed in: 1.11.0\nSeverity: CRITICAL\nFix: Upgrade shell-quote to 1.11.0"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-3e4a02af2b6f91aa", "name": "CVE-2026-73566: tar 7.5.20 \u2014 scripts/package-lock.json", "shortDescription": {"text": "CVE-2026-73566: tar 7.5.20 \u2014 scripts/package-lock.json"}, "fullDescription": {"text": "tar: node-tar: Denial of Service via crafted long-path tar archive\n\nnode-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxD\n\nPackage: tar\nInstalled: 7.5.20\nFixed in: 7.5.21\nSeverity: HIGH\nFix: Upgrade tar to 7.5.21"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ea8da81570789aff", "name": "DS-0013: 'RUN cd ...' to change directory \u2014 cloud/Dockerfile", "shortDescription": {"text": "DS-0013: 'RUN cd ...' to change directory \u2014 cloud/Dockerfile"}, "fullDescription": {"text": "'RUN cd ...' to change directory\n\nRUN should not be used to change directory: 'dpkg-source -x expat_2.9.0-1.dsc source &&     cd source &&     dpkg-buildpackage -b -us -uc -Pstage1,noudeb --jobs=2 &&     make -C build check &&     cd /build &&     dpkg -i libexpat1_2.9.0-1_*.deb libexpat1-dev_2.9.0-1_*.deb &&     mkdir /out &&     cp libexpat1_2.9.0-1_*.deb /out/libexpat1.deb &&     cc -Wall -Wextra -Werror expat-buffer-bounds.c -lexpat -o /out/expat-buffer-bounds &&     /out/expat-buffer-bounds'. Use 'WORKDIR' statement instead\n\nRule: DS-0013\nSeverity: MEDIUM\nTarget: cloud/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e29ac3ee9cd5bb0a", "name": "DS-0026: No HEALTHCHECK defined \u2014 cloud/Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 cloud/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: cloud/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02a2c706c151876c", "name": "AZU-0068: VM Not Attached To Network \u2014 cloud/coder-azure-vm/main.tf", "shortDescription": {"text": "AZU-0068: VM Not Attached To Network \u2014 cloud/coder-azure-vm/main.tf"}, "fullDescription": {"text": "VM Not Attached To Network\n\nVirtual machine network interface is not associated with a network security group.\n\nRule: AZU-0068\nSeverity: MEDIUM\nTarget: cloud/coder-azure-vm/main.tf"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3d94c94aef4162ae", "name": "AZU-0076: Network Interfaces With Public IP \u2014 cloud/coder-azure-vm/main.tf", "shortDescription": {"text": "AZU-0076: Network Interfaces With Public IP \u2014 cloud/coder-azure-vm/main.tf"}, "fullDescription": {"text": "Network Interfaces With Public IP\n\nNetwork interface has a public IP address assigned, which increases attack surface.\n\nRule: AZU-0076\nSeverity: MEDIUM\nTarget: cloud/coder-azure-vm/main.tf"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8e9269525ede8fb7", "name": "DS-0026: No HEALTHCHECK defined \u2014 cloud/coder/Sandbox.Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 cloud/coder/Sandbox.Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: cloud/coder/Sandbox.Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c81e3a2b35a59e22", "name": "DS-0002: Image user should not be 'root' \u2014 cloud/nodeops/Sandbox.Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 cloud/nodeops/Sandbox.Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: cloud/nodeops/Sandbox.Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4dad6a639906b7da", "name": "DS-0026: No HEALTHCHECK defined \u2014 cloud/nodeops/Sandbox.Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 cloud/nodeops/Sandbox.Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: cloud/nodeops/Sandbox.Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e3d8ae8598425b90", "name": "DS-0002: Image user should not be 'root' \u2014 cloud/nodeops/Sandbox.base.Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 cloud/nodeops/Sandbox.base.Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: cloud/nodeops/Sandbox.base.Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0e9bd47aa1b74d98", "name": "DS-0026: No HEALTHCHECK defined \u2014 cloud/nodeops/Sandbox.base.Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 cloud/nodeops/Sandbox.base.Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: cloud/nodeops/Sandbox.base.Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5accc98136ce397c", "name": "DS-0002: Image user should not be 'root' \u2014 cloud/nodeops/harness/claude-code.Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 cloud/nodeops/harness/claude-code.Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: cloud/nodeops/harness/claude-code.Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8ea73fb08577f593", "name": "DS-0026: No HEALTHCHECK defined \u2014 cloud/nodeops/harness/claude-code.Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 cloud/nodeops/harness/claude-code.Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: cloud/nodeops/harness/claude-code.Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e059a2bbbe145426", "name": "DS-0002: Image user should not be 'root' \u2014 cloud/nodeops/harness/codex.Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 cloud/nodeops/harness/codex.Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: cloud/nodeops/harness/codex.Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6c6845d7ccda3f23", "name": "DS-0026: No HEALTHCHECK defined \u2014 cloud/nodeops/harness/codex.Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 cloud/nodeops/harness/codex.Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: cloud/nodeops/harness/codex.Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-57e89f6b73594c69", "name": "DS-0002: Image user should not be 'root' \u2014 cloud/nodeops/harness/cursor.Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 cloud/nodeops/harness/cursor.Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: cloud/nodeops/harness/cursor.Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-43b3ab8d8dbd7c5e", "name": "DS-0026: No HEALTHCHECK defined \u2014 cloud/nodeops/harness/cursor.Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 cloud/nodeops/harness/cursor.Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: cloud/nodeops/harness/cursor.Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f39c2852bbe738f6", "name": "DS-0026: No HEALTHCHECK defined \u2014 cloud/test/Dockerfile.worker-smoke", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 cloud/test/Dockerfile.worker-smoke"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: cloud/test/Dockerfile.worker-smoke"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7550b2b36b8825e2", "name": "DS-0002: Image user should not be 'root' \u2014 experiments/remote-browser-poc/Dockerfile", "shortDescription": {"text": "DS-0002: Image user should not be 'root' \u2014 experiments/remote-browser-poc/Dockerfile"}, "fullDescription": {"text": "Image user should not be 'root'\n\nSpecify at least 1 USER command in Dockerfile with non-root user as argument\n\nRule: DS-0002\nSeverity: HIGH\nTarget: experiments/remote-browser-poc/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e4b2fcf9968cb1c1", "name": "DS-0026: No HEALTHCHECK defined \u2014 experiments/remote-browser-poc/Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 experiments/remote-browser-poc/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: experiments/remote-browser-poc/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-950dd45abbefce69", "name": "DS-0013: 'RUN cd ...' to change directory \u2014 test/cli/Dockerfile", "shortDescription": {"text": "DS-0013: 'RUN cd ...' to change directory \u2014 test/cli/Dockerfile"}, "fullDescription": {"text": "'RUN cd ...' to change directory\n\nRUN should not be used to change directory: 'cd backend && CGO_ENABLED=0 go build -trimpath       -ldflags \"-X github.com/aoagents/agent-orchestrator/backend/internal/cli.releaseRepo=AgentWrapper/ao-fresh-install-fixture\"       -o /out/ao ./cmd/ao'. Use 'WORKDIR' statement instead.\n\nRule: DS-0013\nSeverity: MEDIUM\nTarget: test/cli/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-936f08337cd9a007", "name": "DS-0026: No HEALTHCHECK defined \u2014 test/cli/Dockerfile", "shortDescription": {"text": "DS-0026: No HEALTHCHECK defined \u2014 test/cli/Dockerfile"}, "fullDescription": {"text": "No HEALTHCHECK defined\n\nAdd HEALTHCHECK instruction in your Dockerfile\n\nRule: DS-0026\nSeverity: LOW\nTarget: test/cli/Dockerfile"}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2bd693911a9c2d87", "name": "Secret leak: Google (GCP) Service-account \u2014 .github/.gitleaks.toml", "shortDescription": {"text": "Secret leak: Google (GCP) Service-account \u2014 .github/.gitleaks.toml"}, "fullDescription": {"text": "Trivy detected a possible secret in `.github/.gitleaks.toml`.\n\nRule: gcp-service-account\nSeverity: CRITICAL\nMatch (redacted):     regex = '''*************************'''\n\nAction: rotate the credential and remove it from the repo. Use a secrets manager or environment variables."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-2679282aa1c484b5", "name": "Agent authority lacks a verifier contract: AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-db7976514c141d2e", "name": "Agent authority lacks a verifier contract: cloud/internal/skillassets/using-ao/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: cloud/internal/skillassets/using-ao/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-25846ede0fea196a", "name": "SkillSpector AST4 (behavioral-ast) in .claude/skills/bug-triage/scripts/push_fix_to_github.py", "shortDescription": {"text": "SkillSpector AST4 (behavioral-ast) in .claude/skills/bug-triage/scripts/push_fix_to_github.py"}, "fullDescription": {"text": "result = subprocess.run(cmd, capture_output=True, text=True, timeout=30)\n\nsubprocess module calls execute external commands. Without careful input validation, this enables command injection.\n\nSkill: bug-triage\nRule: AST4  Category: behavioral-ast\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Use subprocess.run() with shell=False and an explicit argument list. Validate all inputs and avoid passing user-controlled data to commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-f999fdd2402fe8c0", "name": "SkillSpector LP3 (mcp-least-priv) in .claude/skills/bug-triage/SKILL.md", "shortDescription": {"text": "SkillSpector LP3 (mcp-least-priv) in .claude/skills/bug-triage/SKILL.md"}, "fullDescription": {"text": "MCP Least Privilege\n\nWithout declared permissions the skill's intent is opaque and cannot be validated.\n\nSkill: bug-triage\nRule: LP3  Category: mcp-least-priv\nSeverity: MEDIUM  Confidence: 0.70\n\nRemediation: Add a 'permissions' field to SKILL.md listing the capabilities this skill requires."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.7}}, {"id": "scanner-e58d8abb85e944db", "name": "SkillSpector OH1 (output-handling) in .claude/skills/bug-triage/scripts/push_fix_to_github.py", "shortDescription": {"text": "SkillSpector OH1 (output-handling) in .claude/skills/bug-triage/scripts/push_fix_to_github.py"}, "fullDescription": {"text": "subprocess.run(cmd, capture_output\n\nModel output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.\n\nSkill: bug-triage\nRule: OH1  Category: output-handling\nSeverity: HIGH  Confidence: 0.95\n\nRemediation: Validate and sanitize all model output before using it in downstream contexts. Use parameterized queries for SQL, shell quoting for commands, and HTML encoding for web output."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 0.95}}, {"id": "scanner-9ac06d0220790f00", "name": "SkillSpector EA2 (excessive-agency) in backend/internal/skillassets/using-ao/commands/project.md", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in backend/internal/skillassets/using-ao/commands/project.md"}, "fullDescription": {"text": "Skip confirmation\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: using-ao\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.85\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-9f077df897f63980", "name": "SkillSpector EA2 (excessive-agency) in backend/internal/skillassets/using-ao/commands/session.md", "shortDescription": {"text": "SkillSpector EA2 (excessive-agency) in backend/internal/skillassets/using-ao/commands/session.md"}, "fullDescription": {"text": "Skip confirmation\n\nSkill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.\n\nSkill: using-ao\nRule: EA2  Category: excessive-agency\nSeverity: MEDIUM  Confidence: 0.85\n\nRemediation: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-8fbfda66b03697ba", "name": "SkillSpector TM3 (tool-misuse) in backend/internal/skillassets/using-ao/commands/project.md", "shortDescription": {"text": "SkillSpector TM3 (tool-misuse) in backend/internal/skillassets/using-ao/commands/project.md"}, "fullDescription": {"text": "NODE_ENV=development\"\n\nTool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.\n\nSkill: using-ao\nRule: TM3  Category: tool-misuse\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Override unsafe defaults with secure settings (verify=True, auth required, restrictive permissions). Review and harden all tool configurations."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-ab795ec1b4f856ef", "name": "SkillSpector E1 (data-exfil) in cloud/internal/skillassets/using-ao/commands/pull-requests.md", "shortDescription": {"text": "SkillSpector E1 (data-exfil) in cloud/internal/skillassets/using-ao/commands/pull-requests.md"}, "fullDescription": {"text": "curl --unix-socket $AO_PULL_REQUEST_SOCKET -X POST http://localhost/pull-request \\\n  -H 'Content-Type: application/json' \\\n  -d\n\nData is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.\n\nSkill: using-ao\nRule: E1  Category: data-exfil\nSeverity: MEDIUM  Confidence: 0.60\n\nRemediation: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.6}}, {"id": "scanner-e637c415447867e4", "name": "Run SkillSpector's LLM-backed analysis in your own pipeline", "shortDescription": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "fullDescription": {"text": "Repobility ran SkillSpector's static rules server-side. The deeper LLM-backed analyzers \u2014 tool-poisoning (TP*), semantic security discovery (SSD*), developer-intent mismatch (SDI*) \u2014 are meant to run on YOUR machine with YOUR model; repobility never sends your code to an LLM. Recipe:\n\n# 1. Install SkillSpector in your own isolated env\npipx install \"skillspector @ git+https://github.com/NVIDIA/SkillSpector.git\"\n\n# 2. Point it at YOUR LLM pipeline (pick one) - your code stays on your machine\nexport SKILLSPECTOR_PROVIDER=anthropic && export ANTHROPIC_API_KEY=sk-ant-...\n# export SKILLSPECTOR_PROVIDER=openai   && export OPENAI_API_KEY=sk-...\n# export SKILLSPECTOR_PROVIDER=openai OPENAI_API_KEY=ollama OPENAI_BASE_URL=http://localhost:11434/v1 SKILLSPECTOR_MODEL=llama3.1:8b\n# export SKILLSPECTOR_PROVIDER=nv_build && export NVIDIA_INFERENCE_KEY=nvapi-...\n\n# 3. Run the LLM-backed scan per skill (omit --no-llm to enable the LLM analyzers)\nskillspector scan .claude/skills/ao-desktop-dev --format "}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c048b520a651950e", "name": "Privileged port 18 in use", "shortDescription": {"text": "Privileged port 18 in use"}, "fullDescription": {"text": "Port 18 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e7b74186b9071c0f", "name": "Privileged port 20 in use", "shortDescription": {"text": "Privileged port 20 in use"}, "fullDescription": {"text": "Port 20 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer."}, "properties": {"scanner": "scanner-primary", "layer": "network", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-181e66fb3f8cf95a", "name": "Docker base image is tag-pinned but not digest-pinned: golang:1.27.1-bookworm", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: golang:1.27.1-bookworm"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d9f47d669fa5f9f3", "name": "Docker base image is tag-pinned but not digest-pinned: node:22-trixie-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-trixie-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e1ec0b0fbae0c9f", "name": "Docker base image is tag-pinned but not digest-pinned: gcr.io/distroless/static-debian12:nonroot", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: gcr.io/distroless/static-debian12:nonroot"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3c0d92e2fd034fb8", "name": "Dockerfile runs as root: experiments/remote-browser-poc/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: experiments/remote-browser-poc/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-99f709496a58032c", "name": "Docker base image is tag-pinned but not digest-pinned: debian:trixie-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: debian:trixie-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-faaf90ae1547bd10", "name": "Insecure pattern 'node_child_process' in frontend/scripts/dev-web.mjs:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in frontend/scripts/dev-web.mjs:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-6ff10e4c0fa6ff0d", "name": "Insecure pattern 'exec_used' in frontend/scripts/verify-mac-artifact.sh:63", "shortDescription": {"text": "Insecure pattern 'exec_used' in frontend/scripts/verify-mac-artifact.sh:63"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cc7080ad7594b8d0", "name": "Insecure pattern 'new_function_used' in frontend/scripts/build-acp-runtime-helpers.test.mjs:141", "shortDescription": {"text": "Insecure pattern 'new_function_used' in frontend/scripts/build-acp-runtime-helpers.test.mjs:141"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a05bda3473ebebe9", "name": "Insecure pattern 'node_child_process' in frontend/scripts/e2e-mac-update.mjs:39", "shortDescription": {"text": "Insecure pattern 'node_child_process' in frontend/scripts/e2e-mac-update.mjs:39"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-9e86ae87e18afe6e", "name": "Insecure pattern 'node_child_process' in frontend/scripts/build-host-bundle.mjs:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in frontend/scripts/build-host-bundle.mjs:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-3ad2e766c90b7ec8", "name": "Insecure pattern 'insert_adjacent_html' in frontend/src/annotate-preload.ts:569", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in frontend/src/annotate-preload.ts:569"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-e372783036b7c501", "name": "Insecure pattern 'exec_used' in frontend/src/types/better-sqlite3.d.ts:18", "shortDescription": {"text": "Insecure pattern 'exec_used' in frontend/src/types/better-sqlite3.d.ts:18"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-aa2880f0dfec74c2", "name": "Insecure pattern 'domparser_html_parse' in frontend/src/renderer/components/SessionLinkPreviewCard.tsx:233", "shortDescription": {"text": "Insecure pattern 'domparser_html_parse' in frontend/src/renderer/components/SessionLinkPreviewCard.tsx:233"}, "fullDescription": {"text": "Found a known-risky pattern (domparser_html_parse). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-1f24c243bf0ab684", "name": "Insecure pattern 'local_storage_auth_token' in frontend/src/renderer/components/cloud-workspace/CloudWorkspaceReviewPane", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/src/renderer/components/cloud-workspace/CloudWorkspaceReviewPane.test.tsx:63"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f86b2c56a2ac6da9", "name": "Insecure pattern 'local_storage_auth_token' in frontend/src/renderer/components/chat/CloudSessionChatSurface.test.tsx:50", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/src/renderer/components/chat/CloudSessionChatSurface.test.tsx:504"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f4ed9a07523a6a1f", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/src/renderer/components/chat/MermaidBlock.tsx:206", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/src/renderer/components/chat/MermaidBlock.tsx:206"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-b7468fec91425af6", "name": "Insecure pattern 'local_storage_auth_token' in frontend/src/renderer/lib/session-management-telemetry.test.ts:96", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/src/renderer/lib/session-management-telemetry.test.ts:96"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-90a039351f18d330", "name": "Insecure pattern 'new_function_used' in frontend/src/main/render-check.test.ts:282", "shortDescription": {"text": "Insecure pattern 'new_function_used' in frontend/src/main/render-check.test.ts:282"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dd77e68d935e1eca", "name": "Insecure pattern 'insert_adjacent_html' in frontend/e2e/chat-render-wrap.spec.ts:174", "shortDescription": {"text": "Insecure pattern 'insert_adjacent_html' in frontend/e2e/chat-render-wrap.spec.ts:174"}, "fullDescription": {"text": "Found a known-risky pattern (insert_adjacent_html). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-f6ce773e4ec46e97", "name": "Insecure pattern 'exec_used' in cloud/internal/postgres/workspace_startup_store_test.go:158", "shortDescription": {"text": "Insecure pattern 'exec_used' in cloud/internal/postgres/workspace_startup_store_test.go:158"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-73ed01cae76436c7", "name": "Insecure pattern 'direct_innerhtml_assignment' in cloud/internal/agentbrowser/host/viewer.html:139", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in cloud/internal/agentbrowser/host/viewer.html:139"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.65}}, {"id": "scanner-dcec5fdca5cff1ce", "name": "Possible secret in cloud/internal/httpapi/coder_lifecycle_handlers_test.go", "shortDescription": {"text": "Possible secret in cloud/internal/httpapi/coder_lifecycle_handlers_test.go"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching github_token. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 0.99}}, {"id": "scanner-e2e1a3fd684140d1", "name": "Possible secret in cloud/internal/httpapi/workspace_startup_handlers_test.go", "shortDescription": {"text": "Possible secret in cloud/internal/httpapi/workspace_startup_handlers_test.go"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching github_token. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 0.99}}, {"id": "scanner-6c06e9d1a1d94707", "name": "Possible secret in cloud/scripts/cloud-local-up.sh", "shortDescription": {"text": "Possible secret in cloud/scripts/cloud-local-up.sh"}, "fullDescription": {"text": "Detected 1 occurrence(s) matching password_literal. Rotate real credentials and move them to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.58}}, {"id": "scanner-3d857990c1f5a7a1", "name": "Insecure pattern 'new_function_used' in packages/mobile/lib/chat/renderFrameModel.test.ts:100", "shortDescription": {"text": "Insecure pattern 'new_function_used' in packages/mobile/lib/chat/renderFrameModel.test.ts:100"}, "fullDescription": {"text": "Found a known-risky pattern (new_function_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a06980f599ae68df", "name": "Insecure pattern 'node_child_process' in backend/internal/adapters/agent/amp/amp_test.go:334", "shortDescription": {"text": "Insecure pattern 'node_child_process' in backend/internal/adapters/agent/amp/amp_test.go:334"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 0.8}}, {"id": "scanner-2613ce617ee9de53", "name": "Insecure pattern 'document_write' in backend/internal/service/linkpreview/service_test.go:18", "shortDescription": {"text": "Insecure pattern 'document_write' in backend/internal/service/linkpreview/service_test.go:18"}, "fullDescription": {"text": "Found a known-risky pattern (document_write). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6980b2447233928d", "name": "Insecure pattern 'weak_hash' in backend/internal/service/chat/handoff_history_files.go:5", "shortDescription": {"text": "Insecure pattern 'weak_hash' in backend/internal/service/chat/handoff_history_files.go:5"}, "fullDescription": {"text": "Found a known-risky pattern (weak_hash). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1cd4c86507696813", "name": "Insecure pattern 'exec_used' in backend/internal/storage/sqlite/session_revision_test.go:34", "shortDescription": {"text": "Insecure pattern 'exec_used' in backend/internal/storage/sqlite/session_revision_test.go:34"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9c97dea51b2485a4", "name": "Insecure pattern 'cors_wildcard' in backend/e2e/chat_usage_limit_daemon_test.go:395", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in backend/e2e/chat_usage_limit_daemon_test.go:395"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7b61e781f2b20705", "name": "Insecure pattern 'private_key_in_repo' in .github/.gitleaks.toml:76", "shortDescription": {"text": "Insecure pattern 'private_key_in_repo' in .github/.gitleaks.toml:76"}, "fullDescription": {"text": "Found a known-risky pattern (private_key_in_repo). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-949552fb75bc56c8", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/upload-artifact@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c7f570b8a5790e08", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "golangci/golangci-lint-action@v8 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de39ac9e5cbf2f3d", "name": "GitHub Action is tag-pinned rather than SHA-pinned", "shortDescription": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "fullDescription": {"text": "actions/deploy-pages@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3345532e49ae8640", "name": "GitHub Actions workflow grants broad write permissions", "shortDescription": {"text": "GitHub Actions workflow grants broad write permissions"}, "fullDescription": {"text": "CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e19c0187efbc3aeb", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-849ba9049feb6e94", "name": "Very large file: frontend/src/annotate-preload.ts (1743 lines)", "shortDescription": {"text": "Very large file: frontend/src/annotate-preload.ts (1743 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-df978ea8a9d00c30", "name": "Very large file: frontend/src/main.ts (3630 lines)", "shortDescription": {"text": "Very large file: frontend/src/main.ts (3630 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1a1f38e431e156c2", "name": "Very large file: frontend/src/renderer/test/shell-new-session-shortcut.test.tsx (1431 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/test/shell-new-session-shortcut.test.tsx (1431 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d24e41e45637fa74", "name": "Very large file: frontend/src/renderer/components/SessionView.test.tsx (5970 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/SessionView.test.tsx (5970 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7ac0af3721e2459b", "name": "Very large file: frontend/src/renderer/components/NotificationCenter.tsx (1357 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/NotificationCenter.tsx (1357 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11cc09e129563073", "name": "Very large file: frontend/src/renderer/components/BrowserPanel.tsx (2096 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/BrowserPanel.tsx (2096 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-28701e81dc7fdcba", "name": "Very large file: frontend/src/renderer/components/Sidebar.test.tsx (3644 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/Sidebar.test.tsx (3644 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7f4f50311ec75e20", "name": "Very large file: frontend/src/renderer/components/SessionView.tsx (2283 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/SessionView.tsx (2283 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd35d1aa53b84d4d", "name": "Very large file: frontend/src/renderer/components/SessionView.remote.test.tsx (912 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/SessionView.remote.test.tsx (912 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-445ac8a2e9878f8b", "name": "Very large file: frontend/src/renderer/components/SessionInspector.tsx (2824 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/SessionInspector.tsx (2824 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72d7cbbe9c603432", "name": "Very large file: frontend/src/renderer/components/CreateProjectFlow.tsx (2875 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/CreateProjectFlow.tsx (2875 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be028e4c08d935e4", "name": "Very large file: frontend/src/renderer/components/TerminalPane.tsx (1576 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/TerminalPane.tsx (1576 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e8633208d1a82982", "name": "Very large file: frontend/src/renderer/components/SessionsBoard.test.tsx (1857 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/SessionsBoard.test.tsx (1857 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e2b7337954e27047", "name": "Very large file: frontend/src/renderer/components/TaskComposer.test.tsx (2461 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/TaskComposer.test.tsx (2461 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-faf12b3b6e323abc", "name": "Very large file: frontend/src/renderer/components/Sidebar.tsx (3501 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/Sidebar.tsx (3501 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee9486caff6ea74c", "name": "Very large file: frontend/src/renderer/components/TerminalPane.test.tsx (1542 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/TerminalPane.test.tsx (1542 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ddf811758f93e3dc", "name": "Very large file: frontend/src/renderer/components/XtermTerminal.tsx (2093 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/XtermTerminal.tsx (2093 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-05f0c5d19f2967ab", "name": "Very large file: frontend/src/renderer/components/BrowserPanel.test.tsx (2018 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/BrowserPanel.test.tsx (2018 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52d0c3fd2e25e4d0", "name": "Very large file: frontend/src/renderer/components/SessionInspector.test.tsx (4935 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/SessionInspector.test.tsx (4935 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-94158431cb58a3c1", "name": "Very large file: frontend/src/renderer/components/SessionFileExplorer.test.tsx (885 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/SessionFileExplorer.test.tsx (885 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-41c94aaee07be2cb", "name": "Very large file: frontend/src/renderer/components/ProjectSettingsForm.test.tsx (2152 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/ProjectSettingsForm.test.tsx (2152 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5bc3af34c7b719b8", "name": "Very large file: frontend/src/renderer/components/CreateProjectFlow.test.tsx (3079 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/CreateProjectFlow.test.tsx (3079 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4ac617b046b579df", "name": "Very large file: frontend/src/renderer/components/XtermTerminal.test.tsx (2924 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/XtermTerminal.test.tsx (2924 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2f73a6cc0647c60c", "name": "Very large file: frontend/src/renderer/components/settings/HarnessSettingsSection.test.tsx (2569 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/settings/HarnessSettingsSection.test.tsx (2569 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c6411bb33f0b93c", "name": "Very large file: frontend/src/renderer/components/settings/CodexAccountsSection.test.tsx (1006 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/settings/CodexAccountsSection.test.tsx (1006 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e333dd5f98b6481c", "name": "Very large file: frontend/src/renderer/components/chat/ChatComposer.tsx (2091 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/chat/ChatComposer.tsx (2091 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d85c8b0bd726c50", "name": "Very large file: frontend/src/renderer/components/chat/TurnSettingsBar.test.tsx (1855 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/chat/TurnSettingsBar.test.tsx (1855 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-571abaec42439b42", "name": "Very large file: frontend/src/renderer/components/chat/CloudSessionChatSurface.test.tsx (1001 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/chat/CloudSessionChatSurface.test.tsx (1001 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ed06370c5edaf2fc", "name": "Very large file: frontend/src/renderer/components/chat/IndependentSideChats.tsx (1572 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/chat/IndependentSideChats.tsx (1572 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6cd0beaf022e8a63", "name": "Very large file: frontend/src/renderer/components/chat/TurnSettingsBar.tsx (1783 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/chat/TurnSettingsBar.tsx (1783 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3bc4e8eb75359cbc", "name": "Very large file: frontend/src/renderer/components/chat/ChatWorkspace.tsx (5174 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/chat/ChatWorkspace.tsx (5174 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-43c94de5ec28c652", "name": "Very large file: frontend/src/renderer/components/chat/ChatTimelineItems.tsx (3239 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/chat/ChatTimelineItems.tsx (3239 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8a2a2efbf16b5ed", "name": "Very large file: frontend/src/renderer/components/chat/ChatComposer.test.tsx (2946 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/chat/ChatComposer.test.tsx (2946 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e7bbf6abf683c11", "name": "Very large file: frontend/src/renderer/components/chat/ChatWorkspace.test.tsx (5449 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/chat/ChatWorkspace.test.tsx (5449 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1553a93146f56cf9", "name": "Very large file: frontend/src/renderer/components/chat/SessionChatSurface.test.tsx (1367 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/chat/SessionChatSurface.test.tsx (1367 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-83f07f3ff5f49a6a", "name": "Very large file: frontend/src/renderer/components/diffs/WorkspaceReviewPane.test.tsx (834 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/components/diffs/WorkspaceReviewPane.test.tsx (834 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0a7942d49f6b1a10", "name": "Very large file: frontend/src/renderer/lib/chat-drafts.ts (1496 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/lib/chat-drafts.ts (1496 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-92002aa34762196f", "name": "Very large file: frontend/src/renderer/routes/_shell.tsx (1543 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/routes/_shell.tsx (1543 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f68383a9855bc5bc", "name": "Very large file: frontend/src/renderer/hooks/useBrowserView.test.tsx (2127 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/hooks/useBrowserView.test.tsx (2127 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8a8525ff3dcb132", "name": "Very large file: frontend/src/renderer/hooks/useTerminalSession.test.tsx (1351 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/hooks/useTerminalSession.test.tsx (1351 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-12a907586309e2ac", "name": "Very large file: frontend/src/renderer/hooks/useConversation.test.tsx (1391 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/hooks/useConversation.test.tsx (1391 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa2c0feecee797ed", "name": "Very large file: frontend/src/renderer/hooks/useConversation.ts (1956 lines)", "shortDescription": {"text": "Very large file: frontend/src/renderer/hooks/useConversation.ts (1956 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9667de6d08ddbaa8", "name": "Very large file: frontend/src/api/schema.ts (23266 lines)", "shortDescription": {"text": "Very large file: frontend/src/api/schema.ts (23266 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f3797fae31f6987b", "name": "Very large file: frontend/src/main/auto-updater.ts (2935 lines)", "shortDescription": {"text": "Very large file: frontend/src/main/auto-updater.ts (2935 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cd1af070331e00ea", "name": "Very large file: frontend/src/main/auto-updater.test.ts (4604 lines)", "shortDescription": {"text": "Very large file: frontend/src/main/auto-updater.test.ts (4604 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-28bb98852352123a", "name": "Very large file: frontend/src/main/browser-view-host.test.ts (6232 lines)", "shortDescription": {"text": "Very large file: frontend/src/main/browser-view-host.test.ts (6232 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0befb0a6fe19cc7c", "name": "Very large file: frontend/src/main/remote-proxy.test.ts (1672 lines)", "shortDescription": {"text": "Very large file: frontend/src/main/remote-proxy.test.ts (1672 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d1408ef002b11fd8", "name": "Very large file: frontend/src/main/browser-view-host.ts (6524 lines)", "shortDescription": {"text": "Very large file: frontend/src/main/browser-view-host.ts (6524 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c0f2d67409af327c", "name": "Very large file: frontend/src/main/browser-profile-import.test.ts (1483 lines)", "shortDescription": {"text": "Very large file: frontend/src/main/browser-profile-import.test.ts (1483 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e52e194e4625152", "name": "Very large file: frontend/src/main/browser-profile-import.ts (1705 lines)", "shortDescription": {"text": "Very large file: frontend/src/main/browser-profile-import.ts (1705 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a3da4646e5a6c6c9", "name": "Very large file: frontend/e2e/support/fake-bridge.ts (1272 lines)", "shortDescription": {"text": "Very large file: frontend/e2e/support/fake-bridge.ts (1272 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9e45521932413c0c", "name": "Very large file: cloud/internal/workertransport/supervisor.go (1537 lines)", "shortDescription": {"text": "Very large file: cloud/internal/workertransport/supervisor.go (1537 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-07d77aa8402985d9", "name": "Very large file: cloud/internal/reconcile/reconciler.go (2101 lines)", "shortDescription": {"text": "Very large file: cloud/internal/reconcile/reconciler.go (2101 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d240c98f647b6316", "name": "Very large file: cloud/internal/sandbox/coder/client_test.go (1433 lines)", "shortDescription": {"text": "Very large file: cloud/internal/sandbox/coder/client_test.go (1433 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-274dfa1511372470", "name": "Very large file: cloud/internal/sandbox/coder/client.go (2404 lines)", "shortDescription": {"text": "Very large file: cloud/internal/sandbox/coder/client.go (2404 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a4402187d7f2f061", "name": "Very large file: cloud/internal/postgres/worker_transport_store.go (1706 lines)", "shortDescription": {"text": "Very large file: cloud/internal/postgres/worker_transport_store.go (1706 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c503e4618d7c6456", "name": "Very large file: cloud/internal/postgres/sandbox_store.go (1739 lines)", "shortDescription": {"text": "Very large file: cloud/internal/postgres/sandbox_store.go (1739 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-88b6613301488e90", "name": "Very large file: cloud/internal/postgres/billing_store.go (1436 lines)", "shortDescription": {"text": "Very large file: cloud/internal/postgres/billing_store.go (1436 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a5c08f6bc5b0529c", "name": "Very large file: cloud/internal/postgres/github_store.go (1861 lines)", "shortDescription": {"text": "Very large file: cloud/internal/postgres/github_store.go (1861 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a4fa0d2db79e8a57", "name": "Very large file: cloud/internal/postgres/project_session_store.go (1591 lines)", "shortDescription": {"text": "Very large file: cloud/internal/postgres/project_session_store.go (1591 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-53ea071935f968a7", "name": "Very large file: cloud/internal/githubapp/service.go (1498 lines)", "shortDescription": {"text": "Very large file: cloud/internal/githubapp/service.go (1498 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1ecd75f64d409833", "name": "Very large file: cloud/internal/agentbrowser/host/viewer.go (1680 lines)", "shortDescription": {"text": "Very large file: cloud/internal/agentbrowser/host/viewer.go (1680 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e8cbb936cebc9fd8", "name": "Very large file: cloud/internal/httpapi/worker_handlers.go (1586 lines)", "shortDescription": {"text": "Very large file: cloud/internal/httpapi/worker_handlers.go (1586 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5b414667f641af71", "name": "Very large file: cloud/internal/httpapi/resource_handlers.go (1448 lines)", "shortDescription": {"text": "Very large file: cloud/internal/httpapi/resource_handlers.go (1448 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-63b6d2d4d00c9161", "name": "Very large file: cloud/cmd/ao-worker/main.go (1875 lines)", "shortDescription": {"text": "Very large file: cloud/cmd/ao-worker/main.go (1875 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-53b821895d9315a5", "name": "Very large file: packages/product-ui/src/SessionInspectorView.tsx (1607 lines)", "shortDescription": {"text": "Very large file: packages/product-ui/src/SessionInspectorView.tsx (1607 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9560472a83ef6d24", "name": "Very large file: packages/mobile/lib/chat/ChatTimeline.tsx (1261 lines)", "shortDescription": {"text": "Very large file: packages/mobile/lib/chat/ChatTimeline.tsx (1261 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cd5abee3f6592ed4", "name": "Very large file: packages/mobile/lib/session/TerminalSessionScreen.tsx (1713 lines)", "shortDescription": {"text": "Very large file: packages/mobile/lib/session/TerminalSessionScreen.tsx (1713 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d39b56de78b53ac3", "name": "Very large file: packages/cloud-client/src/schema.ts (5869 lines)", "shortDescription": {"text": "Very large file: packages/cloud-client/src/schema.ts (5869 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-df04d7d0cba5f1aa", "name": "Very large file: backend/internal/adapters/agent/hermes/hermes_test.go (1878 lines)", "shortDescription": {"text": "Very large file: backend/internal/adapters/agent/hermes/hermes_test.go (1878 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5b5ae243e96e62d2", "name": "Very large file: backend/internal/adapters/agent/hermes/hermes.go (1811 lines)", "shortDescription": {"text": "Very large file: backend/internal/adapters/agent/hermes/hermes.go (1811 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3c2a48845a5403d9", "name": "Very large file: backend/internal/adapters/agent/modelcatalog/catalog.go (1473 lines)", "shortDescription": {"text": "Very large file: backend/internal/adapters/agent/modelcatalog/catalog.go (1473 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0eda847e0f78dd10", "name": "Very large file: backend/internal/adapters/agent/modelcatalog/catalog_test.go (1393 lines)", "shortDescription": {"text": "Very large file: backend/internal/adapters/agent/modelcatalog/catalog_test.go (1393 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6839157de28c6012", "name": "Very large file: backend/internal/adapters/agent/claudecode/claudecode_test.go (1700 lines)", "shortDescription": {"text": "Very large file: backend/internal/adapters/agent/claudecode/claudecode_test.go (1700 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-42db181eae4fb499", "name": "Very large file: backend/internal/adapters/workspace/gitworktree/workspace.go (2343 lines)", "shortDescription": {"text": "Very large file: backend/internal/adapters/workspace/gitworktree/workspace.go (2343 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6ad59bb3a96f5086", "name": "Very large file: backend/internal/adapters/workspace/gitworktree/workspace_integration_test.go (1618 lines)", "shortDescription": {"text": "Very large file: backend/internal/adapters/workspace/gitworktree/workspace_integration_test.go (1618 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d02b4061634c6120", "name": "Very large file: backend/internal/adapters/scm/github/provider_test.go (1933 lines)", "shortDescription": {"text": "Very large file: backend/internal/adapters/scm/github/provider_test.go (1933 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-727f25f6153a3d7e", "name": "Very large file: backend/internal/adapters/scm/gitlab/provider_test.go (3237 lines)", "shortDescription": {"text": "Very large file: backend/internal/adapters/scm/gitlab/provider_test.go (3237 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1844aa374cf3ed3a", "name": "Very large file: backend/internal/adapters/runtime/tmux/tmux_test.go (2327 lines)", "shortDescription": {"text": "Very large file: backend/internal/adapters/runtime/tmux/tmux_test.go (2327 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c3c039cebd77fd1", "name": "Very large file: backend/internal/adapters/runtime/tmux/tmux.go (1749 lines)", "shortDescription": {"text": "Very large file: backend/internal/adapters/runtime/tmux/tmux.go (1749 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11985db54b5c2709", "name": "Very large file: backend/internal/adapters/chatdriver/codexappserver/driver_test.go (1865 lines)", "shortDescription": {"text": "Very large file: backend/internal/adapters/chatdriver/codexappserver/driver_test.go (1865 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-541a17d1aa79d891", "name": "Very large file: backend/internal/adapters/chatdriver/codexappserver/normalize.go (1442 lines)", "shortDescription": {"text": "Very large file: backend/internal/adapters/chatdriver/codexappserver/normalize.go (1442 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-59c25f0bcead8936", "name": "Very large file: backend/internal/adapters/chatdriver/codexappserver/codexproto/protocol.gen.go (5365 lines)", "shortDescription": {"text": "Very large file: backend/internal/adapters/chatdriver/codexappserver/codexproto/protocol.gen.go (5365 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d2df0702e6105c4", "name": "Very large file: backend/internal/adapters/chatdriver/acp/driver_test.go (5149 lines)", "shortDescription": {"text": "Very large file: backend/internal/adapters/chatdriver/acp/driver_test.go (5149 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6159c9e4931a9872", "name": "Very large file: backend/internal/review/review.go (2039 lines)", "shortDescription": {"text": "Very large file: backend/internal/review/review.go (2039 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee218438553cbd17", "name": "Very large file: backend/internal/review/review_test.go (3385 lines)", "shortDescription": {"text": "Very large file: backend/internal/review/review_test.go (3385 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a6193900c55aaf60", "name": "Very large file: backend/internal/cli/hooks_test.go (2452 lines)", "shortDescription": {"text": "Very large file: backend/internal/cli/hooks_test.go (2452 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-68a20ffeb74df2d6", "name": "Very large file: backend/internal/cli/spawn_test.go (1174 lines)", "shortDescription": {"text": "Very large file: backend/internal/cli/spawn_test.go (1174 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab0f7b0597fba130", "name": "Very large file: backend/internal/observe/usage/ingestor_integration_test.go (1272 lines)", "shortDescription": {"text": "Very large file: backend/internal/observe/usage/ingestor_integration_test.go (1272 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c8199f5962be20c0", "name": "Very large file: backend/internal/observe/usage/parser_test.go (1185 lines)", "shortDescription": {"text": "Very large file: backend/internal/observe/usage/parser_test.go (1185 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1491d1349c875f20", "name": "Very large file: backend/internal/observe/scm/observer_test.go (3561 lines)", "shortDescription": {"text": "Very large file: backend/internal/observe/scm/observer_test.go (3561 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d8a1add272a292e9", "name": "Very large file: backend/internal/observe/scm/observer.go (2297 lines)", "shortDescription": {"text": "Very large file: backend/internal/observe/scm/observer.go (2297 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce10772916640aca", "name": "Very large file: backend/internal/httpd/apispec/specgen/build.go (3720 lines)", "shortDescription": {"text": "Very large file: backend/internal/httpd/apispec/specgen/build.go (3720 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5803bddb2435a963", "name": "Very large file: backend/internal/httpd/controllers/conversations.go (1770 lines)", "shortDescription": {"text": "Very large file: backend/internal/httpd/controllers/conversations.go (1770 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-27749776d4ac9903", "name": "Very large file: backend/internal/httpd/controllers/sessions_test.go (5237 lines)", "shortDescription": {"text": "Very large file: backend/internal/httpd/controllers/sessions_test.go (5237 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2212741c0c140efd", "name": "Very large file: backend/internal/httpd/controllers/sessions.go (3187 lines)", "shortDescription": {"text": "Very large file: backend/internal/httpd/controllers/sessions.go (3187 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c334d41bdba760e", "name": "Very large file: backend/internal/httpd/controllers/dto.go (3807 lines)", "shortDescription": {"text": "Very large file: backend/internal/httpd/controllers/dto.go (3807 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-782434daf005c354", "name": "Very large file: backend/internal/lifecycle/manager_test.go (4970 lines)", "shortDescription": {"text": "Very large file: backend/internal/lifecycle/manager_test.go (4970 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-034f93d86438a180", "name": "Very large file: backend/internal/lifecycle/manager.go (1888 lines)", "shortDescription": {"text": "Very large file: backend/internal/lifecycle/manager.go (1888 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6fd5575d184c8605", "name": "Very large file: backend/internal/daemon/daemon.go (1388 lines)", "shortDescription": {"text": "Very large file: backend/internal/daemon/daemon.go (1388 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8888981ac80fe253", "name": "Very large file: backend/internal/service/usage/collector.go (2361 lines)", "shortDescription": {"text": "Very large file: backend/internal/service/usage/collector.go (2361 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d0b84ba76274825c", "name": "Very large file: backend/internal/service/usage/collector_test.go (2270 lines)", "shortDescription": {"text": "Very large file: backend/internal/service/usage/collector_test.go (2270 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-836cf732c45e1f06", "name": "Very large file: backend/internal/service/shellterm/service_test.go (2306 lines)", "shortDescription": {"text": "Very large file: backend/internal/service/shellterm/service_test.go (2306 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5e46df9d5befb198", "name": "Very large file: backend/internal/service/agent/catalog_test.go (2794 lines)", "shortDescription": {"text": "Very large file: backend/internal/service/agent/catalog_test.go (2794 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-364234e163765d61", "name": "Very large file: backend/internal/service/agent/codex_accounts_test.go (2513 lines)", "shortDescription": {"text": "Very large file: backend/internal/service/agent/codex_accounts_test.go (2513 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8151efe43001d19", "name": "Very large file: backend/internal/service/chat/history.go (1227 lines)", "shortDescription": {"text": "Very large file: backend/internal/service/chat/history.go (1227 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-08e44fb94ee2d9ad", "name": "Very large file: backend/internal/service/chat/controller_test.go (7219 lines)", "shortDescription": {"text": "Very large file: backend/internal/service/chat/controller_test.go (7219 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-60f0c8cdbb91a9b5", "name": "Very large file: backend/internal/service/chat/controller.go (4012 lines)", "shortDescription": {"text": "Very large file: backend/internal/service/chat/controller.go (4012 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c5401d38ea2a570b", "name": "Very large file: backend/internal/service/chat/history_test.go (2951 lines)", "shortDescription": {"text": "Very large file: backend/internal/service/chat/history_test.go (2951 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c375ae29d763e31", "name": "Very large file: backend/internal/service/chat/hibernate_test.go (1231 lines)", "shortDescription": {"text": "Very large file: backend/internal/service/chat/hibernate_test.go (1231 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-26ad4924e2fa9a88", "name": "Very large file: backend/internal/service/chat/service.go (3046 lines)", "shortDescription": {"text": "Very large file: backend/internal/service/chat/service.go (3046 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d4fd8e0a23e35e6", "name": "Very large file: backend/internal/service/chat/side.go (2043 lines)", "shortDescription": {"text": "Very large file: backend/internal/service/chat/side.go (2043 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e2bb5e2b73b859a9", "name": "Very large file: backend/internal/service/systeminstall/systeminstall.go (2037 lines)", "shortDescription": {"text": "Very large file: backend/internal/service/systeminstall/systeminstall.go (2037 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bbca66a4fd480773", "name": "Very large file: backend/internal/service/systeminstall/systeminstall_test.go (2038 lines)", "shortDescription": {"text": "Very large file: backend/internal/service/systeminstall/systeminstall_test.go (2038 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3082361ecb610afb", "name": "Very large file: backend/internal/service/session/workspace_files.go (2939 lines)", "shortDescription": {"text": "Very large file: backend/internal/service/session/workspace_files.go (2939 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-dac701352b52da36", "name": "Very large file: backend/internal/service/session/service_test.go (5986 lines)", "shortDescription": {"text": "Very large file: backend/internal/service/session/service_test.go (5986 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c688d2e7b097bfd4", "name": "Very large file: backend/internal/service/session/service.go (1714 lines)", "shortDescription": {"text": "Very large file: backend/internal/service/session/service.go (1714 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-831a83faa7b026a5", "name": "Very large file: backend/internal/service/project/service_test.go (2497 lines)", "shortDescription": {"text": "Very large file: backend/internal/service/project/service_test.go (2497 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2f072ecc18776c6d", "name": "Very large file: backend/internal/ports/chat.go (1280 lines)", "shortDescription": {"text": "Very large file: backend/internal/ports/chat.go (1280 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7f4cf778e4f380d7", "name": "Very large file: backend/internal/session_manager/chat_spawn_test.go (2019 lines)", "shortDescription": {"text": "Very large file: backend/internal/session_manager/chat_spawn_test.go (2019 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-38c11b11fc22d1d1", "name": "Very large file: backend/internal/session_manager/manager_test.go (11998 lines)", "shortDescription": {"text": "Very large file: backend/internal/session_manager/manager_test.go (11998 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5ddd41dbf519abe0", "name": "Very large file: backend/internal/session_manager/interface_transition.go (1904 lines)", "shortDescription": {"text": "Very large file: backend/internal/session_manager/interface_transition.go (1904 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-51c6488ca64b0bc5", "name": "Very large file: backend/internal/session_manager/manager.go (7070 lines)", "shortDescription": {"text": "Very large file: backend/internal/session_manager/manager.go (7070 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-82dc3e56bc4e66d8", "name": "Very large file: backend/internal/session_manager/interface_transition_test.go (3390 lines)", "shortDescription": {"text": "Very large file: backend/internal/session_manager/interface_transition_test.go (3390 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a0582912ed11f4dc", "name": "Very large file: backend/internal/storage/sqlite/db.go (2311 lines)", "shortDescription": {"text": "Very large file: backend/internal/storage/sqlite/db.go (2311 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5a60ef4fd2f816af", "name": "Very large file: backend/internal/storage/sqlite/gen/usage.sql.go (1785 lines)", "shortDescription": {"text": "Very large file: backend/internal/storage/sqlite/gen/usage.sql.go (1785 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-73f4832dd0d6f168", "name": "Very large file: backend/internal/storage/sqlite/gen/conversations.sql.go (4839 lines)", "shortDescription": {"text": "Very large file: backend/internal/storage/sqlite/gen/conversations.sql.go (4839 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b21a22dceed0fa8f", "name": "Very large file: backend/internal/storage/sqlite/gen/sessions.sql.go (2254 lines)", "shortDescription": {"text": "Very large file: backend/internal/storage/sqlite/gen/sessions.sql.go (2254 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d5830396971244c2", "name": "Very large file: backend/internal/storage/sqlite/store/conversation_branch_store_test.go (1250 lines)", "shortDescription": {"text": "Very large file: backend/internal/storage/sqlite/store/conversation_branch_store_test.go (1250 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9c0184cb7333d091", "name": "Very large file: backend/internal/storage/sqlite/store/store_test.go (2545 lines)", "shortDescription": {"text": "Very large file: backend/internal/storage/sqlite/store/store_test.go (2545 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e99e00ae8ff0363", "name": "Very large file: backend/internal/storage/sqlite/store/session_store.go (1288 lines)", "shortDescription": {"text": "Very large file: backend/internal/storage/sqlite/store/session_store.go (1288 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a686787ee9c564b", "name": "Very large file: backend/internal/storage/sqlite/store/usage_store_test.go (2110 lines)", "shortDescription": {"text": "Very large file: backend/internal/storage/sqlite/store/usage_store_test.go (2110 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f39cd22ea1325d9d", "name": "Very large file: backend/internal/storage/sqlite/store/conversation_store.go (4603 lines)", "shortDescription": {"text": "Very large file: backend/internal/storage/sqlite/store/conversation_store.go (4603 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-978f2136b993d868", "name": "Very large file: backend/internal/storage/sqlite/store/conversation_history_store_test.go (1752 lines)", "shortDescription": {"text": "Very large file: backend/internal/storage/sqlite/store/conversation_history_store_test.go (1752 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e2c9b1ab3b906d5", "name": "Node manifest has dependencies but no lockfile: packages/ao/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/ao/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 123 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 1098 placeholder/mock markers across 299 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a3d768a9c62612a0", "name": "Fire-and-forget `fetch()` has no rejection handler \u2014 frontend/src/main.ts:671", "shortDescription": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 frontend/src/main.ts:671"}, "fullDescription": {"text": "This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-68d1ca0150e43926", "name": "Legacy-named symbol `clearsLegacy` in frontend/src/renderer/components/AutomationsView.tsx:259", "shortDescription": {"text": "Legacy-named symbol `clearsLegacy` in frontend/src/renderer/components/AutomationsView.tsx:259"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b893f831710f438d", "name": "Fire-and-forget `fetch()` has no rejection handler \u2014 frontend/src/renderer/lib/event-transport.ts:83", "shortDescription": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 frontend/src/renderer/lib/event-transport.ts:83"}, "fullDescription": {"text": "This fetch result is neither awaited, returned, assigned, nor followed by `.catch(...)`. A network failure can therefore become an unhandled promise rejection. Await/return the promise or attach an explicit rejection handler."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-b3000bd1d687a1db", "name": "Network/subprocess call without timeout or try/except \u2014 cloud/scripts/verify-ecs-service.py:18", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 cloud/scripts/verify-ecs-service.py:18"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-d3072c65de877431", "name": "Network/subprocess call without timeout or try/except \u2014 cloud/scripts/configure-offering-monitoring.py:81", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 cloud/scripts/configure-offering-monitoring.py:81"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-fefcae27e6271e53", "name": "Network/subprocess call without timeout or try/except \u2014 cloud/scripts/configure-monitoring.py:17", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 cloud/scripts/configure-monitoring.py:17"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 0.85}}, {"id": "scanner-ebbfbb7098bc1529", "name": "Commented-code block (7 lines) in packages/mobile/lib/theme.ts:3", "shortDescription": {"text": "Commented-code block (7 lines) in packages/mobile/lib/theme.ts:3"}, "fullDescription": {"text": "4 of 7 consecutive comment lines look like executable statements. Confirm the block is obsolete, then delete it or recover it from git history when needed."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 0.72}}, {"id": "scanner-b510aba8874ac1df", "name": "Legacy-named symbol `firstOld` in packages/mobile/lib/files/model.ts:151", "shortDescription": {"text": "Legacy-named symbol `firstOld` in packages/mobile/lib/files/model.ts:151"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-66bce55719c47e5f", "name": "92 env vars used in code but missing from .env.example", "shortDescription": {"text": "92 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `AO_ACP_RUNTIME_DIR`, `AO_AGENT_BROWSER_PATH`, `AO_ALLOWED_ORIGINS`, `AO_APP_RUN_ID`, `AO_ARTIFACTS_DIR`, `AO_CLOUDFLARED_PATH`, `AO_CLOUD_ALERT_TOPIC_ARN`, `AO_CLOUD_AUTH_REDIRECT` + 84 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af78b763ccb22eec", "name": "Vulnerable dependency dompurify 3.4.14: GHSA-6688-9rhm-gjv2", "shortDescription": {"text": "Vulnerable dependency dompurify 3.4.14: GHSA-6688-9rhm-gjv2"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `3.4.14` (resolved in `frontend/package-lock.json`) is affected by GHSA-6688-9rhm-gjv2.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-6688-9rhm-gjv2\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2f31d4512ab168cc", "name": "Vulnerable dependency dompurify 3.4.14: GHSA-p98j-92pf-mc4p", "shortDescription": {"text": "Vulnerable dependency dompurify 3.4.14: GHSA-p98j-92pf-mc4p"}, "fullDescription": {"text": "OSV.dev reports `dompurify` at version `3.4.14` (resolved in `frontend/package-lock.json`) is affected by GHSA-p98j-92pf-mc4p.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p98j-92pf-mc4p\nFix: upgrade `dompurify` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fff719fdfb6d2bc6", "name": "Vulnerable dependency vite 8.0.16: GHSA-587h-7wmj-h5pm", "shortDescription": {"text": "Vulnerable dependency vite 8.0.16: GHSA-587h-7wmj-h5pm"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `8.0.16` (resolved in `frontend/package-lock.json`) is affected by GHSA-587h-7wmj-h5pm (aka CVE-2026-112942).\n\nlaunch-editor: `fs.existsSync()` existence check can be bypassed on Windows\n\nAliases: CVE-2026-112942\nAdvisory: https://osv.dev/vulnerability/GHSA-587h-7wmj-h5pm\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-d7114fb2db47b878", "name": "Vulnerable dependency vite 8.0.16: GHSA-698v-4r3x-3vcv", "shortDescription": {"text": "Vulnerable dependency vite 8.0.16: GHSA-698v-4r3x-3vcv"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `8.0.16` (resolved in `frontend/package-lock.json`) is affected by GHSA-698v-4r3x-3vcv (aka CVE-2026-112943).\n\nlaunch-editor: escapeCmdArgs() omits % escaping on Windows\n\nAliases: CVE-2026-112943\nAdvisory: https://osv.dev/vulnerability/GHSA-698v-4r3x-3vcv\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-efe16c5d7a3bcea8", "name": "Vulnerable dependency vite 8.0.16: GHSA-9jrq-w75r-8gcw", "shortDescription": {"text": "Vulnerable dependency vite 8.0.16: GHSA-9jrq-w75r-8gcw"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `8.0.16` (resolved in `frontend/package-lock.json`) is affected by GHSA-9jrq-w75r-8gcw (aka CVE-2026-112945).\n\nVite: Cross origin script execution through Vite custom middleware\n\nAliases: CVE-2026-112945\nAdvisory: https://osv.dev/vulnerability/GHSA-9jrq-w75r-8gcw\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-75883af3802831db", "name": "Vulnerable dependency vite 8.0.16: GHSA-r825-w8mm-5pxw", "shortDescription": {"text": "Vulnerable dependency vite 8.0.16: GHSA-r825-w8mm-5pxw"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `8.0.16` (resolved in `frontend/package-lock.json`) is affected by GHSA-r825-w8mm-5pxw (aka CVE-2026-112944).\n\nlaunch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors\n\nAliases: CVE-2026-112944\nAdvisory: https://osv.dev/vulnerability/GHSA-r825-w8mm-5pxw\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-6658870ec2fac2c1", "name": "Vulnerable dependency vite 8.0.16: GHSA-rq7h-c2jc-7f22", "shortDescription": {"text": "Vulnerable dependency vite 8.0.16: GHSA-rq7h-c2jc-7f22"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `8.0.16` (resolved in `frontend/package-lock.json`) is affected by GHSA-rq7h-c2jc-7f22 (aka CVE-2026-112946).\n\nVite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine\n\nAliases: CVE-2026-112946\nAdvisory: https://osv.dev/vulnerability/GHSA-rq7h-c2jc-7f22\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-caebe3537d7697c4", "name": "Vulnerable dependency vitest 4.1.8: GHSA-82fw-gwwq-j7x9", "shortDescription": {"text": "Vulnerable dependency vitest 4.1.8: GHSA-82fw-gwwq-j7x9"}, "fullDescription": {"text": "OSV.dev reports `vitest` at version `4.1.8` (resolved in `frontend/package-lock.json`) is affected by GHSA-82fw-gwwq-j7x9 (aka CVE-2026-84373).\n\nVitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock\n\nAliases: CVE-2026-84373\nAdvisory: https://osv.dev/vulnerability/GHSA-82fw-gwwq-j7x9\nFix: upgrade `vitest` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-8056188a51053e9f", "name": "Vulnerable dependency next 16.2.11: GHSA-2xp9-vwfh-vxw4", "shortDescription": {"text": "Vulnerable dependency next 16.2.11: GHSA-2xp9-vwfh-vxw4"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.11` (resolved in `frontend/src/docs/package-lock.json`) is affected by GHSA-2xp9-vwfh-vxw4.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-2xp9-vwfh-vxw4\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b3c418f48d2c1e3b", "name": "Vulnerable dependency next 16.2.11: GHSA-39w2-rjm5-chcv", "shortDescription": {"text": "Vulnerable dependency next 16.2.11: GHSA-39w2-rjm5-chcv"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.11` (resolved in `frontend/src/docs/package-lock.json`) is affected by GHSA-39w2-rjm5-chcv.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-39w2-rjm5-chcv\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a2c40dddb129fd1b", "name": "Vulnerable dependency next 16.2.11: GHSA-4jqv-mc3x-m676", "shortDescription": {"text": "Vulnerable dependency next 16.2.11: GHSA-4jqv-mc3x-m676"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.11` (resolved in `frontend/src/docs/package-lock.json`) is affected by GHSA-4jqv-mc3x-m676.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-4jqv-mc3x-m676\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a7d0b5c4d7976bbf", "name": "Vulnerable dependency next 16.2.11: GHSA-cjq9-62q9-8jv4", "shortDescription": {"text": "Vulnerable dependency next 16.2.11: GHSA-cjq9-62q9-8jv4"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.11` (resolved in `frontend/src/docs/package-lock.json`) is affected by GHSA-cjq9-62q9-8jv4.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-cjq9-62q9-8jv4\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-de1f6e7e3d0d1da4", "name": "Vulnerable dependency next 16.2.11: GHSA-f87g-xv8r-7p7x", "shortDescription": {"text": "Vulnerable dependency next 16.2.11: GHSA-f87g-xv8r-7p7x"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.11` (resolved in `frontend/src/docs/package-lock.json`) is affected by GHSA-f87g-xv8r-7p7x.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-f87g-xv8r-7p7x\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4145bf5e051924cb", "name": "Vulnerable dependency next 16.2.11: GHSA-mcj8-r9mp-w47p", "shortDescription": {"text": "Vulnerable dependency next 16.2.11: GHSA-mcj8-r9mp-w47p"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.11` (resolved in `frontend/src/docs/package-lock.json`) is affected by GHSA-mcj8-r9mp-w47p.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-mcj8-r9mp-w47p\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f84f3e2f481445c8", "name": "Vulnerable dependency next 16.2.11: GHSA-p293-qw3h-jr36", "shortDescription": {"text": "Vulnerable dependency next 16.2.11: GHSA-p293-qw3h-jr36"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.11` (resolved in `frontend/src/docs/package-lock.json`) is affected by GHSA-p293-qw3h-jr36.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-p293-qw3h-jr36\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a857558437b3d553", "name": "Vulnerable dependency next 16.2.11: GHSA-vcvr-r3jv-pc5j", "shortDescription": {"text": "Vulnerable dependency next 16.2.11: GHSA-vcvr-r3jv-pc5j"}, "fullDescription": {"text": "OSV.dev reports `next` at version `16.2.11` (resolved in `frontend/src/docs/package-lock.json`) is affected by GHSA-vcvr-r3jv-pc5j.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vcvr-r3jv-pc5j\nFix: upgrade `next` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4917e7c20564ceab", "name": "Vulnerable dependency vite 8.2.1: GHSA-587h-7wmj-h5pm", "shortDescription": {"text": "Vulnerable dependency vite 8.2.1: GHSA-587h-7wmj-h5pm"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `8.2.1` (resolved in `packages/product-ui/package-lock.json`) is affected by GHSA-587h-7wmj-h5pm (aka CVE-2026-112942).\n\nlaunch-editor: `fs.existsSync()` existence check can be bypassed on Windows\n\nAliases: CVE-2026-112942\nAdvisory: https://osv.dev/vulnerability/GHSA-587h-7wmj-h5pm\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-c316d1f0d4228300", "name": "Vulnerable dependency vite 8.2.1: GHSA-698v-4r3x-3vcv", "shortDescription": {"text": "Vulnerable dependency vite 8.2.1: GHSA-698v-4r3x-3vcv"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `8.2.1` (resolved in `packages/product-ui/package-lock.json`) is affected by GHSA-698v-4r3x-3vcv (aka CVE-2026-112943).\n\nlaunch-editor: escapeCmdArgs() omits % escaping on Windows\n\nAliases: CVE-2026-112943\nAdvisory: https://osv.dev/vulnerability/GHSA-698v-4r3x-3vcv\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-fd29a0babd5d5bc0", "name": "Vulnerable dependency vite 8.2.1: GHSA-9jrq-w75r-8gcw", "shortDescription": {"text": "Vulnerable dependency vite 8.2.1: GHSA-9jrq-w75r-8gcw"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `8.2.1` (resolved in `packages/product-ui/package-lock.json`) is affected by GHSA-9jrq-w75r-8gcw (aka CVE-2026-112945).\n\nVite: Cross origin script execution through Vite custom middleware\n\nAliases: CVE-2026-112945\nAdvisory: https://osv.dev/vulnerability/GHSA-9jrq-w75r-8gcw\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-160beed3328fb274", "name": "Vulnerable dependency vite 8.2.1: GHSA-r825-w8mm-5pxw", "shortDescription": {"text": "Vulnerable dependency vite 8.2.1: GHSA-r825-w8mm-5pxw"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `8.2.1` (resolved in `packages/product-ui/package-lock.json`) is affected by GHSA-r825-w8mm-5pxw (aka CVE-2026-112944).\n\nlaunch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors\n\nAliases: CVE-2026-112944\nAdvisory: https://osv.dev/vulnerability/GHSA-r825-w8mm-5pxw\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-d5d4a7510072137a", "name": "Vulnerable dependency vite 8.2.1: GHSA-rq7h-c2jc-7f22", "shortDescription": {"text": "Vulnerable dependency vite 8.2.1: GHSA-rq7h-c2jc-7f22"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `8.2.1` (resolved in `packages/product-ui/package-lock.json`) is affected by GHSA-rq7h-c2jc-7f22 (aka CVE-2026-112946).\n\nVite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine\n\nAliases: CVE-2026-112946\nAdvisory: https://osv.dev/vulnerability/GHSA-rq7h-c2jc-7f22\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-63de8127349310bb", "name": "Vulnerable dependency vite 8.2.1: GHSA-vfpm-58rq-9qcg", "shortDescription": {"text": "Vulnerable dependency vite 8.2.1: GHSA-vfpm-58rq-9qcg"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `8.2.1` (resolved in `packages/product-ui/package-lock.json`) is affected by GHSA-vfpm-58rq-9qcg (aka CVE-2026-112947).\n\nVite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`\n\nAliases: CVE-2026-112947\nAdvisory: https://osv.dev/vulnerability/GHSA-vfpm-58rq-9qcg\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-dc79c915c47aa77e", "name": "Vulnerable dependency vitest 4.1.10: GHSA-82fw-gwwq-j7x9", "shortDescription": {"text": "Vulnerable dependency vitest 4.1.10: GHSA-82fw-gwwq-j7x9"}, "fullDescription": {"text": "OSV.dev reports `vitest` at version `4.1.10` (resolved in `packages/cloud-client/package-lock.json`) is affected by GHSA-82fw-gwwq-j7x9 (aka CVE-2026-84373).\n\nVitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock\n\nAliases: CVE-2026-84373\nAdvisory: https://osv.dev/vulnerability/GHSA-82fw-gwwq-j7x9\nFix: upgrade `vitest` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-a04a5f1b104cdae1", "name": "Vulnerable dependency vite 8.2.2: GHSA-587h-7wmj-h5pm", "shortDescription": {"text": "Vulnerable dependency vite 8.2.2: GHSA-587h-7wmj-h5pm"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `8.2.2` (resolved in `packages/mobile/package-lock.json`) is affected by GHSA-587h-7wmj-h5pm (aka CVE-2026-112942).\n\nlaunch-editor: `fs.existsSync()` existence check can be bypassed on Windows\n\nAliases: CVE-2026-112942\nAdvisory: https://osv.dev/vulnerability/GHSA-587h-7wmj-h5pm\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-9e4edcc3b1b35187", "name": "Vulnerable dependency vite 8.2.2: GHSA-698v-4r3x-3vcv", "shortDescription": {"text": "Vulnerable dependency vite 8.2.2: GHSA-698v-4r3x-3vcv"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `8.2.2` (resolved in `packages/mobile/package-lock.json`) is affected by GHSA-698v-4r3x-3vcv (aka CVE-2026-112943).\n\nlaunch-editor: escapeCmdArgs() omits % escaping on Windows\n\nAliases: CVE-2026-112943\nAdvisory: https://osv.dev/vulnerability/GHSA-698v-4r3x-3vcv\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-f37a752d1714f684", "name": "Vulnerable dependency vite 8.2.2: GHSA-9jrq-w75r-8gcw", "shortDescription": {"text": "Vulnerable dependency vite 8.2.2: GHSA-9jrq-w75r-8gcw"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `8.2.2` (resolved in `packages/mobile/package-lock.json`) is affected by GHSA-9jrq-w75r-8gcw (aka CVE-2026-112945).\n\nVite: Cross origin script execution through Vite custom middleware\n\nAliases: CVE-2026-112945\nAdvisory: https://osv.dev/vulnerability/GHSA-9jrq-w75r-8gcw\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-4228033814a8d2a2", "name": "Vulnerable dependency vite 8.2.2: GHSA-r825-w8mm-5pxw", "shortDescription": {"text": "Vulnerable dependency vite 8.2.2: GHSA-r825-w8mm-5pxw"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `8.2.2` (resolved in `packages/mobile/package-lock.json`) is affected by GHSA-r825-w8mm-5pxw (aka CVE-2026-112944).\n\nlaunch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors\n\nAliases: CVE-2026-112944\nAdvisory: https://osv.dev/vulnerability/GHSA-r825-w8mm-5pxw\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-68c9377ebaa09330", "name": "Vulnerable dependency vite 8.2.2: GHSA-rq7h-c2jc-7f22", "shortDescription": {"text": "Vulnerable dependency vite 8.2.2: GHSA-rq7h-c2jc-7f22"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `8.2.2` (resolved in `packages/mobile/package-lock.json`) is affected by GHSA-rq7h-c2jc-7f22 (aka CVE-2026-112946).\n\nVite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine\n\nAliases: CVE-2026-112946\nAdvisory: https://osv.dev/vulnerability/GHSA-rq7h-c2jc-7f22\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-a36d0725c0938f5c", "name": "Vulnerable dependency vite 8.2.2: GHSA-vfpm-58rq-9qcg", "shortDescription": {"text": "Vulnerable dependency vite 8.2.2: GHSA-vfpm-58rq-9qcg"}, "fullDescription": {"text": "OSV.dev reports `vite` at version `8.2.2` (resolved in `packages/mobile/package-lock.json`) is affected by GHSA-vfpm-58rq-9qcg (aka CVE-2026-112947).\n\nVite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`\n\nAliases: CVE-2026-112947\nAdvisory: https://osv.dev/vulnerability/GHSA-vfpm-58rq-9qcg\nFix: upgrade `vite` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-71e98deddbb5e021", "name": "Vulnerable dependency fast-uri 3.1.6: GHSA-58mr-gqgx-xq4g", "shortDescription": {"text": "Vulnerable dependency fast-uri 3.1.6: GHSA-58mr-gqgx-xq4g"}, "fullDescription": {"text": "OSV.dev reports `fast-uri` at version `3.1.6` (resolved in `frontend/acp-runtime/package-lock.json`) is affected by GHSA-58mr-gqgx-xq4g.\nNote: `fast-uri` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-58mr-gqgx-xq4g\nFix: upgrade `fast-uri` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-9f00762fb5e84dc0", "name": "Vulnerable dependency fast-uri 3.1.6: GHSA-hrr3-gc8f-f4qj", "shortDescription": {"text": "Vulnerable dependency fast-uri 3.1.6: GHSA-hrr3-gc8f-f4qj"}, "fullDescription": {"text": "OSV.dev reports `fast-uri` at version `3.1.6` (resolved in `frontend/acp-runtime/package-lock.json`) is affected by GHSA-hrr3-gc8f-f4qj.\nNote: `fast-uri` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-hrr3-gc8f-f4qj\nFix: upgrade `fast-uri` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-c58c63739761c60b", "name": "Vulnerable dependency fast-uri 3.1.6: GHSA-qw65-cvwx-89v3", "shortDescription": {"text": "Vulnerable dependency fast-uri 3.1.6: GHSA-qw65-cvwx-89v3"}, "fullDescription": {"text": "OSV.dev reports `fast-uri` at version `3.1.6` (resolved in `frontend/acp-runtime/package-lock.json`) is affected by GHSA-qw65-cvwx-89v3.\nNote: `fast-uri` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-qw65-cvwx-89v3\nFix: upgrade `fast-uri` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-927e8ae7d918a3d7", "name": "Vulnerable dependency ip-address 10.5.0: GHSA-2vr4-cq9g-pvrc", "shortDescription": {"text": "Vulnerable dependency ip-address 10.5.0: GHSA-2vr4-cq9g-pvrc"}, "fullDescription": {"text": "OSV.dev reports `ip-address` at version `10.5.0` (resolved in `frontend/acp-runtime/package-lock.json`) is affected by GHSA-2vr4-cq9g-pvrc.\nNote: `ip-address` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-2vr4-cq9g-pvrc\nFix: upgrade `ip-address` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-fb38d8bf25ab029c", "name": "Vulnerable dependency ip-address 10.5.0: GHSA-h3mg-xc3c-68pw", "shortDescription": {"text": "Vulnerable dependency ip-address 10.5.0: GHSA-h3mg-xc3c-68pw"}, "fullDescription": {"text": "OSV.dev reports `ip-address` at version `10.5.0` (resolved in `frontend/acp-runtime/package-lock.json`) is affected by GHSA-h3mg-xc3c-68pw.\nNote: `ip-address` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-h3mg-xc3c-68pw\nFix: upgrade `ip-address` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-caedc7aaa2cff90d", "name": "Vulnerable dependency ip-address 10.5.0: GHSA-j6r3-76f7-8jcv", "shortDescription": {"text": "Vulnerable dependency ip-address 10.5.0: GHSA-j6r3-76f7-8jcv"}, "fullDescription": {"text": "OSV.dev reports `ip-address` at version `10.5.0` (resolved in `frontend/acp-runtime/package-lock.json`) is affected by GHSA-j6r3-76f7-8jcv.\nNote: `ip-address` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-j6r3-76f7-8jcv\nFix: upgrade `ip-address` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-3677a4173cc02cbe", "name": "Vulnerable dependency ip-address 10.5.0: GHSA-rpw4-54j3-4h4q", "shortDescription": {"text": "Vulnerable dependency ip-address 10.5.0: GHSA-rpw4-54j3-4h4q"}, "fullDescription": {"text": "OSV.dev reports `ip-address` at version `10.5.0` (resolved in `frontend/acp-runtime/package-lock.json`) is affected by GHSA-rpw4-54j3-4h4q.\nNote: `ip-address` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-rpw4-54j3-4h4q\nFix: upgrade `ip-address` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-56d85870cf45a322", "name": "Vulnerable dependency proxy-addr 2.0.7: GHSA-jqcg-44mw-7w3h", "shortDescription": {"text": "Vulnerable dependency proxy-addr 2.0.7: GHSA-jqcg-44mw-7w3h"}, "fullDescription": {"text": "OSV.dev reports `proxy-addr` at version `2.0.7` (resolved in `frontend/acp-runtime/package-lock.json`) is affected by GHSA-jqcg-44mw-7w3h.\nNote: `proxy-addr` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-jqcg-44mw-7w3h\nFix: upgrade `proxy-addr` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-4de4f2693cda9cff", "name": "Vulnerable dependency qs 6.15.3: GHSA-4mjr-xmp4-gh2g", "shortDescription": {"text": "Vulnerable dependency qs 6.15.3: GHSA-4mjr-xmp4-gh2g"}, "fullDescription": {"text": "OSV.dev reports `qs` at version `6.15.3` (resolved in `frontend/acp-runtime/package-lock.json`) is affected by GHSA-4mjr-xmp4-gh2g.\nNote: `qs` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-4mjr-xmp4-gh2g\nFix: upgrade `qs` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-0fb04e715d1c7621", "name": "Vulnerable dependency qs 6.15.3: GHSA-x5fp-wj9c-mxmx", "shortDescription": {"text": "Vulnerable dependency qs 6.15.3: GHSA-x5fp-wj9c-mxmx"}, "fullDescription": {"text": "OSV.dev reports `qs` at version `6.15.3` (resolved in `frontend/acp-runtime/package-lock.json`) is affected by GHSA-x5fp-wj9c-mxmx.\nNote: `qs` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-x5fp-wj9c-mxmx\nFix: upgrade `qs` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-a6d0f7906830bd98", "name": "Vulnerable dependency tar 6.2.1: GHSA-23hp-3jrh-7fpw", "shortDescription": {"text": "Vulnerable dependency tar 6.2.1: GHSA-23hp-3jrh-7fpw"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `6.2.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-23hp-3jrh-7fpw (aka CVE-2026-59873).\nNote: `tar` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nnode-tar: Decompression/parse DoS via unlimited input\n\nAliases: CVE-2026-59873\nAdvisory: https://osv.dev/vulnerability/GHSA-23hp-3jrh-7fpw\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-18a336547e134f24", "name": "Vulnerable dependency tar 6.2.1: GHSA-34x7-hfp2-rc4v", "shortDescription": {"text": "Vulnerable dependency tar 6.2.1: GHSA-34x7-hfp2-rc4v"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `6.2.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-34x7-hfp2-rc4v.\nNote: `tar` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-34x7-hfp2-rc4v\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-ace77adcf2f46b1f", "name": "Vulnerable dependency tar 6.2.1: GHSA-83g3-92jg-28cx", "shortDescription": {"text": "Vulnerable dependency tar 6.2.1: GHSA-83g3-92jg-28cx"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `6.2.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-83g3-92jg-28cx.\nNote: `tar` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-83g3-92jg-28cx\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-2acb01ad2fb5175c", "name": "Vulnerable dependency tar 6.2.1: GHSA-8qq5-rm4j-mr97", "shortDescription": {"text": "Vulnerable dependency tar 6.2.1: GHSA-8qq5-rm4j-mr97"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `6.2.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-8qq5-rm4j-mr97.\nNote: `tar` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-8qq5-rm4j-mr97\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-cad9d55f863c0622", "name": "Vulnerable dependency tar 6.2.1: GHSA-8x88-c5mf-7j5w", "shortDescription": {"text": "Vulnerable dependency tar 6.2.1: GHSA-8x88-c5mf-7j5w"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `6.2.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-8x88-c5mf-7j5w.\nNote: `tar` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-8x88-c5mf-7j5w\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-c0652d174da962da", "name": "Vulnerable dependency tar 6.2.1: GHSA-9ppj-qmqm-q256", "shortDescription": {"text": "Vulnerable dependency tar 6.2.1: GHSA-9ppj-qmqm-q256"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `6.2.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-9ppj-qmqm-q256.\nNote: `tar` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-9ppj-qmqm-q256\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-59f8d00e3c78a9f3", "name": "Vulnerable dependency tar 6.2.1: GHSA-gvwx-54wh-qm9j", "shortDescription": {"text": "Vulnerable dependency tar 6.2.1: GHSA-gvwx-54wh-qm9j"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `6.2.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-gvwx-54wh-qm9j.\nNote: `tar` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-gvwx-54wh-qm9j\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-a2b1f9b1ccaa2f9b", "name": "Vulnerable dependency tar 6.2.1: GHSA-qffp-2rhf-9h96", "shortDescription": {"text": "Vulnerable dependency tar 6.2.1: GHSA-qffp-2rhf-9h96"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `6.2.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-qffp-2rhf-9h96.\nNote: `tar` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-qffp-2rhf-9h96\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-b8318fc8febe2ae4", "name": "Vulnerable dependency tar 6.2.1: GHSA-r292-9mhp-454m", "shortDescription": {"text": "Vulnerable dependency tar 6.2.1: GHSA-r292-9mhp-454m"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `6.2.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-r292-9mhp-454m.\nNote: `tar` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-r292-9mhp-454m\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-77377b8c5d8fe93e", "name": "Vulnerable dependency tar 6.2.1: GHSA-r6q2-hw4h-h46w", "shortDescription": {"text": "Vulnerable dependency tar 6.2.1: GHSA-r6q2-hw4h-h46w"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `6.2.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-r6q2-hw4h-h46w.\nNote: `tar` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-r6q2-hw4h-h46w\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-2a3cec1879a4e374", "name": "Vulnerable dependency tar 6.2.1: GHSA-vmf3-w455-68vh", "shortDescription": {"text": "Vulnerable dependency tar 6.2.1: GHSA-vmf3-w455-68vh"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `6.2.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-vmf3-w455-68vh.\nNote: `tar` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-vmf3-w455-68vh\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-6d60371c6f718dfc", "name": "Vulnerable dependency tar 6.2.1: GHSA-w8wr-v893-vjvp", "shortDescription": {"text": "Vulnerable dependency tar 6.2.1: GHSA-w8wr-v893-vjvp"}, "fullDescription": {"text": "OSV.dev reports `tar` at version `6.2.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-w8wr-v893-vjvp.\nNote: `tar` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nNo summary published yet.\n\nAdvisory: https://osv.dev/vulnerability/GHSA-w8wr-v893-vjvp\nFix: upgrade `tar` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-5452e01a31bf09c9", "name": "Vulnerable dependency brace-expansion 1.1.15: GHSA-3jxr-9vmj-r5cp", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.15: GHSA-3jxr-9vmj-r5cp"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.15` (resolved in `frontend/package-lock.json`) is affected by GHSA-3jxr-9vmj-r5cp (aka CVE-2026-13149).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups\n\nAliases: CVE-2026-13149\nAdvisory: https://osv.dev/vulnerability/GHSA-3jxr-9vmj-r5cp\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-9d7997b6f12ae840", "name": "Vulnerable dependency brace-expansion 1.1.15: GHSA-6j4f-fj2g-mc7p", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.15: GHSA-6j4f-fj2g-mc7p"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.15` (resolved in `frontend/package-lock.json`) is affected by GHSA-6j4f-fj2g-mc7p (aka CVE-2026-102276).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion\n\nAliases: CVE-2026-102276\nAdvisory: https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-53788ae09cb4aafc", "name": "Vulnerable dependency brace-expansion 1.1.15: GHSA-mh99-v99m-4gvg", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.15: GHSA-mh99-v99m-4gvg"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.15` (resolved in `frontend/package-lock.json`) is affected by GHSA-mh99-v99m-4gvg (aka CVE-2026-14257).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash\n\nAliases: CVE-2026-14257\nAdvisory: https://osv.dev/vulnerability/GHSA-mh99-v99m-4gvg\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-4dcc93db8ccc0e8b", "name": "Vulnerable dependency brace-expansion 1.1.15: GHSA-q2hr-2g5m-vwhr", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.15: GHSA-q2hr-2g5m-vwhr"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.15` (resolved in `frontend/package-lock.json`) is affected by GHSA-q2hr-2g5m-vwhr (aka CVE-2026-102277).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service\n\nAliases: CVE-2026-102277\nAdvisory: https://osv.dev/vulnerability/GHSA-q2hr-2g5m-vwhr\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-3b117644a3df6da6", "name": "Vulnerable dependency brace-expansion 1.1.15: GHSA-qhr7-859c-m2p7", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.15: GHSA-qhr7-859c-m2p7"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.15` (resolved in `frontend/package-lock.json`) is affected by GHSA-qhr7-859c-m2p7 (aka CVE-2026-102278).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion\n\nAliases: CVE-2026-102278\nAdvisory: https://osv.dev/vulnerability/GHSA-qhr7-859c-m2p7\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-18bb41d994b2bd69", "name": "Vulnerable dependency brace-expansion 1.1.15: GHSA-rgw5-rvv9-x895", "shortDescription": {"text": "Vulnerable dependency brace-expansion 1.1.15: GHSA-rgw5-rvv9-x895"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `1.1.15` (resolved in `frontend/package-lock.json`) is affected by GHSA-rgw5-rvv9-x895 (aka CVE-2026-69152).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation\n\nAliases: CVE-2026-69152\nAdvisory: https://osv.dev/vulnerability/GHSA-rgw5-rvv9-x895\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-87f15d3b75156184", "name": "Vulnerable dependency brace-expansion 2.1.1: GHSA-3jxr-9vmj-r5cp", "shortDescription": {"text": "Vulnerable dependency brace-expansion 2.1.1: GHSA-3jxr-9vmj-r5cp"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `2.1.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-3jxr-9vmj-r5cp (aka CVE-2026-13149).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via exponential-time expansion of consecutive non-expanding {} groups\n\nAliases: CVE-2026-13149\nAdvisory: https://osv.dev/vulnerability/GHSA-3jxr-9vmj-r5cp\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-6a7a3b63d6527a88", "name": "Vulnerable dependency brace-expansion 2.1.1: GHSA-6j4f-fj2g-mc7p", "shortDescription": {"text": "Vulnerable dependency brace-expansion 2.1.1: GHSA-6j4f-fj2g-mc7p"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `2.1.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-6j4f-fj2g-mc7p (aka CVE-2026-102276).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion\n\nAliases: CVE-2026-102276\nAdvisory: https://osv.dev/vulnerability/GHSA-6j4f-fj2g-mc7p\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-9774b68c979fc4f4", "name": "Vulnerable dependency brace-expansion 2.1.1: GHSA-mh99-v99m-4gvg", "shortDescription": {"text": "Vulnerable dependency brace-expansion 2.1.1: GHSA-mh99-v99m-4gvg"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `2.1.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-mh99-v99m-4gvg (aka CVE-2026-14257).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via unbounded expansion length causing an out-of-memory process crash\n\nAliases: CVE-2026-14257\nAdvisory: https://osv.dev/vulnerability/GHSA-mh99-v99m-4gvg\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-fbc6bff27f7c98f9", "name": "Vulnerable dependency brace-expansion 2.1.1: GHSA-q2hr-2g5m-vwhr", "shortDescription": {"text": "Vulnerable dependency brace-expansion 2.1.1: GHSA-q2hr-2g5m-vwhr"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `2.1.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-q2hr-2g5m-vwhr (aka CVE-2026-102277).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service\n\nAliases: CVE-2026-102277\nAdvisory: https://osv.dev/vulnerability/GHSA-q2hr-2g5m-vwhr\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "medium", "confidence": 0.9}}, {"id": "scanner-e634214dc5a52edd", "name": "Vulnerable dependency brace-expansion 2.1.1: GHSA-qhr7-859c-m2p7", "shortDescription": {"text": "Vulnerable dependency brace-expansion 2.1.1: GHSA-qhr7-859c-m2p7"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `2.1.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-qhr7-859c-m2p7 (aka CVE-2026-102278).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion\n\nAliases: CVE-2026-102278\nAdvisory: https://osv.dev/vulnerability/GHSA-qhr7-859c-m2p7\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-1943f6da2f7496d4", "name": "Vulnerable dependency brace-expansion 2.1.1: GHSA-rgw5-rvv9-x895", "shortDescription": {"text": "Vulnerable dependency brace-expansion 2.1.1: GHSA-rgw5-rvv9-x895"}, "fullDescription": {"text": "OSV.dev reports `brace-expansion` at version `2.1.1` (resolved in `frontend/package-lock.json`) is affected by GHSA-rgw5-rvv9-x895 (aka CVE-2026-69152).\nNote: `brace-expansion` is a transitive dependency \u2014 pulled in by another package, not declared directly in a manifest.\n\nbrace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation\n\nAliases: CVE-2026-69152\nAdvisory: https://osv.dev/vulnerability/GHSA-rgw5-rvv9-x895\nFix: upgrade `brace-expansion` past the affected range per the advisory."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "high", "confidence": 0.9}}, {"id": "scanner-91de7b57ddc11545", "name": "Dependency @expo/ui is a major version behind", "shortDescription": {"text": "Dependency @expo/ui is a major version behind"}, "fullDescription": {"text": "`@expo/ui` is pinned at `57.0.14` in `packages/mobile/package.json` while the latest release on the npm registry is `58.0.22` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@expo/ui` to `58.0.22`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-919d3862b3b276ec", "name": "Dependency @react-native-async-storage/async-storage is a major version behind", "shortDescription": {"text": "Dependency @react-native-async-storage/async-storage is a major version behind"}, "fullDescription": {"text": "`@react-native-async-storage/async-storage` is pinned at `2.2.0` in `packages/mobile/package.json` while the latest release on the npm registry is `3.1.1` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@react-native-async-storage/async-storage` to `3.1.1`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-51e683bb9cf600bd", "name": "Dependency @sentry/electron is a major version behind", "shortDescription": {"text": "Dependency @sentry/electron is a major version behind"}, "fullDescription": {"text": "`@sentry/electron` is pinned at `7.17.0` in `frontend/package.json` while the latest release on the npm registry is `8.3.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@sentry/electron` to `8.3.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-4c57c39d36095678", "name": "Dependency @workos-inc/node is a major version behind", "shortDescription": {"text": "Dependency @workos-inc/node is a major version behind"}, "fullDescription": {"text": "`@workos-inc/node` is pinned at `10.9.0` in `frontend/package.json` while the latest release on the npm registry is `11.0.0` \u2014 1 major version(s) behind. Old majors stop receiving security backports and accumulate known CVEs. Review the upstream changelog / migration guide and upgrade `@workos-inc/node` to `11.0.0`."}, "properties": {"scanner": "scanner-primary", "layer": "dependencies", "severity": "low", "confidence": 0.9}}, {"id": "scanner-421e035c996b6b3d", "name": "Dangling fetch: POST /api/cloud/v1/github/user/authorize (packages/cloud-client/src/client.ts:218)", "shortDescription": {"text": "Dangling fetch: POST /api/cloud/v1/github/user/authorize (packages/cloud-client/src/client.ts:218)"}, "fullDescription": {"text": "`packages/cloud-client/src/client.ts:218` calls `POST /api/cloud/v1/github/user/authorize` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it.\n\nTool: helper:request\nNormalized path used for matching: `/cloud/v1/github/user/authorize`"}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 0.9}}, {"id": "scanner-8fa0fe543a54437c", "name": "Dangling fetch: DELETE /api/cloud/v1/github/user (packages/cloud-client/src/client.ts:225)", "shortDescription": {"text": "Dangling fetch: DELETE /api/cloud/v1/github/user (packages/cloud-client/src/client.ts:225)"}, "fullDescription": {"text": "`packages/cloud-client/src/client.ts:225` calls `DELETE /api/cloud/v1/github/user` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it.\n\nTool: helper:request\nNormalized path used for matching: `/cloud/v1/github/user`"}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 0.9}}, {"id": "scanner-1d85d193e118517f", "name": "Dangling fetch: POST /api/cloud/v1/worker/heartbeat (packages/cloud-client/src/client.ts:949)", "shortDescription": {"text": "Dangling fetch: POST /api/cloud/v1/worker/heartbeat (packages/cloud-client/src/client.ts:949)"}, "fullDescription": {"text": "`packages/cloud-client/src/client.ts:949` calls `POST /api/cloud/v1/worker/heartbeat` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it.\n\nTool: helper:request\nNormalized path used for matching: `/cloud/v1/worker/heartbeat`"}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 0.9}}, {"id": "scanner-69f3552c884d9f46", "name": "Dangling fetch: POST /api/cloud/v1/worker/events (packages/cloud-client/src/client.ts:961)", "shortDescription": {"text": "Dangling fetch: POST /api/cloud/v1/worker/events (packages/cloud-client/src/client.ts:961)"}, "fullDescription": {"text": "`packages/cloud-client/src/client.ts:961` calls `POST /api/cloud/v1/worker/events` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it.\n\nTool: helper:request\nNormalized path used for matching: `/cloud/v1/worker/events`"}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 0.9}}, {"id": "scanner-acfacc417c90d659", "name": "Dangling fetch: POST /api/cloud/v1/worker/turns/claim (packages/cloud-client/src/client.ts:969)", "shortDescription": {"text": "Dangling fetch: POST /api/cloud/v1/worker/turns/claim (packages/cloud-client/src/client.ts:969)"}, "fullDescription": {"text": "`packages/cloud-client/src/client.ts:969` calls `POST /api/cloud/v1/worker/turns/claim` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it.\n\nTool: helper:request\nNormalized path used for matching: `/cloud/v1/worker/turns/claim`"}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 0.9}}, {"id": "scanner-9a4c87a619f62d83", "name": "Dangling fetch: POST /api/cloud/v1/worker/turns/${encodeURIComponent(turnId)}/cancellation?${query.toString()} (packages", "shortDescription": {"text": "Dangling fetch: POST /api/cloud/v1/worker/turns/${encodeURIComponent(turnId)}/cancellation?${query.toString()} (packages/cloud-client/src/client.ts:982)"}, "fullDescription": {"text": "`packages/cloud-client/src/client.ts:982` calls `POST /api/cloud/v1/worker/turns/${encodeURIComponent(turnId)}/cancellation?${query.toString()}` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it.\n\nTool: helper:request\nNormalized path used for matching: `/cloud/v1/worker/turns/<p>/cancellation`"}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 0.9}}, {"id": "scanner-2c95cc062027428f", "name": "Dangling fetch: GET /api/cloud/v1/worker/credential?reviewRunId=${encodeURIComponent(reviewRunId)} (packages/cloud-clien", "shortDescription": {"text": "Dangling fetch: GET /api/cloud/v1/worker/credential?reviewRunId=${encodeURIComponent(reviewRunId)} (packages/cloud-client/src/client.ts:1020)"}, "fullDescription": {"text": "`packages/cloud-client/src/client.ts:1020` calls `GET /api/cloud/v1/worker/credential?reviewRunId=${encodeURIComponent(reviewRunId)}` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it.\n\nTool: helper:request\nNormalized path used for matching: `/cloud/v1/worker/credential`"}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 0.9}}, {"id": "scanner-c6aaa4b0d9cf1074", "name": "Dangling fetch: POST /api/cloud/v1/worker/checkout-grant (packages/cloud-client/src/client.ts:1028)", "shortDescription": {"text": "Dangling fetch: POST /api/cloud/v1/worker/checkout-grant (packages/cloud-client/src/client.ts:1028)"}, "fullDescription": {"text": "`packages/cloud-client/src/client.ts:1028` calls `POST /api/cloud/v1/worker/checkout-grant` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it.\n\nTool: helper:request\nNormalized path used for matching: `/cloud/v1/worker/checkout-grant`"}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 0.9}}, {"id": "scanner-e38c22ea162d334f", "name": "Dangling fetch: GET /api/cloud/v1/worker/children${suffix} (packages/cloud-client/src/client.ts:1042)", "shortDescription": {"text": "Dangling fetch: GET /api/cloud/v1/worker/children${suffix} (packages/cloud-client/src/client.ts:1042)"}, "fullDescription": {"text": "`packages/cloud-client/src/client.ts:1042` calls `GET /api/cloud/v1/worker/children${suffix}` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it.\n\nTool: helper:request\nNormalized path used for matching: `/cloud/v1/worker/children/<p>`"}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 0.9}}, {"id": "scanner-5f0ece24a967d4cd", "name": "Dangling fetch: POST /api/cloud/v1/worker/children (packages/cloud-client/src/client.ts:1051)", "shortDescription": {"text": "Dangling fetch: POST /api/cloud/v1/worker/children (packages/cloud-client/src/client.ts:1051)"}, "fullDescription": {"text": "`packages/cloud-client/src/client.ts:1051` calls `POST /api/cloud/v1/worker/children` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it.\n\nTool: helper:request\nNormalized path used for matching: `/cloud/v1/worker/children`"}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 0.9}}, {"id": "scanner-bbb227c824cf89c1", "name": "Dangling fetch: POST /api/cloud/v1/worker/children/${encodeURIComponent(sessionId)}/messages (packages/cloud-client/src/", "shortDescription": {"text": "Dangling fetch: POST /api/cloud/v1/worker/children/${encodeURIComponent(sessionId)}/messages (packages/cloud-client/src/client.ts:1064)"}, "fullDescription": {"text": "`packages/cloud-client/src/client.ts:1064` calls `POST /api/cloud/v1/worker/children/${encodeURIComponent(sessionId)}/messages` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it.\n\nTool: helper:request\nNormalized path used for matching: `/cloud/v1/worker/children/<p>/messages`"}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 0.9}}, {"id": "scanner-098eed23240f3675", "name": "Dangling fetch: POST /api/cloud/v1/worker/transport/${encodeURIComponent(requestId)}/complete (packages/cloud-client/src", "shortDescription": {"text": "Dangling fetch: POST /api/cloud/v1/worker/transport/${encodeURIComponent(requestId)}/complete (packages/cloud-client/src/client.ts:1103)"}, "fullDescription": {"text": "`packages/cloud-client/src/client.ts:1103` calls `POST /api/cloud/v1/worker/transport/${encodeURIComponent(requestId)}/complete` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it.\n\nTool: helper:request\nNormalized path used for matching: `/cloud/v1/worker/transport/<p>/complete`"}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 0.9}}, {"id": "scanner-6cf80ff550f480c2", "name": "Dangling fetch: POST /api/cloud/v1/worker/terminals/${encodeURIComponent(terminalId)}/output (packages/cloud-client/src/", "shortDescription": {"text": "Dangling fetch: POST /api/cloud/v1/worker/terminals/${encodeURIComponent(terminalId)}/output (packages/cloud-client/src/client.ts:1135)"}, "fullDescription": {"text": "`packages/cloud-client/src/client.ts:1135` calls `POST /api/cloud/v1/worker/terminals/${encodeURIComponent(terminalId)}/output` but no backend route in the scanned graph matches that path. This is a likely runtime 404 unless an external gateway or unsupported router provides it.\n\nTool: helper:request\nNormalized path used for matching: `/cloud/v1/worker/terminals/<p>/output`"}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 0.9}}, {"id": "scanner-57442f17e477d110", "name": "1 backend endpoint not called by scanned frontend", "shortDescription": {"text": "1 backend endpoint not called by scanned frontend"}, "fullDescription": {"text": "No scanned frontend call matched these backend routes. Sample: GET /api/search. This is fine when endpoints serve external clients (mobile apps, SDKs, third-party integrations, server-side webhooks). Otherwise document consumers or remove dead routes."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/30844"}, "properties": {"repository": "OrchestratorInc/agent-orchestrator", "repoUrl": "https://github.com/OrchestratorInc/agent-orchestrator", "branch": "main"}, "results": [{"ruleId": "scanner-613d6385a2185559", "level": "note", "message": {"text": "Possibly dead Python function: log_message"}, "properties": {"repobilityId": "965f3150b4af5b2e", "scanner": "scanner-primary", "fingerprint": "613d6385a2185559", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud/scripts/dev-connect-agent-credential.py:132"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a1794532e196da0b", "level": "note", "message": {"text": "Possibly dead Python function: do_GET"}, "properties": {"repobilityId": "2d943bb45e4f13bd", "scanner": "scanner-primary", "fingerprint": "a1794532e196da0b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud/scripts/dev-connect-agent-credential.py:135"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2e27fbddd7a84296", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/makers/maker-dmg.ts:215"}, "properties": {"repobilityId": "a1c0c424d41f432f", "scanner": "scanner-primary", "fingerprint": "2e27fbddd7a84296", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/makers/maker-dmg.ts"}, "region": {"startLine": 215}}}]}, {"ruleId": "scanner-9dc8905e1ee4d5a8", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/main.ts:792"}, "properties": {"repobilityId": "50d7984a9da8fd63", "scanner": "scanner-primary", "fingerprint": "9dc8905e1ee4d5a8", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/main.ts"}, "region": {"startLine": 792}}}]}, {"ruleId": "scanner-a2846cbaf16fce17", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/renderer/main.tsx:81"}, "properties": {"repobilityId": "c16a40e4f2557b96", "scanner": "scanner-primary", "fingerprint": "a2846cbaf16fce17", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/main.tsx"}, "region": {"startLine": 81}}}]}, {"ruleId": "scanner-cacc38d3f03ea364", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/MigrationSection.tsx:192"}, "properties": {"repobilityId": "01c191f033a97cc5", "scanner": "scanner-primary", "fingerprint": "cacc38d3f03ea364", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/MigrationSection.tsx"}, "region": {"startLine": 192}}}]}, {"ruleId": "scanner-92a948e6a5170f50", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SessionsBoardAdapters.tsx:404"}, "properties": {"repobilityId": "6f69f95b689ab12d", "scanner": "scanner-primary", "fingerprint": "92a948e6a5170f50", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/SessionsBoardAdapters.tsx"}, "region": {"startLine": 404}}}]}, {"ruleId": "scanner-7b89eb4ebb363c67", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/CommandPalette.tsx:739"}, "properties": {"repobilityId": "c167d8c816734205", "scanner": "scanner-primary", "fingerprint": "7b89eb4ebb363c67", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/CommandPalette.tsx"}, "region": {"startLine": 739}}}]}, {"ruleId": "scanner-be66724d8681413f", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/RemoteDirectoryPicker.tsx:39"}, "properties": {"repobilityId": "41fe04c0ab9bd7aa", "scanner": "scanner-primary", "fingerprint": "be66724d8681413f", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/RemoteDirectoryPicker.tsx"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-f81560a38ee701ce", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/NotificationCenter.tsx:1030"}, "properties": {"repobilityId": "723211dbd647b30c", "scanner": "scanner-primary", "fingerprint": "f81560a38ee701ce", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/NotificationCenter.tsx"}, "region": {"startLine": 1030}}}]}, {"ruleId": "scanner-937607acf866c774", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/BrowserPanel.tsx:1085"}, "properties": {"repobilityId": "58251f761e9c88a1", "scanner": "scanner-primary", "fingerprint": "937607acf866c774", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/BrowserPanel.tsx"}, "region": {"startLine": 1085}}}]}, {"ruleId": "scanner-93f54791bbf6cad3", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SearchablePicker.tsx:163"}, "properties": {"repobilityId": "e37821196a5140d2", "scanner": "scanner-primary", "fingerprint": "93f54791bbf6cad3", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/SearchablePicker.tsx"}, "region": {"startLine": 163}}}]}, {"ruleId": "scanner-958baa2bd141e0a4", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/OrchestratorChildrenSection.tsx:93"}, "properties": {"repobilityId": "5ca97a986a479c85", "scanner": "scanner-primary", "fingerprint": "958baa2bd141e0a4", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/OrchestratorChildrenSection.tsx"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-85ba224ca5b67050", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/RestartToUpdateDialog.tsx:169"}, "properties": {"repobilityId": "e872a797ff6e3ac6", "scanner": "scanner-primary", "fingerprint": "85ba224ca5b67050", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/RestartToUpdateDialog.tsx"}, "region": {"startLine": 169}}}]}, {"ruleId": "scanner-00c183d56186c04b", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SessionLinkPreviewCard.tsx:118"}, "properties": {"repobilityId": "7ae273d045a88c5c", "scanner": "scanner-primary", "fingerprint": "00c183d56186c04b", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/SessionLinkPreviewCard.tsx"}, "region": {"startLine": 118}}}]}, {"ruleId": "scanner-29baec45241be9b0", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/HomePage.tsx:105"}, "properties": {"repobilityId": "33ad98683c080d13", "scanner": "scanner-primary", "fingerprint": "29baec45241be9b0", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/HomePage.tsx"}, "region": {"startLine": 105}}}]}, {"ruleId": "scanner-2edf7685ca34339b", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SessionFileTabs.tsx:121"}, "properties": {"repobilityId": "7aabf50b5bfaedf4", "scanner": "scanner-primary", "fingerprint": "2edf7685ca34339b", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/SessionFileTabs.tsx"}, "region": {"startLine": 121}}}]}, {"ruleId": "scanner-6034c22e8cdb9708", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/AutomationsView.tsx:93"}, "properties": {"repobilityId": "ec291624debc4149", "scanner": "scanner-primary", "fingerprint": "6034c22e8cdb9708", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/AutomationsView.tsx"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-a5aa70b0125f27f8", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/CoderWorkspaceLinkButton.tsx:75"}, "properties": {"repobilityId": "3f0045b49b1a931a", "scanner": "scanner-primary", "fingerprint": "a5aa70b0125f27f8", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/CoderWorkspaceLinkButton.tsx"}, "region": {"startLine": 75}}}]}, {"ruleId": "scanner-c811c2969102af0a", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/FileContentPane.tsx:289"}, "properties": {"repobilityId": "f1b3ad1ee5b3cd05", "scanner": "scanner-primary", "fingerprint": "c811c2969102af0a", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/FileContentPane.tsx"}, "region": {"startLine": 289}}}]}, {"ruleId": "scanner-e5ed7a4ef91a6224", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/CenterPane.tsx:721"}, "properties": {"repobilityId": "5ed7f0addcbd1329", "scanner": "scanner-primary", "fingerprint": "e5ed7a4ef91a6224", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/CenterPane.tsx"}, "region": {"startLine": 721}}}]}, {"ruleId": "scanner-6f0e4823e927f762", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/PathRow.tsx:18"}, "properties": {"repobilityId": "d65dabe529e7434e", "scanner": "scanner-primary", "fingerprint": "6f0e4823e927f762", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/PathRow.tsx"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-3166df5fabd76d77", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/BranchNamingLabel.tsx:15"}, "properties": {"repobilityId": "4fff79ecd79af9dc", "scanner": "scanner-primary", "fingerprint": "3166df5fabd76d77", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/BranchNamingLabel.tsx"}, "region": {"startLine": 15}}}]}, {"ruleId": "scanner-b0aabc9fb9194de4", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SessionInspector.tsx:621"}, "properties": {"repobilityId": "c11c62796b4df8c9", "scanner": "scanner-primary", "fingerprint": "b0aabc9fb9194de4", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/SessionInspector.tsx"}, "region": {"startLine": 621}}}]}, {"ruleId": "scanner-7717c276d427d293", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/CloudProjectSettingsForm.tsx:124"}, "properties": {"repobilityId": "a80dacfd86ed29ee", "scanner": "scanner-primary", "fingerprint": "7717c276d427d293", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/CloudProjectSettingsForm.tsx"}, "region": {"startLine": 124}}}]}, {"ruleId": "scanner-61e8213b901f8b23", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SessionArtifactsView.tsx:139"}, "properties": {"repobilityId": "02401940497031f5", "scanner": "scanner-primary", "fingerprint": "61e8213b901f8b23", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/SessionArtifactsView.tsx"}, "region": {"startLine": 139}}}]}, {"ruleId": "scanner-71004c7a2bf91215", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/CuesDialog.tsx:237"}, "properties": {"repobilityId": "07d8c9ec4fdfc620", "scanner": "scanner-primary", "fingerprint": "71004c7a2bf91215", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/CuesDialog.tsx"}, "region": {"startLine": 237}}}]}, {"ruleId": "scanner-8f601258e3e9b2f7", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SettingsDialog.tsx:564"}, "properties": {"repobilityId": "d100561066e98235", "scanner": "scanner-primary", "fingerprint": "8f601258e3e9b2f7", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/SettingsDialog.tsx"}, "region": {"startLine": 564}}}]}, {"ruleId": "scanner-7e8fa451e9b4f42f", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/CreateProjectFlow.tsx:2440"}, "properties": {"repobilityId": "39e88e30fc2716fe", "scanner": "scanner-primary", "fingerprint": "7e8fa451e9b4f42f", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/CreateProjectFlow.tsx"}, "region": {"startLine": 2440}}}]}, {"ruleId": "scanner-53cca9f42de320be", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/NewTaskDialog.tsx:152"}, "properties": {"repobilityId": "b0177c9dddc26b28", "scanner": "scanner-primary", "fingerprint": "53cca9f42de320be", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/NewTaskDialog.tsx"}, "region": {"startLine": 152}}}]}, {"ruleId": "scanner-6cfa9813dcf757d5", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SessionMemoryPanel.tsx:667"}, "properties": {"repobilityId": "cd03c46630f846e3", "scanner": "scanner-primary", "fingerprint": "6cfa9813dcf757d5", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/SessionMemoryPanel.tsx"}, "region": {"startLine": 667}}}]}, {"ruleId": "scanner-5f52d360713c58bc", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/TerminalPane.tsx:1551"}, "properties": {"repobilityId": "ed47c8536b9d6a40", "scanner": "scanner-primary", "fingerprint": "5f52d360713c58bc", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/TerminalPane.tsx"}, "region": {"startLine": 1551}}}]}, {"ruleId": "scanner-c9f83462a675d4ba", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/LinkPreviewCard.tsx:76"}, "properties": {"repobilityId": "8340b216cfec0667", "scanner": "scanner-primary", "fingerprint": "c9f83462a675d4ba", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/LinkPreviewCard.tsx"}, "region": {"startLine": 76}}}]}, {"ruleId": "scanner-22d57bc5042da433", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/WorkspaceDiffView.tsx:367"}, "properties": {"repobilityId": "f5c63ee6f18c1a3e", "scanner": "scanner-primary", "fingerprint": "22d57bc5042da433", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/WorkspaceDiffView.tsx"}, "region": {"startLine": 367}}}]}, {"ruleId": "scanner-283f8921d2d7b67c", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/HarnessUpdateNotice.tsx:271"}, "properties": {"repobilityId": "34b96c4d6eba31e3", "scanner": "scanner-primary", "fingerprint": "283f8921d2d7b67c", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/HarnessUpdateNotice.tsx"}, "region": {"startLine": 271}}}]}, {"ruleId": "scanner-25d0d58985f82b49", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/CreateProjectAgentSheet.tsx:496"}, "properties": {"repobilityId": "8ffb765e4f0cf302", "scanner": "scanner-primary", "fingerprint": "25d0d58985f82b49", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/CreateProjectAgentSheet.tsx"}, "region": {"startLine": 496}}}]}, {"ruleId": "scanner-e016b13703f5d96a", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/Sidebar.tsx:980"}, "properties": {"repobilityId": "5c1d1f7266229718", "scanner": "scanner-primary", "fingerprint": "e016b13703f5d96a", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/Sidebar.tsx"}, "region": {"startLine": 980}}}]}, {"ruleId": "scanner-e9cf91fe11a895db", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/ShellTerminalTab.tsx:198"}, "properties": {"repobilityId": "f00ca25576433563", "scanner": "scanner-primary", "fingerprint": "e9cf91fe11a895db", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/ShellTerminalTab.tsx"}, "region": {"startLine": 198}}}]}, {"ruleId": "scanner-b7c2617ba2f051ff", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/ReviewerSelect.tsx:310"}, "properties": {"repobilityId": "b7115fd7117d678b", "scanner": "scanner-primary", "fingerprint": "b7c2617ba2f051ff", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/ReviewerSelect.tsx"}, "region": {"startLine": 310}}}]}, {"ruleId": "scanner-2ddadb7a5ccc4e6d", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/TaskComposer.tsx:923"}, "properties": {"repobilityId": "9af7bc9837849c9a", "scanner": "scanner-primary", "fingerprint": "2ddadb7a5ccc4e6d", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/TaskComposer.tsx"}, "region": {"startLine": 923}}}]}, {"ruleId": "scanner-426bdadb78bf0f23", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/GitHubOnboardingNotice.tsx:159"}, "properties": {"repobilityId": "6cd4ea4a16901575", "scanner": "scanner-primary", "fingerprint": "426bdadb78bf0f23", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/GitHubOnboardingNotice.tsx"}, "region": {"startLine": 159}}}]}, {"ruleId": "scanner-675e336673f6a6f7", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/BrowserProfileButton.tsx:60"}, "properties": {"repobilityId": "c18a6ae6d6c3dea1", "scanner": "scanner-primary", "fingerprint": "675e336673f6a6f7", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/BrowserProfileButton.tsx"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-fa14d44d3edca083", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SessionBranchSummary.tsx:227"}, "properties": {"repobilityId": "de49228540d32c16", "scanner": "scanner-primary", "fingerprint": "fa14d44d3edca083", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/SessionBranchSummary.tsx"}, "region": {"startLine": 227}}}]}, {"ruleId": "scanner-4a48d9ffee61ab75", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/ShellTopbar.tsx:178"}, "properties": {"repobilityId": "c093b4d418959b74", "scanner": "scanner-primary", "fingerprint": "4a48d9ffee61ab75", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/ShellTopbar.tsx"}, "region": {"startLine": 178}}}]}, {"ruleId": "scanner-4b0e1f2a53bf0482", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/ArtifactsView.tsx:150"}, "properties": {"repobilityId": "3fc1ccc49c3b244d", "scanner": "scanner-primary", "fingerprint": "4b0e1f2a53bf0482", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/ArtifactsView.tsx"}, "region": {"startLine": 150}}}]}, {"ruleId": "scanner-231177e21219bcfd", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/SessionsBoard.tsx:256"}, "properties": {"repobilityId": "b1ce903f7caa6996", "scanner": "scanner-primary", "fingerprint": "231177e21219bcfd", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/SessionsBoard.tsx"}, "region": {"startLine": 256}}}]}, {"ruleId": "scanner-5815f2ec22b774e9", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/CloneRepositoryDialog.tsx:303"}, "properties": {"repobilityId": "0348d186e34df1c7", "scanner": "scanner-primary", "fingerprint": "5815f2ec22b774e9", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/CloneRepositoryDialog.tsx"}, "region": {"startLine": 303}}}]}, {"ruleId": "scanner-d0bdff5d01e04bc0", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/ImageDiffView.tsx:113"}, "properties": {"repobilityId": "794e48c3aa0ce471", "scanner": "scanner-primary", "fingerprint": "d0bdff5d01e04bc0", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/ImageDiffView.tsx"}, "region": {"startLine": 113}}}]}, {"ruleId": "scanner-7e0fd130e4db488c", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/RemoteHostsSection.tsx:30"}, "properties": {"repobilityId": "cf91907bcb22deb8", "scanner": "scanner-primary", "fingerprint": "7e0fd130e4db488c", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/RemoteHostsSection.tsx"}, "region": {"startLine": 30}}}]}, {"ruleId": "scanner-8e98d7b0ba106c8b", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/ArtifactHistory.tsx:63"}, "properties": {"repobilityId": "2614d0158d589e51", "scanner": "scanner-primary", "fingerprint": "8e98d7b0ba106c8b", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/ArtifactHistory.tsx"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-bbe1b7da2e0f4ee8", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/TitlebarNav.tsx:158"}, "properties": {"repobilityId": "6607405f4f323a4d", "scanner": "scanner-primary", "fingerprint": "bbe1b7da2e0f4ee8", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/TitlebarNav.tsx"}, "region": {"startLine": 158}}}]}, {"ruleId": "scanner-280f06a4e52cd31b", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/BrowserImportDialog.tsx:419"}, "properties": {"repobilityId": "39f05f577087cca9", "scanner": "scanner-primary", "fingerprint": "280f06a4e52cd31b", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/settings/BrowserImportDialog.tsx"}, "region": {"startLine": 419}}}]}, {"ruleId": "scanner-9278a1c42a58dd56", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/AgentAccountsSection.tsx:152"}, "properties": {"repobilityId": "9ebe3b87c727c3c5", "scanner": "scanner-primary", "fingerprint": "9278a1c42a58dd56", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/settings/AgentAccountsSection.tsx"}, "region": {"startLine": 152}}}]}, {"ruleId": "scanner-4dc771084e003453", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/ConnectMobileContent.tsx:642"}, "properties": {"repobilityId": "b364278dc19978f6", "scanner": "scanner-primary", "fingerprint": "4dc771084e003453", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/settings/ConnectMobileContent.tsx"}, "region": {"startLine": 642}}}]}, {"ruleId": "scanner-241c6cae6c97d20c", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/AgentProviderGroup.tsx:36"}, "properties": {"repobilityId": "54f3b722eaa22ac4", "scanner": "scanner-primary", "fingerprint": "241c6cae6c97d20c", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/settings/AgentProviderGroup.tsx"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-ee2c0582a52573ad", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/AgentSelectMenuItem.tsx:34"}, "properties": {"repobilityId": "c6878ce8dcc4c793", "scanner": "scanner-primary", "fingerprint": "ee2c0582a52573ad", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/settings/AgentSelectMenuItem.tsx"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-65fd13ee6d608f09", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/SettingsOptionMenu.tsx:115"}, "properties": {"repobilityId": "df5dad06220a288e", "scanner": "scanner-primary", "fingerprint": "65fd13ee6d608f09", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/settings/SettingsOptionMenu.tsx"}, "region": {"startLine": 115}}}]}, {"ruleId": "scanner-48d57494913e0c37", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/CodexAccountsSection.tsx:204"}, "properties": {"repobilityId": "6eaedf30cd4eda93", "scanner": "scanner-primary", "fingerprint": "48d57494913e0c37", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/settings/CodexAccountsSection.tsx"}, "region": {"startLine": 204}}}]}, {"ruleId": "scanner-4682f08a6e39e187", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/CodexAccountRow.tsx:43"}, "properties": {"repobilityId": "ef3760850d702100", "scanner": "scanner-primary", "fingerprint": "4682f08a6e39e187", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/settings/CodexAccountRow.tsx"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-4916874dac3dbff5", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/AgentModelCombobox.tsx:308"}, "properties": {"repobilityId": "9301d902de6074a2", "scanner": "scanner-primary", "fingerprint": "4916874dac3dbff5", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/settings/AgentModelCombobox.tsx"}, "region": {"startLine": 308}}}]}, {"ruleId": "scanner-9116b2035d37594b", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/CodexAccountLoginTerminalPanel.tsx:46"}, "properties": {"repobilityId": "3bdcea4801ce4be2", "scanner": "scanner-primary", "fingerprint": "9116b2035d37594b", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/settings/CodexAccountLoginTerminalPanel.tsx"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-07e0146d3d63cc65", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/UpdatesSection.tsx:710"}, "properties": {"repobilityId": "2e41527008b1efb7", "scanner": "scanner-primary", "fingerprint": "07e0146d3d63cc65", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/settings/UpdatesSection.tsx"}, "region": {"startLine": 710}}}]}, {"ruleId": "scanner-9e8c1bcab475e1f1", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/SettingsRow.tsx:25"}, "properties": {"repobilityId": "129d2cf153e682cc", "scanner": "scanner-primary", "fingerprint": "9e8c1bcab475e1f1", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/settings/SettingsRow.tsx"}, "region": {"startLine": 25}}}]}, {"ruleId": "scanner-ae0d8712582f81b9", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/EffortPicker.tsx:104"}, "properties": {"repobilityId": "a48bdeb94905f1f1", "scanner": "scanner-primary", "fingerprint": "ae0d8712582f81b9", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/settings/EffortPicker.tsx"}, "region": {"startLine": 104}}}]}, {"ruleId": "scanner-59deb6565bf8afb4", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/GeneralSettingsSection.tsx:178"}, "properties": {"repobilityId": "e04901d4a9edc0e3", "scanner": "scanner-primary", "fingerprint": "59deb6565bf8afb4", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/settings/GeneralSettingsSection.tsx"}, "region": {"startLine": 178}}}]}, {"ruleId": "scanner-60d0edfa03221ac8", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/harness/HarnessSessionsDialog.tsx:51"}, "properties": {"repobilityId": "0ccf8f90b7fa20fe", "scanner": "scanner-primary", "fingerprint": "60d0edfa03221ac8", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/settings/harness/HarnessSessionsDialog.tsx"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-539206f28f15f4b2", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/settings/harness/HarnessAuthTerminalPanel.tsx:93"}, "properties": {"repobilityId": "df41f419a9c4f1ef", "scanner": "scanner-primary", "fingerprint": "539206f28f15f4b2", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/settings/harness/HarnessAuthTerminalPanel.tsx"}, "region": {"startLine": 93}}}]}, {"ruleId": "scanner-8a457220f1e378a8", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/cloud-workspace/CloudWorkspaceReviewPane.tsx:193"}, "properties": {"repobilityId": "d2e2bcdb7e82d3a5", "scanner": "scanner-primary", "fingerprint": "8a457220f1e378a8", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/cloud-workspace/CloudWorkspaceReviewPane.tsx"}, "region": {"startLine": 193}}}]}, {"ruleId": "scanner-6967dd01e6d19d3e", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/cloud-workspace/CloudFileTree.tsx:52"}, "properties": {"repobilityId": "e5484fd4f68d0a83", "scanner": "scanner-primary", "fingerprint": "6967dd01e6d19d3e", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/cloud-workspace/CloudFileTree.tsx"}, "region": {"startLine": 52}}}]}, {"ruleId": "scanner-43e25b8f7b7dcfc2", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/ui/option-menu.tsx:163"}, "properties": {"repobilityId": "6a5cbbbdf306486f", "scanner": "scanner-primary", "fingerprint": "43e25b8f7b7dcfc2", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/ui/option-menu.tsx"}, "region": {"startLine": 163}}}]}, {"ruleId": "scanner-2e553fd3627f9f60", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/ChatAnnotationSummary.tsx:63"}, "properties": {"repobilityId": "3ec6fe511d7b97b7", "scanner": "scanner-primary", "fingerprint": "2e553fd3627f9f60", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/chat/ChatAnnotationSummary.tsx"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-a4454751ca1bbadb", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/RenderFrame.tsx:328"}, "properties": {"repobilityId": "236ee5f46abbce3a", "scanner": "scanner-primary", "fingerprint": "a4454751ca1bbadb", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/chat/RenderFrame.tsx"}, "region": {"startLine": 328}}}]}, {"ruleId": "scanner-aa73869571ec4a0d", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/ChatStatusBanners.tsx:373"}, "properties": {"repobilityId": "eb99af0cf68de2b0", "scanner": "scanner-primary", "fingerprint": "aa73869571ec4a0d", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/chat/ChatStatusBanners.tsx"}, "region": {"startLine": 373}}}]}, {"ruleId": "scanner-8ab20864c36a619a", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/ComposerEditor.tsx:138"}, "properties": {"repobilityId": "7ceea370a1621f59", "scanner": "scanner-primary", "fingerprint": "8ab20864c36a619a", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/chat/ComposerEditor.tsx"}, "region": {"startLine": 138}}}]}, {"ruleId": "scanner-43db08b13dc2b2ba", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/AgentSwitchPicker.tsx:424"}, "properties": {"repobilityId": "9c202e23d1f396f5", "scanner": "scanner-primary", "fingerprint": "43db08b13dc2b2ba", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/chat/AgentSwitchPicker.tsx"}, "region": {"startLine": 424}}}]}, {"ruleId": "scanner-c78b36c1341564b2", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/CueRunMenu.tsx:331"}, "properties": {"repobilityId": "60f8b89852334ee4", "scanner": "scanner-primary", "fingerprint": "c78b36c1341564b2", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/chat/CueRunMenu.tsx"}, "region": {"startLine": 331}}}]}, {"ruleId": "scanner-64503e17eb93992f", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/src/renderer/components/chat/MermaidBlock.tsx:206"}, "properties": {"repobilityId": "45d825ddcb7b3270", "scanner": "scanner-primary", "fingerprint": "64503e17eb93992f", "layer": "frontend", "severity": "medium", "confidence": 0.8, "tags": ["frontend-quality", "fq.dangerous-html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/chat/MermaidBlock.tsx"}, "region": {"startLine": 206}}}]}, {"ruleId": "scanner-64d51eb43711c9ed", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/TurnSettingsBar.tsx:731"}, "properties": {"repobilityId": "f734e0a0c3765fff", "scanner": "scanner-primary", "fingerprint": "64d51eb43711c9ed", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/chat/TurnSettingsBar.tsx"}, "region": {"startLine": 731}}}]}, {"ruleId": "scanner-8bcf5cb194651a5f", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/ComposerSuggestMenu.tsx:159"}, "properties": {"repobilityId": "fbf2a8b61ac08f2d", "scanner": "scanner-primary", "fingerprint": "8bcf5cb194651a5f", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/chat/ComposerSuggestMenu.tsx"}, "region": {"startLine": 159}}}]}, {"ruleId": "scanner-51a72e7198f973c9", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/ChatWorkspace.tsx:2278"}, "properties": {"repobilityId": "03d4a91364abda95", "scanner": "scanner-primary", "fingerprint": "51a72e7198f973c9", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/chat/ChatWorkspace.tsx"}, "region": {"startLine": 2278}}}]}, {"ruleId": "scanner-3cb0c9c5b7cf751a", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/ChatTimelineItems.tsx:362"}, "properties": {"repobilityId": "3c28748e939deb84", "scanner": "scanner-primary", "fingerprint": "3cb0c9c5b7cf751a", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/chat/ChatTimelineItems.tsx"}, "region": {"startLine": 362}}}]}, {"ruleId": "scanner-f02245f19ad1ad7d", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/ElicitationDock.tsx:195"}, "properties": {"repobilityId": "22c88ff6f00d07b4", "scanner": "scanner-primary", "fingerprint": "f02245f19ad1ad7d", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/chat/ElicitationDock.tsx"}, "region": {"startLine": 195}}}]}, {"ruleId": "scanner-a8cdc0c12533a09e", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/ConversationContentItems.tsx:58"}, "properties": {"repobilityId": "5a8911cea52c5c80", "scanner": "scanner-primary", "fingerprint": "a8cdc0c12533a09e", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/chat/ConversationContentItems.tsx"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-37580b22b2deaeec", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/chat/ConversationBranchNavigator.tsx:67"}, "properties": {"repobilityId": "41be4a21414b1c84", "scanner": "scanner-primary", "fingerprint": "37580b22b2deaeec", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/chat/ConversationBranchNavigator.tsx"}, "region": {"startLine": 67}}}]}, {"ruleId": "scanner-31caa1ed5c3dc35d", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/diffs/WorkspaceReviewPane.tsx:670"}, "properties": {"repobilityId": "459797b3ab275b63", "scanner": "scanner-primary", "fingerprint": "31caa1ed5c3dc35d", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/diffs/WorkspaceReviewPane.tsx"}, "region": {"startLine": 670}}}]}, {"ruleId": "scanner-b1648e7be47874c7", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/diffs/ReviewChangesMenu.tsx:160"}, "properties": {"repobilityId": "df5e0cd5182bee0f", "scanner": "scanner-primary", "fingerprint": "b1648e7be47874c7", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/diffs/ReviewChangesMenu.tsx"}, "region": {"startLine": 160}}}]}, {"ruleId": "scanner-9e3fa8e783190ad8", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 frontend/src/renderer/components/diffs/ReviewBranchMenu.tsx:182"}, "properties": {"repobilityId": "741b1604d03ff937", "scanner": "scanner-primary", "fingerprint": "9e3fa8e783190ad8", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/diffs/ReviewBranchMenu.tsx"}, "region": {"startLine": 182}}}]}, {"ruleId": "scanner-354d669692126d3a", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 frontend/src/main/remote-proxy.ts:128"}, "properties": {"repobilityId": "581ee8b4b4c1a88d", "scanner": "scanner-primary", "fingerprint": "354d669692126d3a", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/main/remote-proxy.ts"}, "region": {"startLine": 128}}}]}, {"ruleId": "scanner-fab132269b3f76d8", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 packages/product-ui/src/SessionInspectorView.tsx:388"}, "properties": {"repobilityId": "b973f9a13c2c7239", "scanner": "scanner-primary", "fingerprint": "fab132269b3f76d8", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/product-ui/src/SessionInspectorView.tsx"}, "region": {"startLine": 388}}}]}, {"ruleId": "scanner-fb6f5b9a34a67cba", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 packages/product-ui/src/PRSummaryDisplay.tsx:357"}, "properties": {"repobilityId": "eb0b6103a51b64e3", "scanner": "scanner-primary", "fingerprint": "fb6f5b9a34a67cba", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/product-ui/src/PRSummaryDisplay.tsx"}, "region": {"startLine": 357}}}]}, {"ruleId": "scanner-299b20f8fbf2b488", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 packages/product-ui/src/SessionsBoardView.tsx:360"}, "properties": {"repobilityId": "72777183f239f4b4", "scanner": "scanner-primary", "fingerprint": "299b20f8fbf2b488", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/product-ui/src/SessionsBoardView.tsx"}, "region": {"startLine": 360}}}]}, {"ruleId": "scanner-55f2beecc9560c3d", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 packages/product-ui/src/TaskComposerView.tsx:345"}, "properties": {"repobilityId": "dc9c2141afdeca3b", "scanner": "scanner-primary", "fingerprint": "55f2beecc9560c3d", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/product-ui/src/TaskComposerView.tsx"}, "region": {"startLine": 345}}}]}, {"ruleId": "scanner-5a7c7ae0a30552b3", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 packages/product-ui/src/ProjectViews.tsx:200"}, "properties": {"repobilityId": "985a4bef53f2ccf1", "scanner": "scanner-primary", "fingerprint": "5a7c7ae0a30552b3", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/product-ui/src/ProjectViews.tsx"}, "region": {"startLine": 200}}}]}, {"ruleId": "scanner-a5ba69485fcf320c", "level": "none", "message": {"text": "Truncated text has no discoverable full-value affordance \u2014 packages/product-ui/src/ExecutionContextView.tsx:88"}, "properties": {"repobilityId": "b79b1c87822fd8c4", "scanner": "scanner-primary", "fingerprint": "a5ba69485fcf320c", "layer": "frontend", "severity": "info", "confidence": 0.65, "tags": ["frontend-quality", "fq.truncate.no-title"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/product-ui/src/ExecutionContextView.tsx"}, "region": {"startLine": 88}}}]}, {"ruleId": "scanner-776b6d806578e692", "level": "note", "message": {"text": "Debug `console.log` remains in browser-facing code \u2014 packages/mobile/app/pair.tsx:127"}, "properties": {"repobilityId": "ef64b7d6754e05df", "scanner": "scanner-primary", "fingerprint": "776b6d806578e692", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.console-leak"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/mobile/app/pair.tsx"}, "region": {"startLine": 127}}}]}, {"ruleId": "scanner-b1c18ebd80b5c283", "level": "note", "message": {"text": "React Flow <Controls> without dark theming \u2014 packages/mobile/lib/worker-controls-sheet.icons.test.tsx:77"}, "properties": {"repobilityId": "de5e37555120a17c", "scanner": "scanner-primary", "fingerprint": "b1c18ebd80b5c283", "layer": "frontend", "severity": "low", "confidence": 0.85, "tags": ["frontend-quality", "fq.controls.no-bg"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/mobile/lib/worker-controls-sheet.icons.test.tsx"}, "region": {"startLine": 77}}}]}, {"ruleId": "scanner-29ad8d148e99346b", "level": "warning", "message": {"text": "use of unsafe block \u2014 backend/internal/adapters/chatdriver/codexappserver/account_home_windows.go:96"}, "properties": {"repobilityId": "61cdca447bf6a41d", "scanner": "scanner-primary", "fingerprint": "29ad8d148e99346b", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/internal/adapters/chatdriver/codexappserver/account_home_windows.go"}, "region": {"startLine": 96}}}]}, {"ruleId": "scanner-521a2073856b9134", "level": "warning", "message": {"text": "use of unsafe block \u2014 backend/internal/adapters/chatdriver/persistenthost/child_windows.go:39"}, "properties": {"repobilityId": "9a3c957315c0d5c0", "scanner": "scanner-primary", "fingerprint": "521a2073856b9134", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/internal/adapters/chatdriver/persistenthost/child_windows.go"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-ef0f88e39ccebffe", "level": "warning", "message": {"text": "math random used \u2014 backend/internal/pricing/refresher.go:7"}, "properties": {"repobilityId": "b801322cc7d0cc6c", "scanner": "scanner-primary", "fingerprint": "ef0f88e39ccebffe", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/internal/pricing/refresher.go"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-38552d3e2c138818", "level": "warning", "message": {"text": "use of unsafe block \u2014 backend/internal/procmem/snapshot_windows.go:39"}, "properties": {"repobilityId": "f34b9d986b73016c", "scanner": "scanner-primary", "fingerprint": "38552d3e2c138818", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/internal/procmem/snapshot_windows.go"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-a291d9467981a269", "level": "warning", "message": {"text": "use of unsafe block \u2014 backend/internal/procmem/system_windows.go:54"}, "properties": {"repobilityId": "6b6f6e901c979b30", "scanner": "scanner-primary", "fingerprint": "a291d9467981a269", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/internal/procmem/system_windows.go"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-b6b462afb9491147", "level": "warning", "message": {"text": "use of unsafe block \u2014 backend/internal/runfile/rename_windows.go:33"}, "properties": {"repobilityId": "50f15b6a8c20f627", "scanner": "scanner-primary", "fingerprint": "b6b462afb9491147", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/internal/runfile/rename_windows.go"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-2473661dcb74b1bb", "level": "warning", "message": {"text": "use of unsafe block \u2014 backend/internal/service/agent/codex_secure_fs_windows.go:300"}, "properties": {"repobilityId": "ed7ad7207fe651e4", "scanner": "scanner-primary", "fingerprint": "2473661dcb74b1bb", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/internal/service/agent/codex_secure_fs_windows.go"}, "region": {"startLine": 300}}}]}, {"ruleId": "scanner-fd27c08bbea78d68", "level": "warning", "message": {"text": "use of md5 \u2014 backend/internal/service/chat/handoff_history_files.go:36"}, "properties": {"repobilityId": "134bc05689ab7c26", "scanner": "scanner-primary", "fingerprint": "fd27c08bbea78d68", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/internal/service/chat/handoff_history_files.go"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-bdec18ae294a6034", "level": "warning", "message": {"text": "string formatted query \u2014 backend/internal/storage/sqlite/db.go:1255"}, "properties": {"repobilityId": "80ba7360cb4a7626", "scanner": "scanner-primary", "fingerprint": "bdec18ae294a6034", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/internal/storage/sqlite/db.go"}, "region": {"startLine": 1255}}}]}, {"ruleId": "scanner-e6a679c606f6e556", "level": "warning", "message": {"text": "use tls \u2014 cloud/internal/agentbrowser/host/main.go:342"}, "properties": {"repobilityId": "7d91b2844a5cd4c8", "scanner": "scanner-primary", "fingerprint": "e6a679c606f6e556", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud/internal/agentbrowser/host/main.go"}, "region": {"startLine": 342}}}]}, {"ruleId": "scanner-7816f865f0a1ec02", "level": "warning", "message": {"text": "math random used \u2014 cloud/internal/notification/service.go:9"}, "properties": {"repobilityId": "b6dd01fe43ae4e8d", "scanner": "scanner-primary", "fingerprint": "7816f865f0a1ec02", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud/internal/notification/service.go"}, "region": {"startLine": 9}}}]}, {"ruleId": "scanner-116dea1916f47a62", "level": "warning", "message": {"text": "math random used \u2014 cloud/internal/notificationoutbox/flusher.go:7"}, "properties": {"repobilityId": "414ba248c63b9c3d", "scanner": "scanner-primary", "fingerprint": "116dea1916f47a62", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud/internal/notificationoutbox/flusher.go"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-7920ae41e2c37054", "level": "warning", "message": {"text": "potential dos via decompression bomb \u2014 cloud/internal/workertransport/harness.go:145"}, "properties": {"repobilityId": "d7df4f78807f3753", "scanner": "scanner-primary", "fingerprint": "7920ae41e2c37054", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "go"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud/internal/workertransport/harness.go"}, "region": {"startLine": 145}}}]}, {"ruleId": "scanner-dc4bc8275fe47b0f", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 cloud/scripts/dev-connect-agent-credential.py:117"}, "properties": {"repobilityId": "00fb991465a3229b", "scanner": "scanner-primary", "fingerprint": "dc4bc8275fe47b0f", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud/scripts/dev-connect-agent-credential.py"}, "region": {"startLine": 117}}}]}, {"ruleId": "scanner-8020b442d860aae0", "level": "warning", "message": {"text": "dynamic urllib use detected \u2014 cloud/scripts/workos-copy-environment.py:54"}, "properties": {"repobilityId": "3073e926269e19f3", "scanner": "scanner-primary", "fingerprint": "8020b442d860aae0", "layer": "security", "severity": "medium", "confidence": 0.55, "tags": ["semgrep", "security", "python"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud/scripts/workos-copy-environment.py"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-a02c2e9d2dd985a6", "level": "warning", "message": {"text": "CVE-2025-71405: github.com/go-chi/chi/v5 v5.1.0 \u2014 backend/go.mod"}, "properties": {"repobilityId": "ad627820ffc2b5ea", "scanner": "scanner-primary", "fingerprint": "a02c2e9d2dd985a6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-71405"]}}, {"ruleId": "scanner-e965c194c131cf0c", "level": "error", "message": {"text": "CVE-2026-39828: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "properties": {"repobilityId": "02f985203c176bcd", "scanner": "scanner-primary", "fingerprint": "e965c194c131cf0c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39828"]}}, {"ruleId": "scanner-cf751f6a9ff6ad01", "level": "error", "message": {"text": "CVE-2026-39829: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "properties": {"repobilityId": "82560a0ae78cc0ae", "scanner": "scanner-primary", "fingerprint": "cf751f6a9ff6ad01", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39829"]}}, {"ruleId": "scanner-a979915c1a9d5998", "level": "error", "message": {"text": "CVE-2026-39830: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "properties": {"repobilityId": "446a24b7e9ac756a", "scanner": "scanner-primary", "fingerprint": "a979915c1a9d5998", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39830"]}}, {"ruleId": "scanner-cbe37bc552828d42", "level": "error", "message": {"text": "CVE-2026-39831: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "properties": {"repobilityId": "1c4d69bd17e2c128", "scanner": "scanner-primary", "fingerprint": "cbe37bc552828d42", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39831"]}}, {"ruleId": "scanner-21077b7e36b9fb2f", "level": "error", "message": {"text": "CVE-2026-39832: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "properties": {"repobilityId": "df44372c17081cbf", "scanner": "scanner-primary", "fingerprint": "21077b7e36b9fb2f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39832"]}}, {"ruleId": "scanner-732eab092f014e94", "level": "error", "message": {"text": "CVE-2026-39835: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "properties": {"repobilityId": "7da5c3073163b968", "scanner": "scanner-primary", "fingerprint": "732eab092f014e94", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39835"]}}, {"ruleId": "scanner-57f475a12eebc033", "level": "error", "message": {"text": "CVE-2026-42508: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "properties": {"repobilityId": "e0830ad8fe2e7ce1", "scanner": "scanner-primary", "fingerprint": "57f475a12eebc033", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-42508"]}}, {"ruleId": "scanner-eb809a6a53c849f6", "level": "error", "message": {"text": "CVE-2026-46595: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "properties": {"repobilityId": "7c4b95b5f4bc7eca", "scanner": "scanner-primary", "fingerprint": "eb809a6a53c849f6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-46595"]}}, {"ruleId": "scanner-e8f5d81c827ce216", "level": "error", "message": {"text": "CVE-2026-46597: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "properties": {"repobilityId": "66b712e5e581c3ce", "scanner": "scanner-primary", "fingerprint": "e8f5d81c827ce216", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-46597"]}}, {"ruleId": "scanner-afac6ed8b8213fa0", "level": "error", "message": {"text": "CVE-2026-56854: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "properties": {"repobilityId": "ba8ec0d9dc26a297", "scanner": "scanner-primary", "fingerprint": "afac6ed8b8213fa0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-56854"]}}, {"ruleId": "scanner-86bfcf7f285ddab5", "level": "warning", "message": {"text": "CVE-2026-39827: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "properties": {"repobilityId": "28dcf7afe6f3d348", "scanner": "scanner-primary", "fingerprint": "86bfcf7f285ddab5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39827"]}}, {"ruleId": "scanner-d9d377500a5d89dd", "level": "warning", "message": {"text": "CVE-2026-39833: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "properties": {"repobilityId": "7ee85b29cc09d2af", "scanner": "scanner-primary", "fingerprint": "d9d377500a5d89dd", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39833"]}}, {"ruleId": "scanner-6fa2456892f8a46e", "level": "warning", "message": {"text": "CVE-2026-39834: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "properties": {"repobilityId": "5d5d17dc2f15fefb", "scanner": "scanner-primary", "fingerprint": "6fa2456892f8a46e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-39834"]}}, {"ruleId": "scanner-8846bdeb5eaaccca", "level": "warning", "message": {"text": "CVE-2026-46598: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "properties": {"repobilityId": "9846496b119f7179", "scanner": "scanner-primary", "fingerprint": "8846bdeb5eaaccca", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-46598"]}}, {"ruleId": "scanner-39e91f6d5f16d066", "level": "warning", "message": {"text": "CVE-2026-56855: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "properties": {"repobilityId": "7b6fcb434887ac86", "scanner": "scanner-primary", "fingerprint": "39e91f6d5f16d066", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-56855"]}}, {"ruleId": "scanner-213e87d52c9b38a6", "level": "warning", "message": {"text": "CVE-2026-78662: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "properties": {"repobilityId": "f631c5753b794546", "scanner": "scanner-primary", "fingerprint": "213e87d52c9b38a6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-78662"]}}, {"ruleId": "scanner-53d0922e83763946", "level": "none", "message": {"text": "GO-2026-5932: golang.org/x/crypto v0.51.0 \u2014 backend/go.mod"}, "properties": {"repobilityId": "4c418b30615ebd78", "scanner": "scanner-primary", "fingerprint": "53d0922e83763946", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["trivy", "vuln", "GO-2026-5932"]}}, {"ruleId": "scanner-a4529f3e85973e15", "level": "error", "message": {"text": "CVE-2026-56854: golang.org/x/crypto v0.54.0 \u2014 cloud/go.mod"}, "properties": {"repobilityId": "65754a4555690590", "scanner": "scanner-primary", "fingerprint": "a4529f3e85973e15", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-56854"]}}, {"ruleId": "scanner-0483a0ccefeb20d6", "level": "warning", "message": {"text": "CVE-2026-56855: golang.org/x/crypto v0.54.0 \u2014 cloud/go.mod"}, "properties": {"repobilityId": "367942fca370593b", "scanner": "scanner-primary", "fingerprint": "0483a0ccefeb20d6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-56855"]}}, {"ruleId": "scanner-21266a6e48432871", "level": "warning", "message": {"text": "CVE-2026-78662: golang.org/x/crypto v0.54.0 \u2014 cloud/go.mod"}, "properties": {"repobilityId": "685a43973857d329", "scanner": "scanner-primary", "fingerprint": "21266a6e48432871", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-78662"]}}, {"ruleId": "scanner-925b90f9d4028ad1", "level": "none", "message": {"text": "GO-2026-5932: golang.org/x/crypto v0.54.0 \u2014 cloud/go.mod"}, "properties": {"repobilityId": "a8c3bca8ae1c64d3", "scanner": "scanner-primary", "fingerprint": "925b90f9d4028ad1", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["trivy", "vuln", "GO-2026-5932"]}}, {"ruleId": "scanner-291da55ea1e8a9ea", "level": "error", "message": {"text": "CVE-2026-104850: @modelcontextprotocol/sdk 1.30.0 \u2014 frontend/acp-runtime/package-lock.json"}, "properties": {"repobilityId": "d191dcc9717128c9", "scanner": "scanner-primary", "fingerprint": "291da55ea1e8a9ea", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-104850"]}}, {"ruleId": "scanner-9c197a8656406f8b", "level": "error", "message": {"text": "CVE-2026-111767: @modelcontextprotocol/sdk 1.30.0 \u2014 frontend/acp-runtime/package-lock.json"}, "properties": {"repobilityId": "0858f39c0e466f3c", "scanner": "scanner-primary", "fingerprint": "9c197a8656406f8b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-111767"]}}, {"ruleId": "scanner-7ab8d38dda01ac2d", "level": "error", "message": {"text": "CVE-2026-111768: @modelcontextprotocol/sdk 1.30.0 \u2014 frontend/acp-runtime/package-lock.json"}, "properties": {"repobilityId": "30f47bfdca899b59", "scanner": "scanner-primary", "fingerprint": "7ab8d38dda01ac2d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-111768"]}}, {"ruleId": "scanner-e6a3ec701d7b9fd4", "level": "warning", "message": {"text": "CVE-2026-111769: @modelcontextprotocol/sdk 1.30.0 \u2014 frontend/acp-runtime/package-lock.json"}, "properties": {"repobilityId": "c3ff34a60981cf7f", "scanner": "scanner-primary", "fingerprint": "e6a3ec701d7b9fd4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-111769"]}}, {"ruleId": "scanner-10217ce7ff7e93e3", "level": "warning", "message": {"text": "CVE-2026-111771: @modelcontextprotocol/sdk 1.30.0 \u2014 frontend/acp-runtime/package-lock.json"}, "properties": {"repobilityId": "2f4b59d470756ca7", "scanner": "scanner-primary", "fingerprint": "10217ce7ff7e93e3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-111771"]}}, {"ruleId": "scanner-27172a5f900e3314", "level": "error", "message": {"text": "CVE-2026-84292: fast-uri 3.1.6 \u2014 frontend/acp-runtime/package-lock.json"}, "properties": {"repobilityId": "712cf59a7ed0ced7", "scanner": "scanner-primary", "fingerprint": "27172a5f900e3314", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84292"]}}, {"ruleId": "scanner-4bc694944476d6b9", "level": "error", "message": {"text": "CVE-2026-84394: fast-uri 3.1.6 \u2014 frontend/acp-runtime/package-lock.json"}, "properties": {"repobilityId": "4858b0dbb3e58a43", "scanner": "scanner-primary", "fingerprint": "4bc694944476d6b9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84394"]}}, {"ruleId": "scanner-08cb8ccb160f44ab", "level": "warning", "message": {"text": "CVE-2026-86472: fast-uri 3.1.6 \u2014 frontend/acp-runtime/package-lock.json"}, "properties": {"repobilityId": "19e2703b4f7ea854", "scanner": "scanner-primary", "fingerprint": "08cb8ccb160f44ab", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-86472"]}}, {"ruleId": "scanner-0b6cedbe60e2f89b", "level": "warning", "message": {"text": "CVE-2026-111757: hono 4.13.5 \u2014 frontend/acp-runtime/package-lock.json"}, "properties": {"repobilityId": "94f90ea580e20595", "scanner": "scanner-primary", "fingerprint": "0b6cedbe60e2f89b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-111757"]}}, {"ruleId": "scanner-7b8096abef8251d2", "level": "warning", "message": {"text": "CVE-2026-93981: hono 4.13.5 \u2014 frontend/acp-runtime/package-lock.json"}, "properties": {"repobilityId": "03750928263e3297", "scanner": "scanner-primary", "fingerprint": "7b8096abef8251d2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-93981"]}}, {"ruleId": "scanner-e278f7201207ff33", "level": "warning", "message": {"text": "CVE-2026-101910: ip-address 10.5.0 \u2014 frontend/acp-runtime/package-lock.json"}, "properties": {"repobilityId": "92c9d909cffca753", "scanner": "scanner-primary", "fingerprint": "e278f7201207ff33", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101910"]}}, {"ruleId": "scanner-ece97f0bba1c6b73", "level": "warning", "message": {"text": "CVE-2026-101911: ip-address 10.5.0 \u2014 frontend/acp-runtime/package-lock.json"}, "properties": {"repobilityId": "d3f0eb392983da0a", "scanner": "scanner-primary", "fingerprint": "ece97f0bba1c6b73", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101911"]}}, {"ruleId": "scanner-3c7110bd8372cbda", "level": "warning", "message": {"text": "CVE-2026-101912: ip-address 10.5.0 \u2014 frontend/acp-runtime/package-lock.json"}, "properties": {"repobilityId": "ef0a31a0479b0ccb", "scanner": "scanner-primary", "fingerprint": "3c7110bd8372cbda", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101912"]}}, {"ruleId": "scanner-e17f35ca416357d7", "level": "warning", "message": {"text": "CVE-2026-101913: ip-address 10.5.0 \u2014 frontend/acp-runtime/package-lock.json"}, "properties": {"repobilityId": "c6ed7681ee2c4aa1", "scanner": "scanner-primary", "fingerprint": "e17f35ca416357d7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101913"]}}, {"ruleId": "scanner-c5b4dc46c8ba2243", "level": "error", "message": {"text": "CVE-2026-90711: proxy-addr 2.0.7 \u2014 frontend/acp-runtime/package-lock.json"}, "properties": {"repobilityId": "c81d2873c02c7030", "scanner": "scanner-primary", "fingerprint": "c5b4dc46c8ba2243", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-90711"]}}, {"ruleId": "scanner-7e488ec134e7a320", "level": "warning", "message": {"text": "CVE-2026-82417: qs 6.15.3 \u2014 frontend/acp-runtime/package-lock.json"}, "properties": {"repobilityId": "816a8364496bb948", "scanner": "scanner-primary", "fingerprint": "7e488ec134e7a320", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-82417"]}}, {"ruleId": "scanner-15f8a14152a6e940", "level": "warning", "message": {"text": "CVE-2026-82562: qs 6.15.3 \u2014 frontend/acp-runtime/package-lock.json"}, "properties": {"repobilityId": "eca6cba4dd149e7c", "scanner": "scanner-primary", "fingerprint": "15f8a14152a6e940", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-82562"]}}, {"ruleId": "scanner-f9fbfe0dc2bf231a", "level": "error", "message": {"text": "CVE-2026-102276: brace-expansion 1.1.15 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "5d017ae51efbf7e9", "scanner": "scanner-primary", "fingerprint": "f9fbfe0dc2bf231a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-102276"]}}, {"ruleId": "scanner-8dbb3c200dcfab17", "level": "error", "message": {"text": "CVE-2026-102278: brace-expansion 1.1.15 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "3f65b7715cde0959", "scanner": "scanner-primary", "fingerprint": "8dbb3c200dcfab17", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-102278"]}}, {"ruleId": "scanner-0fad124590577689", "level": "error", "message": {"text": "CVE-2026-13149: brace-expansion 1.1.15 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "1b167da6cf9297d4", "scanner": "scanner-primary", "fingerprint": "0fad124590577689", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-13149"]}}, {"ruleId": "scanner-810431c46b2b9cc1", "level": "error", "message": {"text": "CVE-2026-14257: brace-expansion 1.1.15 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "a0c8285080de244c", "scanner": "scanner-primary", "fingerprint": "810431c46b2b9cc1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-14257"]}}, {"ruleId": "scanner-00469d75f7b7e3c0", "level": "error", "message": {"text": "CVE-2026-69152: brace-expansion 1.1.15 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "4aec133f95a9de31", "scanner": "scanner-primary", "fingerprint": "00469d75f7b7e3c0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69152"]}}, {"ruleId": "scanner-a13e0c555b1ed992", "level": "warning", "message": {"text": "CVE-2026-102277: brace-expansion 1.1.15 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "17c4d962a04ceb63", "scanner": "scanner-primary", "fingerprint": "a13e0c555b1ed992", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-102277"]}}, {"ruleId": "scanner-5f16dcdf33a036bf", "level": "note", "message": {"text": "GHSA-6688-9rhm-gjv2: dompurify 3.4.14 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "3436a70b27eba94e", "scanner": "scanner-primary", "fingerprint": "5f16dcdf33a036bf", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-6688-9rhm-gjv2"]}}, {"ruleId": "scanner-be98f72722d74cd9", "level": "note", "message": {"text": "GHSA-p98j-92pf-mc4p: dompurify 3.4.14 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "b6cc8282b0500ba1", "scanner": "scanner-primary", "fingerprint": "be98f72722d74cd9", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-p98j-92pf-mc4p"]}}, {"ruleId": "scanner-431d8b6ba442560b", "level": "warning", "message": {"text": "CVE-2026-45820: fflate 0.4.8 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "80ad87194696460b", "scanner": "scanner-primary", "fingerprint": "431d8b6ba442560b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45820"]}}, {"ruleId": "scanner-4c2cef1864fbbab7", "level": "error", "message": {"text": "CVE-2026-59869: js-yaml 4.2.0 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "991b502c88ae79b4", "scanner": "scanner-primary", "fingerprint": "4c2cef1864fbbab7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59869"]}}, {"ruleId": "scanner-78efb48e2aa68c70", "level": "error", "message": {"text": "CVE-2026-84375: js-yaml 4.2.0 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "6b2033c040487f75", "scanner": "scanner-primary", "fingerprint": "78efb48e2aa68c70", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-84375"]}}, {"ruleId": "scanner-19ff5bf354bcc374", "level": "error", "message": {"text": "GHSA-5p4m-2wfm-xmqj: js-yaml 4.2.0 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "b316583d92a9a26d", "scanner": "scanner-primary", "fingerprint": "19ff5bf354bcc374", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-5p4m-2wfm-xmqj"]}}, {"ruleId": "scanner-72c1ea1b378fa792", "level": "note", "message": {"text": "CVE-2026-103923: katex 0.16.47 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "2e3e426e29d67cab", "scanner": "scanner-primary", "fingerprint": "72c1ea1b378fa792", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-103923"]}}, {"ruleId": "scanner-335ec22c74c42d35", "level": "error", "message": {"text": "CVE-2026-104846: seroval 1.5.4 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "cbd259ebacd2d57d", "scanner": "scanner-primary", "fingerprint": "335ec22c74c42d35", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-104846"]}}, {"ruleId": "scanner-e246572371104fd6", "level": "error", "message": {"text": "CVE-2026-104845: seroval 1.5.4 \u2014 frontend/package-lock.json"}, "properties": {"repobilityId": "49e4ec886d112a1a", "scanner": "scanner-primary", "fingerprint": "e246572371104fd6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-104845"]}}, {"ruleId": "scanner-68d57f608e6db8c8", "level": "error", "message": {"text": "CVE-2026-102276: brace-expansion 5.0.8 \u2014 frontend/src/docs/package-lock.json"}, "properties": {"repobilityId": "512979bf3fbc4eee", "scanner": "scanner-primary", "fingerprint": "68d57f608e6db8c8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-102276"]}}, {"ruleId": "scanner-2577194b99ccc442", "level": "error", "message": {"text": "CVE-2026-102278: brace-expansion 5.0.8 \u2014 frontend/src/docs/package-lock.json"}, "properties": {"repobilityId": "cb44a08c8d78699f", "scanner": "scanner-primary", "fingerprint": "2577194b99ccc442", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-102278"]}}, {"ruleId": "scanner-843a384a28763e10", "level": "error", "message": {"text": "CVE-2026-69152: brace-expansion 5.0.8 \u2014 frontend/src/docs/package-lock.json"}, "properties": {"repobilityId": "780caf09f31a0b3d", "scanner": "scanner-primary", "fingerprint": "843a384a28763e10", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69152"]}}, {"ruleId": "scanner-1b0eed3ac43fb54e", "level": "warning", "message": {"text": "CVE-2026-102277: brace-expansion 5.0.8 \u2014 frontend/src/docs/package-lock.json"}, "properties": {"repobilityId": "9ce88c3072a2738f", "scanner": "scanner-primary", "fingerprint": "1b0eed3ac43fb54e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-102277"]}}, {"ruleId": "scanner-5e2894d488148107", "level": "error", "message": {"text": "CVE-2025-71329: image-size 2.0.2 \u2014 frontend/src/docs/package-lock.json"}, "properties": {"repobilityId": "a5f5274fe9be9c3f", "scanner": "scanner-primary", "fingerprint": "5e2894d488148107", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-71329"]}}, {"ruleId": "scanner-c90e9f63c0032c04", "level": "error", "message": {"text": "CVE-2025-71330: image-size 2.0.2 \u2014 frontend/src/docs/package-lock.json"}, "properties": {"repobilityId": "8d4a79d81c9baf31", "scanner": "scanner-primary", "fingerprint": "c90e9f63c0032c04", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2025-71330"]}}, {"ruleId": "scanner-60fe8ba83b09c6b6", "level": "note", "message": {"text": "CVE-2026-103923: katex 0.18.1 \u2014 frontend/src/docs/package-lock.json"}, "properties": {"repobilityId": "f326ba01a8a2d7de", "scanner": "scanner-primary", "fingerprint": "60fe8ba83b09c6b6", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-103923"]}}, {"ruleId": "scanner-b80b65646ce417aa", "level": "error", "message": {"text": "CVE-2026-67213: nanoid 3.3.16 \u2014 frontend/src/docs/package-lock.json"}, "properties": {"repobilityId": "46b417246361a11d", "scanner": "scanner-primary", "fingerprint": "b80b65646ce417aa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-67213"]}}, {"ruleId": "scanner-4b2dc1eb3b760539", "level": "error", "message": {"text": "CVE-2026-75604: next 16.2.11 \u2014 frontend/src/docs/package-lock.json"}, "properties": {"repobilityId": "65db54a3e432a214", "scanner": "scanner-primary", "fingerprint": "4b2dc1eb3b760539", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-75604"]}}, {"ruleId": "scanner-b6d673a6e68a305b", "level": "error", "message": {"text": "GHSA-2xp9-vwfh-vxw4: next 16.2.11 \u2014 frontend/src/docs/package-lock.json"}, "properties": {"repobilityId": "11b5df8b2700880b", "scanner": "scanner-primary", "fingerprint": "b6d673a6e68a305b", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-2xp9-vwfh-vxw4"]}}, {"ruleId": "scanner-c2c4315b8a9370f7", "level": "error", "message": {"text": "GHSA-vcvr-r3jv-pc5j: next 16.2.11 \u2014 frontend/src/docs/package-lock.json"}, "properties": {"repobilityId": "5e1a76a74b7f14d1", "scanner": "scanner-primary", "fingerprint": "c2c4315b8a9370f7", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-vcvr-r3jv-pc5j"]}}, {"ruleId": "scanner-0e23ae98f67deb01", "level": "error", "message": {"text": "CVE-2026-94483: next 16.2.11 \u2014 frontend/src/docs/package-lock.json"}, "properties": {"repobilityId": "8f79099e65426a1a", "scanner": "scanner-primary", "fingerprint": "0e23ae98f67deb01", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-94483"]}}, {"ruleId": "scanner-4df3fc2c5e37c94a", "level": "warning", "message": {"text": "CVE-2026-94484: next 16.2.11 \u2014 frontend/src/docs/package-lock.json"}, "properties": {"repobilityId": "b43ee4a14194d649", "scanner": "scanner-primary", "fingerprint": "4df3fc2c5e37c94a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-94484"]}}, {"ruleId": "scanner-f72db35c3868ced8", "level": "warning", "message": {"text": "CVE-2026-94485: next 16.2.11 \u2014 frontend/src/docs/package-lock.json"}, "properties": {"repobilityId": "6c27bdb31987242b", "scanner": "scanner-primary", "fingerprint": "f72db35c3868ced8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-94485"]}}, {"ruleId": "scanner-d01d7e6228611282", "level": "warning", "message": {"text": "CVE-2026-94543: next 16.2.11 \u2014 frontend/src/docs/package-lock.json"}, "properties": {"repobilityId": "de81a3289b5e77b0", "scanner": "scanner-primary", "fingerprint": "d01d7e6228611282", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-94543"]}}, {"ruleId": "scanner-270f3a826528455a", "level": "note", "message": {"text": "CVE-2026-94486: next 16.2.11 \u2014 frontend/src/docs/package-lock.json"}, "properties": {"repobilityId": "802d7fcd53f9d596", "scanner": "scanner-primary", "fingerprint": "270f3a826528455a", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-94486"]}}, {"ruleId": "scanner-5c1cea267a160f24", "level": "error", "message": {"text": "CVE-2026-45623: postcss 8.4.31 \u2014 frontend/src/docs/package-lock.json"}, "properties": {"repobilityId": "7f542889dd43e5c1", "scanner": "scanner-primary", "fingerprint": "5c1cea267a160f24", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45623"]}}, {"ruleId": "scanner-236c6e996a429d32", "level": "error", "message": {"text": "CVE-2026-73646: postcss 8.4.31 \u2014 frontend/src/docs/package-lock.json"}, "properties": {"repobilityId": "efdf26659c777b3f", "scanner": "scanner-primary", "fingerprint": "236c6e996a429d32", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73646"]}}, {"ruleId": "scanner-cd570d83531d8fb4", "level": "warning", "message": {"text": "CVE-2026-41305: postcss 8.4.31 \u2014 frontend/src/docs/package-lock.json"}, "properties": {"repobilityId": "576247edfc0ba656", "scanner": "scanner-primary", "fingerprint": "cd570d83531d8fb4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41305"]}}, {"ruleId": "scanner-86b7136815586b5b", "level": "warning", "message": {"text": "CVE-2026-69153: postcss 8.4.31 \u2014 frontend/src/docs/package-lock.json"}, "properties": {"repobilityId": "e5703a109d7e7aea", "scanner": "scanner-primary", "fingerprint": "86b7136815586b5b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-69153"]}}, {"ruleId": "scanner-43e9d2a24a437c8d", "level": "error", "message": {"text": "GHSA-f88m-g3jw-g9cj: sharp 0.34.5 \u2014 frontend/src/docs/package-lock.json"}, "properties": {"repobilityId": "babd9b28a9c5801a", "scanner": "scanner-primary", "fingerprint": "43e9d2a24a437c8d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-f88m-g3jw-g9cj"]}}, {"ruleId": "scanner-be8591bfe241726b", "level": "error", "message": {"text": "GHSA-rgj7-g3m4-5g8c: sharp 0.34.5 \u2014 frontend/src/docs/package-lock.json"}, "properties": {"repobilityId": "201f2ed9b05b4dd0", "scanner": "scanner-primary", "fingerprint": "be8591bfe241726b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-rgj7-g3m4-5g8c"]}}, {"ruleId": "scanner-5b9e9bde7657f9b0", "level": "error", "message": {"text": "GHSA-wq5f-xc86-pv6w: sharp 0.34.5 \u2014 frontend/src/docs/package-lock.json"}, "properties": {"repobilityId": "3c919ba38441482e", "scanner": "scanner-primary", "fingerprint": "5b9e9bde7657f9b0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "GHSA-wq5f-xc86-pv6w"]}}, {"ruleId": "scanner-bce566c304796077", "level": "error", "message": {"text": "CVE-2026-93749: source-map-js 1.2.1 \u2014 frontend/src/docs/package-lock.json"}, "properties": {"repobilityId": "7394ae80e509fae7", "scanner": "scanner-primary", "fingerprint": "bce566c304796077", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-93749"]}}, {"ruleId": "scanner-9459a7ff0e1c14c5", "level": "error", "message": {"text": "CVE-2026-102276: brace-expansion 5.0.9 \u2014 packages/mobile/package-lock.json"}, "properties": {"repobilityId": "c2b4dc3f89cfc987", "scanner": "scanner-primary", "fingerprint": "9459a7ff0e1c14c5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-102276"]}}, {"ruleId": "scanner-13a6b7c921c0e760", "level": "error", "message": {"text": "CVE-2026-102278: brace-expansion 5.0.9 \u2014 packages/mobile/package-lock.json"}, "properties": {"repobilityId": "1110191ea27dab3b", "scanner": "scanner-primary", "fingerprint": "13a6b7c921c0e760", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-102278"]}}, {"ruleId": "scanner-2fd67f314f4b8d75", "level": "warning", "message": {"text": "CVE-2026-102277: brace-expansion 5.0.9 \u2014 packages/mobile/package-lock.json"}, "properties": {"repobilityId": "d39db15ed41e60ff", "scanner": "scanner-primary", "fingerprint": "2fd67f314f4b8d75", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-102277"]}}, {"ruleId": "scanner-32f6f5ba198c9b0c", "level": "error", "message": {"text": "CVE-2026-93687: braces 3.0.3 \u2014 packages/mobile/package-lock.json"}, "properties": {"repobilityId": "3fff49a38a07653f", "scanner": "scanner-primary", "fingerprint": "32f6f5ba198c9b0c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-93687"]}}, {"ruleId": "scanner-054c77d63c740554", "level": "error", "message": {"text": "CVE-2026-87776: compression 1.8.1 \u2014 packages/mobile/package-lock.json"}, "properties": {"repobilityId": "d96c5cadf202d8ad", "scanner": "scanner-primary", "fingerprint": "054c77d63c740554", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-87776"]}}, {"ruleId": "scanner-9fb4a90ae923f6aa", "level": "warning", "message": {"text": "CVE-2026-45822: decode-uri-component 0.2.2 \u2014 packages/mobile/package-lock.json"}, "properties": {"repobilityId": "cacfefc9087772a1", "scanner": "scanner-primary", "fingerprint": "9fb4a90ae923f6aa", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-45822"]}}, {"ruleId": "scanner-a92b6dbb48e51062", "level": "error", "message": {"text": "CVE-2026-85393: node-forge 1.4.0 \u2014 packages/mobile/package-lock.json"}, "properties": {"repobilityId": "e355eb82493cf8d5", "scanner": "scanner-primary", "fingerprint": "a92b6dbb48e51062", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-85393"]}}, {"ruleId": "scanner-e35886ed7ff5e5fe", "level": "error", "message": {"text": "CVE-2026-102422: shell-quote 1.10.0 \u2014 packages/mobile/package-lock.json"}, "properties": {"repobilityId": "a8de3dcbb8f6182e", "scanner": "scanner-primary", "fingerprint": "e35886ed7ff5e5fe", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-102422"]}}, {"ruleId": "scanner-64463e87e9d21096", "level": "error", "message": {"text": "CVE-2026-93749: source-map-js 1.2.1 \u2014 packages/mobile/package-lock.json"}, "properties": {"repobilityId": "020e4a7b4aa9237c", "scanner": "scanner-primary", "fingerprint": "64463e87e9d21096", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-93749"]}}, {"ruleId": "scanner-8a4aecbb5aa6ca9d", "level": "warning", "message": {"text": "CVE-2026-41907: uuid 7.0.3 \u2014 packages/mobile/package-lock.json"}, "properties": {"repobilityId": "029ab7a117b7cd43", "scanner": "scanner-primary", "fingerprint": "8a4aecbb5aa6ca9d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-41907"]}}, {"ruleId": "scanner-304c7ba1aa9979d0", "level": "error", "message": {"text": "CVE-2026-101916: @grpc/grpc-js 1.14.4 \u2014 scripts/package-lock.json"}, "properties": {"repobilityId": "f1e389e6f730fa51", "scanner": "scanner-primary", "fingerprint": "304c7ba1aa9979d0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101916"]}}, {"ruleId": "scanner-d4d2d19f5660a025", "level": "note", "message": {"text": "CVE-2026-101915: @grpc/grpc-js 1.14.4 \u2014 scripts/package-lock.json"}, "properties": {"repobilityId": "cc2af26c9b558e54", "scanner": "scanner-primary", "fingerprint": "d4d2d19f5660a025", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101915"]}}, {"ruleId": "scanner-32a9ae39b8dbee47", "level": "error", "message": {"text": "CVE-2026-59892: @opentelemetry/propagator-jaeger 2.8.0 \u2014 scripts/package-lock.json"}, "properties": {"repobilityId": "efb3fcb19151fd12", "scanner": "scanner-primary", "fingerprint": "32a9ae39b8dbee47", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-59892"]}}, {"ruleId": "scanner-ffa5d2eab9129d81", "level": "error", "message": {"text": "CVE-2026-101898: axios 1.18.1 \u2014 scripts/package-lock.json"}, "properties": {"repobilityId": "a6ffc0b8f440fdad", "scanner": "scanner-primary", "fingerprint": "ffa5d2eab9129d81", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101898"]}}, {"ruleId": "scanner-474db2193150a063", "level": "error", "message": {"text": "CVE-2026-101901: axios 1.18.1 \u2014 scripts/package-lock.json"}, "properties": {"repobilityId": "b448f4563359ce39", "scanner": "scanner-primary", "fingerprint": "474db2193150a063", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101901"]}}, {"ruleId": "scanner-296e92244a94853a", "level": "error", "message": {"text": "CVE-2026-101903: axios 1.18.1 \u2014 scripts/package-lock.json"}, "properties": {"repobilityId": "7326f07bad4d69e1", "scanner": "scanner-primary", "fingerprint": "296e92244a94853a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101903"]}}, {"ruleId": "scanner-ff37546c8ab2bd69", "level": "error", "message": {"text": "CVE-2026-101905: axios 1.18.1 \u2014 scripts/package-lock.json"}, "properties": {"repobilityId": "8d5b5cdcf811db35", "scanner": "scanner-primary", "fingerprint": "ff37546c8ab2bd69", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101905"]}}, {"ruleId": "scanner-9bdfb0d6ec07b039", "level": "error", "message": {"text": "CVE-2026-101906: axios 1.18.1 \u2014 scripts/package-lock.json"}, "properties": {"repobilityId": "72ebe7b8bee705c6", "scanner": "scanner-primary", "fingerprint": "9bdfb0d6ec07b039", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101906"]}}, {"ruleId": "scanner-fe21c8e8dd3dc2c2", "level": "error", "message": {"text": "CVE-2026-101907: axios 1.18.1 \u2014 scripts/package-lock.json"}, "properties": {"repobilityId": "06a71654e191f26c", "scanner": "scanner-primary", "fingerprint": "fe21c8e8dd3dc2c2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101907"]}}, {"ruleId": "scanner-56f8c535ed2294a3", "level": "error", "message": {"text": "CVE-2026-101909: axios 1.18.1 \u2014 scripts/package-lock.json"}, "properties": {"repobilityId": "7c81c30a65a78256", "scanner": "scanner-primary", "fingerprint": "56f8c535ed2294a3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101909"]}}, {"ruleId": "scanner-189e46ff8a2913ea", "level": "warning", "message": {"text": "CVE-2026-101899: axios 1.18.1 \u2014 scripts/package-lock.json"}, "properties": {"repobilityId": "1852ddc092c9e537", "scanner": "scanner-primary", "fingerprint": "189e46ff8a2913ea", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101899"]}}, {"ruleId": "scanner-0437850624d67f09", "level": "warning", "message": {"text": "CVE-2026-101900: axios 1.18.1 \u2014 scripts/package-lock.json"}, "properties": {"repobilityId": "e52966e7e61f1139", "scanner": "scanner-primary", "fingerprint": "0437850624d67f09", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101900"]}}, {"ruleId": "scanner-0f9a373ebe61f492", "level": "warning", "message": {"text": "CVE-2026-101902: axios 1.18.1 \u2014 scripts/package-lock.json"}, "properties": {"repobilityId": "927a98047fb81d15", "scanner": "scanner-primary", "fingerprint": "0f9a373ebe61f492", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101902"]}}, {"ruleId": "scanner-c73e3697e1839905", "level": "warning", "message": {"text": "CVE-2026-101904: axios 1.18.1 \u2014 scripts/package-lock.json"}, "properties": {"repobilityId": "27a4588fc8e7b88d", "scanner": "scanner-primary", "fingerprint": "c73e3697e1839905", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101904"]}}, {"ruleId": "scanner-99a11ec31c6935e2", "level": "warning", "message": {"text": "CVE-2026-101908: axios 1.18.1 \u2014 scripts/package-lock.json"}, "properties": {"repobilityId": "a0fd9e0337fe5879", "scanner": "scanner-primary", "fingerprint": "99a11ec31c6935e2", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-101908"]}}, {"ruleId": "scanner-b0cdeaf586712a24", "level": "error", "message": {"text": "CVE-2026-93687: braces 3.0.3 \u2014 scripts/package-lock.json"}, "properties": {"repobilityId": "100733cefbe85c79", "scanner": "scanner-primary", "fingerprint": "b0cdeaf586712a24", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-93687"]}}, {"ruleId": "scanner-37fbff9b8e3c46dc", "level": "error", "message": {"text": "CVE-2026-111755: follow-redirects 1.16.0 \u2014 scripts/package-lock.json"}, "properties": {"repobilityId": "223eb0c8ed2e3fc2", "scanner": "scanner-primary", "fingerprint": "37fbff9b8e3c46dc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-111755"]}}, {"ruleId": "scanner-37e2a7f48a94a47c", "level": "error", "message": {"text": "CVE-2026-111756: follow-redirects 1.16.0 \u2014 scripts/package-lock.json"}, "properties": {"repobilityId": "d62a65015597fe38", "scanner": "scanner-primary", "fingerprint": "37e2a7f48a94a47c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-111756"]}}, {"ruleId": "scanner-b8b6e5e6857579e4", "level": "error", "message": {"text": "CVE-2026-102422: shell-quote 1.10.0 \u2014 scripts/package-lock.json"}, "properties": {"repobilityId": "25390afd1c270bac", "scanner": "scanner-primary", "fingerprint": "b8b6e5e6857579e4", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-102422"]}}, {"ruleId": "scanner-3e4a02af2b6f91aa", "level": "error", "message": {"text": "CVE-2026-73566: tar 7.5.20 \u2014 scripts/package-lock.json"}, "properties": {"repobilityId": "aee4bc99f17b0cc9", "scanner": "scanner-primary", "fingerprint": "3e4a02af2b6f91aa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "vuln", "CVE-2026-73566"]}}, {"ruleId": "scanner-ea8da81570789aff", "level": "warning", "message": {"text": "DS-0013: 'RUN cd ...' to change directory \u2014 cloud/Dockerfile"}, "properties": {"repobilityId": "0c248ac7972c8107", "scanner": "scanner-primary", "fingerprint": "ea8da81570789aff", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-e29ac3ee9cd5bb0a", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 cloud/Dockerfile"}, "properties": {"repobilityId": "19e351cd0e3f290f", "scanner": "scanner-primary", "fingerprint": "e29ac3ee9cd5bb0a", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-02a2c706c151876c", "level": "warning", "message": {"text": "AZU-0068: VM Not Attached To Network \u2014 cloud/coder-azure-vm/main.tf"}, "properties": {"repobilityId": "9e10d814924b7e2f", "scanner": "scanner-primary", "fingerprint": "02a2c706c151876c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-3d94c94aef4162ae", "level": "warning", "message": {"text": "AZU-0076: Network Interfaces With Public IP \u2014 cloud/coder-azure-vm/main.tf"}, "properties": {"repobilityId": "65c85f6a243c9d4f", "scanner": "scanner-primary", "fingerprint": "3d94c94aef4162ae", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-8e9269525ede8fb7", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 cloud/coder/Sandbox.Dockerfile"}, "properties": {"repobilityId": "c7fd0b9742b67c17", "scanner": "scanner-primary", "fingerprint": "8e9269525ede8fb7", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-c81e3a2b35a59e22", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 cloud/nodeops/Sandbox.Dockerfile"}, "properties": {"repobilityId": "7288597ef171af55", "scanner": "scanner-primary", "fingerprint": "c81e3a2b35a59e22", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-4dad6a639906b7da", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 cloud/nodeops/Sandbox.Dockerfile"}, "properties": {"repobilityId": "1a33f23ece3a6f24", "scanner": "scanner-primary", "fingerprint": "4dad6a639906b7da", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-e3d8ae8598425b90", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 cloud/nodeops/Sandbox.base.Dockerfile"}, "properties": {"repobilityId": "62aac89d76d69d6d", "scanner": "scanner-primary", "fingerprint": "e3d8ae8598425b90", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-0e9bd47aa1b74d98", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 cloud/nodeops/Sandbox.base.Dockerfile"}, "properties": {"repobilityId": "305aed7434783d2a", "scanner": "scanner-primary", "fingerprint": "0e9bd47aa1b74d98", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-5accc98136ce397c", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 cloud/nodeops/harness/claude-code.Dockerfile"}, "properties": {"repobilityId": "e14b1ea1ac10ece8", "scanner": "scanner-primary", "fingerprint": "5accc98136ce397c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-8ea73fb08577f593", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 cloud/nodeops/harness/claude-code.Dockerfile"}, "properties": {"repobilityId": "a0539c97359b8f89", "scanner": "scanner-primary", "fingerprint": "8ea73fb08577f593", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-e059a2bbbe145426", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 cloud/nodeops/harness/codex.Dockerfile"}, "properties": {"repobilityId": "36cdbf7c155506a2", "scanner": "scanner-primary", "fingerprint": "e059a2bbbe145426", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-6c6845d7ccda3f23", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 cloud/nodeops/harness/codex.Dockerfile"}, "properties": {"repobilityId": "2ed6000b28d99ebf", "scanner": "scanner-primary", "fingerprint": "6c6845d7ccda3f23", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-57e89f6b73594c69", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 cloud/nodeops/harness/cursor.Dockerfile"}, "properties": {"repobilityId": "2caffb4c4cb659cf", "scanner": "scanner-primary", "fingerprint": "57e89f6b73594c69", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-43b3ab8d8dbd7c5e", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 cloud/nodeops/harness/cursor.Dockerfile"}, "properties": {"repobilityId": "e0a781a2e607bc0d", "scanner": "scanner-primary", "fingerprint": "43b3ab8d8dbd7c5e", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-f39c2852bbe738f6", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 cloud/test/Dockerfile.worker-smoke"}, "properties": {"repobilityId": "2ad65cdfb80bcc9e", "scanner": "scanner-primary", "fingerprint": "f39c2852bbe738f6", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-7550b2b36b8825e2", "level": "error", "message": {"text": "DS-0002: Image user should not be 'root' \u2014 experiments/remote-browser-poc/Dockerfile"}, "properties": {"repobilityId": "96d01d2f01f6362c", "scanner": "scanner-primary", "fingerprint": "7550b2b36b8825e2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-e4b2fcf9968cb1c1", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 experiments/remote-browser-poc/Dockerfile"}, "properties": {"repobilityId": "682e9c9477287acf", "scanner": "scanner-primary", "fingerprint": "e4b2fcf9968cb1c1", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-950dd45abbefce69", "level": "warning", "message": {"text": "DS-0013: 'RUN cd ...' to change directory \u2014 test/cli/Dockerfile"}, "properties": {"repobilityId": "721c4ea8ee5a7bcc", "scanner": "scanner-primary", "fingerprint": "950dd45abbefce69", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-936f08337cd9a007", "level": "note", "message": {"text": "DS-0026: No HEALTHCHECK defined \u2014 test/cli/Dockerfile"}, "properties": {"repobilityId": "f25c79df43126fd3", "scanner": "scanner-primary", "fingerprint": "936f08337cd9a007", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["trivy", "misconfig"]}}, {"ruleId": "scanner-2bd693911a9c2d87", "level": "error", "message": {"text": "Secret leak: Google (GCP) Service-account \u2014 .github/.gitleaks.toml"}, "properties": {"repobilityId": "f6d5ee1c064964a2", "scanner": "scanner-primary", "fingerprint": "2bd693911a9c2d87", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["trivy", "secret"]}}, {"ruleId": "scanner-2679282aa1c484b5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "properties": {"repobilityId": "27d579812e6be614", "scanner": "scanner-primary", "fingerprint": "2679282aa1c484b5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-db7976514c141d2e", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: cloud/internal/skillassets/using-ao/SKILL.md"}, "properties": {"repobilityId": "b2a4e5c574d981af", "scanner": "scanner-primary", "fingerprint": "db7976514c141d2e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud/internal/skillassets/using-ao/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-25846ede0fea196a", "level": "warning", "message": {"text": "SkillSpector AST4 (behavioral-ast) in .claude/skills/bug-triage/scripts/push_fix_to_github.py"}, "properties": {"repobilityId": "093fc9d2f8fee9cc", "scanner": "scanner-primary", "fingerprint": "25846ede0fea196a", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "behavioral-ast", "AST4", "code-exec"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/bug-triage/scripts/push_fix_to_github.py"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-f999fdd2402fe8c0", "level": "warning", "message": {"text": "SkillSpector LP3 (mcp-least-priv) in .claude/skills/bug-triage/SKILL.md"}, "properties": {"repobilityId": "817c10b30ecda93c", "scanner": "scanner-primary", "fingerprint": "f999fdd2402fe8c0", "layer": "security", "severity": "medium", "confidence": 0.7, "tags": ["skillspector", "mcp-skill", "mcp-least-priv", "LP3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/bug-triage/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e58d8abb85e944db", "level": "error", "message": {"text": "SkillSpector OH1 (output-handling) in .claude/skills/bug-triage/scripts/push_fix_to_github.py"}, "properties": {"repobilityId": "c04862b4b05dbf85", "scanner": "scanner-primary", "fingerprint": "e58d8abb85e944db", "layer": "security", "severity": "high", "confidence": 0.95, "tags": ["skillspector", "mcp-skill", "output-handling", "OH1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/skills/bug-triage/scripts/push_fix_to_github.py"}, "region": {"startLine": 28}}}]}, {"ruleId": "scanner-9ac06d0220790f00", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in backend/internal/skillassets/using-ao/commands/project.md"}, "properties": {"repobilityId": "061599244edcfece", "scanner": "scanner-primary", "fingerprint": "9ac06d0220790f00", "layer": "security", "severity": "medium", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/internal/skillassets/using-ao/commands/project.md"}, "region": {"startLine": 111}}}]}, {"ruleId": "scanner-9f077df897f63980", "level": "warning", "message": {"text": "SkillSpector EA2 (excessive-agency) in backend/internal/skillassets/using-ao/commands/session.md"}, "properties": {"repobilityId": "15cf3596e22ac604", "scanner": "scanner-primary", "fingerprint": "9f077df897f63980", "layer": "security", "severity": "medium", "confidence": 0.85, "tags": ["skillspector", "mcp-skill", "excessive-agency", "EA2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/internal/skillassets/using-ao/commands/session.md"}, "region": {"startLine": 277}}}]}, {"ruleId": "scanner-8fbfda66b03697ba", "level": "warning", "message": {"text": "SkillSpector TM3 (tool-misuse) in backend/internal/skillassets/using-ao/commands/project.md"}, "properties": {"repobilityId": "3c3d6f2ef11f25f0", "scanner": "scanner-primary", "fingerprint": "8fbfda66b03697ba", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "tool-misuse", "TM3"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/internal/skillassets/using-ao/commands/project.md"}, "region": {"startLine": 184}}}]}, {"ruleId": "scanner-ab795ec1b4f856ef", "level": "warning", "message": {"text": "SkillSpector E1 (data-exfil) in cloud/internal/skillassets/using-ao/commands/pull-requests.md"}, "properties": {"repobilityId": "00a9ac87cb9d0576", "scanner": "scanner-primary", "fingerprint": "ab795ec1b4f856ef", "layer": "security", "severity": "medium", "confidence": 0.6, "tags": ["skillspector", "mcp-skill", "data-exfil", "E1"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud/internal/skillassets/using-ao/commands/pull-requests.md"}, "region": {"startLine": 14}}}]}, {"ruleId": "scanner-e637c415447867e4", "level": "none", "message": {"text": "Run SkillSpector's LLM-backed analysis in your own pipeline"}, "properties": {"repobilityId": "1936f198ff5212bf", "scanner": "scanner-primary", "fingerprint": "e637c415447867e4", "layer": "security", "severity": "info", "confidence": 1.0, "tags": ["skillspector", "mcp-skill", "llm-advisory", "ai-coder"]}}, {"ruleId": "scanner-c048b520a651950e", "level": "warning", "message": {"text": "Privileged port 18 in use"}, "properties": {"repobilityId": "2d7b5e7d9c158e43", "scanner": "scanner-primary", "fingerprint": "c048b520a651950e", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud/scripts/verify-image-contract.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e7b74186b9071c0f", "level": "warning", "message": {"text": "Privileged port 20 in use"}, "properties": {"repobilityId": "a59f3e53d617e0f8", "scanner": "scanner-primary", "fingerprint": "e7b74186b9071c0f", "layer": "network", "severity": "medium", "confidence": 1.0, "tags": ["security", "ports"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud/scripts/verify-image-contract.sh"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-181e66fb3f8cf95a", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: golang:1.27.1-bookworm"}, "properties": {"repobilityId": "f81bf552a4445ee3", "scanner": "scanner-primary", "fingerprint": "181e66fb3f8cf95a", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud/Dockerfile"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-d9f47d669fa5f9f3", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-trixie-slim"}, "properties": {"repobilityId": "4477d0857fa93ba8", "scanner": "scanner-primary", "fingerprint": "d9f47d669fa5f9f3", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud/Dockerfile"}, "region": {"startLine": 60}}}]}, {"ruleId": "scanner-3e1ec0b0fbae0c9f", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: gcr.io/distroless/static-debian12:nonroot"}, "properties": {"repobilityId": "34ae353be5b1547e", "scanner": "scanner-primary", "fingerprint": "3e1ec0b0fbae0c9f", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud/Dockerfile"}, "region": {"startLine": 157}}}]}, {"ruleId": "scanner-3c0d92e2fd034fb8", "level": "warning", "message": {"text": "Dockerfile runs as root: experiments/remote-browser-poc/Dockerfile"}, "properties": {"repobilityId": "e2d4ba56c7af0d2b", "scanner": "scanner-primary", "fingerprint": "3c0d92e2fd034fb8", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-99f709496a58032c", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: debian:trixie-slim"}, "properties": {"repobilityId": "7a197340a00571c4", "scanner": "scanner-primary", "fingerprint": "99f709496a58032c", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "experiments/remote-browser-poc/Dockerfile"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-faaf90ae1547bd10", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in frontend/scripts/dev-web.mjs:1"}, "properties": {"repobilityId": "854249e76b6f09c7", "scanner": "scanner-primary", "fingerprint": "faaf90ae1547bd10", "layer": "security", "severity": "medium", "confidence": 0.8, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/dev-web.mjs"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6ff10e4c0fa6ff0d", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in frontend/scripts/verify-mac-artifact.sh:63"}, "properties": {"repobilityId": "f00cc7dd648c0418", "scanner": "scanner-primary", "fingerprint": "6ff10e4c0fa6ff0d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/verify-mac-artifact.sh"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-cc7080ad7594b8d0", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in frontend/scripts/build-acp-runtime-helpers.test.mjs:141"}, "properties": {"repobilityId": "66c034589ee93af1", "scanner": "scanner-primary", "fingerprint": "cc7080ad7594b8d0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/build-acp-runtime-helpers.test.mjs"}, "region": {"startLine": 141}}}]}, {"ruleId": "scanner-a05bda3473ebebe9", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in frontend/scripts/e2e-mac-update.mjs:39"}, "properties": {"repobilityId": "14133d03fb16e55e", "scanner": "scanner-primary", "fingerprint": "a05bda3473ebebe9", "layer": "security", "severity": "medium", "confidence": 0.8, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/e2e-mac-update.mjs"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-9e86ae87e18afe6e", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in frontend/scripts/build-host-bundle.mjs:1"}, "properties": {"repobilityId": "7b07ca192704e22b", "scanner": "scanner-primary", "fingerprint": "9e86ae87e18afe6e", "layer": "security", "severity": "medium", "confidence": 0.8, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/scripts/build-host-bundle.mjs"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ad2e766c90b7ec8", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in frontend/src/annotate-preload.ts:569"}, "properties": {"repobilityId": "4cc5a972b7349753", "scanner": "scanner-primary", "fingerprint": "3ad2e766c90b7ec8", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/annotate-preload.ts"}, "region": {"startLine": 569}}}]}, {"ruleId": "scanner-e372783036b7c501", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in frontend/src/types/better-sqlite3.d.ts:18"}, "properties": {"repobilityId": "ee68b1788330ec39", "scanner": "scanner-primary", "fingerprint": "e372783036b7c501", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/types/better-sqlite3.d.ts"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-aa2880f0dfec74c2", "level": "warning", "message": {"text": "Insecure pattern 'domparser_html_parse' in frontend/src/renderer/components/SessionLinkPreviewCard.tsx:233"}, "properties": {"repobilityId": "3ee6773a940918f7", "scanner": "scanner-primary", "fingerprint": "aa2880f0dfec74c2", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "domparser_html_parse"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/SessionLinkPreviewCard.tsx"}, "region": {"startLine": 233}}}]}, {"ruleId": "scanner-1f24c243bf0ab684", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/src/renderer/components/cloud-workspace/CloudWorkspaceReviewPane.test.tsx:63"}, "properties": {"repobilityId": "81dd08c4462d7409", "scanner": "scanner-primary", "fingerprint": "1f24c243bf0ab684", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/cloud-workspace/CloudWorkspaceReviewPane.test.tsx"}, "region": {"startLine": 63}}}]}, {"ruleId": "scanner-f86b2c56a2ac6da9", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/src/renderer/components/chat/CloudSessionChatSurface.test.tsx:504"}, "properties": {"repobilityId": "af62ee0180c7fe35", "scanner": "scanner-primary", "fingerprint": "f86b2c56a2ac6da9", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/chat/CloudSessionChatSurface.test.tsx"}, "region": {"startLine": 504}}}]}, {"ruleId": "scanner-f4ed9a07523a6a1f", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/src/renderer/components/chat/MermaidBlock.tsx:206"}, "properties": {"repobilityId": "660e6032ef1be1be", "scanner": "scanner-primary", "fingerprint": "f4ed9a07523a6a1f", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/components/chat/MermaidBlock.tsx"}, "region": {"startLine": 206}}}]}, {"ruleId": "scanner-b7468fec91425af6", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/src/renderer/lib/session-management-telemetry.test.ts:96"}, "properties": {"repobilityId": "54df8c6516544262", "scanner": "scanner-primary", "fingerprint": "b7468fec91425af6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/lib/session-management-telemetry.test.ts"}, "region": {"startLine": 96}}}]}, {"ruleId": "scanner-90a039351f18d330", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in frontend/src/main/render-check.test.ts:282"}, "properties": {"repobilityId": "d7af3fd0e1b5922c", "scanner": "scanner-primary", "fingerprint": "90a039351f18d330", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/main/render-check.test.ts"}, "region": {"startLine": 282}}}]}, {"ruleId": "scanner-dd77e68d935e1eca", "level": "warning", "message": {"text": "Insecure pattern 'insert_adjacent_html' in frontend/e2e/chat-render-wrap.spec.ts:174"}, "properties": {"repobilityId": "131d70e3fb883455", "scanner": "scanner-primary", "fingerprint": "dd77e68d935e1eca", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "insert_adjacent_html"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/e2e/chat-render-wrap.spec.ts"}, "region": {"startLine": 174}}}]}, {"ruleId": "scanner-f6ce773e4ec46e97", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in cloud/internal/postgres/workspace_startup_store_test.go:158"}, "properties": {"repobilityId": "6ebe9147c1839253", "scanner": "scanner-primary", "fingerprint": "f6ce773e4ec46e97", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud/internal/postgres/workspace_startup_store_test.go"}, "region": {"startLine": 158}}}]}, {"ruleId": "scanner-73ed01cae76436c7", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in cloud/internal/agentbrowser/host/viewer.html:139"}, "properties": {"repobilityId": "c32d6f5d4a040808", "scanner": "scanner-primary", "fingerprint": "73ed01cae76436c7", "layer": "security", "severity": "medium", "confidence": 0.65, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud/internal/agentbrowser/host/viewer.html"}, "region": {"startLine": 139}}}]}, {"ruleId": "scanner-dcec5fdca5cff1ce", "level": "error", "message": {"text": "Possible secret in cloud/internal/httpapi/coder_lifecycle_handlers_test.go"}, "properties": {"repobilityId": "c8d6db847b82ce58", "scanner": "scanner-primary", "fingerprint": "dcec5fdca5cff1ce", "layer": "security", "severity": "critical", "confidence": 0.99, "tags": ["secrets", "github_token", "high-confidence-secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud/internal/httpapi/coder_lifecycle_handlers_test.go"}, "region": {"startLine": 164}}}]}, {"ruleId": "scanner-e2e1a3fd684140d1", "level": "error", "message": {"text": "Possible secret in cloud/internal/httpapi/workspace_startup_handlers_test.go"}, "properties": {"repobilityId": "d12205553cb3d41a", "scanner": "scanner-primary", "fingerprint": "e2e1a3fd684140d1", "layer": "security", "severity": "critical", "confidence": 0.99, "tags": ["secrets", "github_token", "high-confidence-secret"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud/internal/httpapi/workspace_startup_handlers_test.go"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-6c06e9d1a1d94707", "level": "warning", "message": {"text": "Possible secret in cloud/scripts/cloud-local-up.sh"}, "properties": {"repobilityId": "aee0b24d19569ce1", "scanner": "scanner-primary", "fingerprint": "6c06e9d1a1d94707", "layer": "security", "severity": "medium", "confidence": 0.58, "tags": ["secrets", "password_literal"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud/scripts/cloud-local-up.sh"}, "region": {"startLine": 95}}}]}, {"ruleId": "scanner-3d857990c1f5a7a1", "level": "error", "message": {"text": "Insecure pattern 'new_function_used' in packages/mobile/lib/chat/renderFrameModel.test.ts:100"}, "properties": {"repobilityId": "b5773757818c1edd", "scanner": "scanner-primary", "fingerprint": "3d857990c1f5a7a1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "new_function_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/mobile/lib/chat/renderFrameModel.test.ts"}, "region": {"startLine": 100}}}]}, {"ruleId": "scanner-a06980f599ae68df", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in backend/internal/adapters/agent/amp/amp_test.go:334"}, "properties": {"repobilityId": "141f11b8e6b8dc7a", "scanner": "scanner-primary", "fingerprint": "a06980f599ae68df", "layer": "security", "severity": "medium", "confidence": 0.8, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/internal/adapters/agent/amp/amp_test.go"}, "region": {"startLine": 334}}}]}, {"ruleId": "scanner-2613ce617ee9de53", "level": "note", "message": {"text": "Insecure pattern 'document_write' in backend/internal/service/linkpreview/service_test.go:18"}, "properties": {"repobilityId": "e14f311c0affebdc", "scanner": "scanner-primary", "fingerprint": "2613ce617ee9de53", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "document_write"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/internal/service/linkpreview/service_test.go"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-6980b2447233928d", "level": "warning", "message": {"text": "Insecure pattern 'weak_hash' in backend/internal/service/chat/handoff_history_files.go:5"}, "properties": {"repobilityId": "a905583773e4eca7", "scanner": "scanner-primary", "fingerprint": "6980b2447233928d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "weak_hash"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/internal/service/chat/handoff_history_files.go"}, "region": {"startLine": 5}}}]}, {"ruleId": "scanner-1cd4c86507696813", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in backend/internal/storage/sqlite/session_revision_test.go:34"}, "properties": {"repobilityId": "3351dd20d9c08937", "scanner": "scanner-primary", "fingerprint": "1cd4c86507696813", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/internal/storage/sqlite/session_revision_test.go"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-9c97dea51b2485a4", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in backend/e2e/chat_usage_limit_daemon_test.go:395"}, "properties": {"repobilityId": "16db511da493aaed", "scanner": "scanner-primary", "fingerprint": "9c97dea51b2485a4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/e2e/chat_usage_limit_daemon_test.go"}, "region": {"startLine": 395}}}]}, {"ruleId": "scanner-7b61e781f2b20705", "level": "error", "message": {"text": "Insecure pattern 'private_key_in_repo' in .github/.gitleaks.toml:76"}, "properties": {"repobilityId": "6463f78625d78696", "scanner": "scanner-primary", "fingerprint": "7b61e781f2b20705", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["owasp", "private_key_in_repo"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/.gitleaks.toml"}, "region": {"startLine": 76}}}]}, {"ruleId": "scanner-949552fb75bc56c8", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "de61d5410027bd7b", "scanner": "scanner-primary", "fingerprint": "949552fb75bc56c8", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/build-artifacts.yml"}, "region": {"startLine": 192}}}]}, {"ruleId": "scanner-c7f570b8a5790e08", "level": "warning", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "994e831d68b69eb9", "scanner": "scanner-primary", "fingerprint": "c7f570b8a5790e08", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/go.yml"}, "region": {"startLine": 263}}}]}, {"ruleId": "scanner-de39ac9e5cbf2f3d", "level": "note", "message": {"text": "GitHub Action is tag-pinned rather than SHA-pinned"}, "properties": {"repobilityId": "6e208bcb7189dc85", "scanner": "scanner-primary", "fingerprint": "de39ac9e5cbf2f3d", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-docs.yml"}, "region": {"startLine": 53}}}]}, {"ruleId": "scanner-3345532e49ae8640", "level": "warning", "message": {"text": "GitHub Actions workflow grants broad write permissions"}, "properties": {"repobilityId": "32c4cca348173c51", "scanner": "scanner-primary", "fingerprint": "3345532e49ae8640", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["supply-chain", "github-actions", "least-privilege"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".github/workflows/deploy-docs.yml"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e19c0187efbc3aeb", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "6c6f64a638af55fb", "scanner": "scanner-primary", "fingerprint": "e19c0187efbc3aeb", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/mobile/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-849ba9049feb6e94", "level": "note", "message": {"text": "Very large file: frontend/src/annotate-preload.ts (1743 lines)"}, "properties": {"repobilityId": "f35efd2e68f899f7", "scanner": "scanner-primary", "fingerprint": "849ba9049feb6e94", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-df978ea8a9d00c30", "level": "note", "message": {"text": "Very large file: frontend/src/main.ts (3630 lines)"}, "properties": {"repobilityId": "f33ce5cb908f010b", "scanner": "scanner-primary", "fingerprint": "df978ea8a9d00c30", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1a1f38e431e156c2", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/test/shell-new-session-shortcut.test.tsx (1431 lines)"}, "properties": {"repobilityId": "17771cc9dd036a39", "scanner": "scanner-primary", "fingerprint": "1a1f38e431e156c2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d24e41e45637fa74", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/SessionView.test.tsx (5970 lines)"}, "properties": {"repobilityId": "24ceeec355ffce6f", "scanner": "scanner-primary", "fingerprint": "d24e41e45637fa74", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7ac0af3721e2459b", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/NotificationCenter.tsx (1357 lines)"}, "properties": {"repobilityId": "d143b40a76074239", "scanner": "scanner-primary", "fingerprint": "7ac0af3721e2459b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-11cc09e129563073", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/BrowserPanel.tsx (2096 lines)"}, "properties": {"repobilityId": "0084059118348b6a", "scanner": "scanner-primary", "fingerprint": "11cc09e129563073", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-28701e81dc7fdcba", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/Sidebar.test.tsx (3644 lines)"}, "properties": {"repobilityId": "d65bbcd993da0182", "scanner": "scanner-primary", "fingerprint": "28701e81dc7fdcba", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7f4f50311ec75e20", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/SessionView.tsx (2283 lines)"}, "properties": {"repobilityId": "4196bcf3a5636417", "scanner": "scanner-primary", "fingerprint": "7f4f50311ec75e20", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-bd35d1aa53b84d4d", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/SessionView.remote.test.tsx (912 lines)"}, "properties": {"repobilityId": "0d62c46bd8577687", "scanner": "scanner-primary", "fingerprint": "bd35d1aa53b84d4d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-445ac8a2e9878f8b", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/SessionInspector.tsx (2824 lines)"}, "properties": {"repobilityId": "5fb1f7bde6a03a96", "scanner": "scanner-primary", "fingerprint": "445ac8a2e9878f8b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-72d7cbbe9c603432", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/CreateProjectFlow.tsx (2875 lines)"}, "properties": {"repobilityId": "45326951e7e6367c", "scanner": "scanner-primary", "fingerprint": "72d7cbbe9c603432", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-be028e4c08d935e4", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/TerminalPane.tsx (1576 lines)"}, "properties": {"repobilityId": "a0bc3df791883a02", "scanner": "scanner-primary", "fingerprint": "be028e4c08d935e4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e8633208d1a82982", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/SessionsBoard.test.tsx (1857 lines)"}, "properties": {"repobilityId": "a8f3019aefb9b5dc", "scanner": "scanner-primary", "fingerprint": "e8633208d1a82982", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e2b7337954e27047", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/TaskComposer.test.tsx (2461 lines)"}, "properties": {"repobilityId": "8e923dfaa8774e67", "scanner": "scanner-primary", "fingerprint": "e2b7337954e27047", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-faf12b3b6e323abc", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/Sidebar.tsx (3501 lines)"}, "properties": {"repobilityId": "c777e8a610642942", "scanner": "scanner-primary", "fingerprint": "faf12b3b6e323abc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ee9486caff6ea74c", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/TerminalPane.test.tsx (1542 lines)"}, "properties": {"repobilityId": "09ac4729cc626f3f", "scanner": "scanner-primary", "fingerprint": "ee9486caff6ea74c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ddf811758f93e3dc", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/XtermTerminal.tsx (2093 lines)"}, "properties": {"repobilityId": "8d16065c0441e3e2", "scanner": "scanner-primary", "fingerprint": "ddf811758f93e3dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-05f0c5d19f2967ab", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/BrowserPanel.test.tsx (2018 lines)"}, "properties": {"repobilityId": "afe4f2e863083004", "scanner": "scanner-primary", "fingerprint": "05f0c5d19f2967ab", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-52d0c3fd2e25e4d0", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/SessionInspector.test.tsx (4935 lines)"}, "properties": {"repobilityId": "0d66d788dae6d683", "scanner": "scanner-primary", "fingerprint": "52d0c3fd2e25e4d0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-94158431cb58a3c1", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/SessionFileExplorer.test.tsx (885 lines)"}, "properties": {"repobilityId": "1c3bfdda58880901", "scanner": "scanner-primary", "fingerprint": "94158431cb58a3c1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-41c94aaee07be2cb", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/ProjectSettingsForm.test.tsx (2152 lines)"}, "properties": {"repobilityId": "1dad4f23503d6fc6", "scanner": "scanner-primary", "fingerprint": "41c94aaee07be2cb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5bc3af34c7b719b8", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/CreateProjectFlow.test.tsx (3079 lines)"}, "properties": {"repobilityId": "5120978694d134ef", "scanner": "scanner-primary", "fingerprint": "5bc3af34c7b719b8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4ac617b046b579df", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/XtermTerminal.test.tsx (2924 lines)"}, "properties": {"repobilityId": "54b9904b999efed9", "scanner": "scanner-primary", "fingerprint": "4ac617b046b579df", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2f73a6cc0647c60c", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/settings/HarnessSettingsSection.test.tsx (2569 lines)"}, "properties": {"repobilityId": "f90cfc0b5d13e692", "scanner": "scanner-primary", "fingerprint": "2f73a6cc0647c60c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0c6411bb33f0b93c", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/settings/CodexAccountsSection.test.tsx (1006 lines)"}, "properties": {"repobilityId": "7167f2900e1fff06", "scanner": "scanner-primary", "fingerprint": "0c6411bb33f0b93c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e333dd5f98b6481c", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/chat/ChatComposer.tsx (2091 lines)"}, "properties": {"repobilityId": "61e71acce00e5e8b", "scanner": "scanner-primary", "fingerprint": "e333dd5f98b6481c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4d85c8b0bd726c50", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/chat/TurnSettingsBar.test.tsx (1855 lines)"}, "properties": {"repobilityId": "fe93e677d4422a60", "scanner": "scanner-primary", "fingerprint": "4d85c8b0bd726c50", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-571abaec42439b42", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/chat/CloudSessionChatSurface.test.tsx (1001 lines)"}, "properties": {"repobilityId": "f66827003d50996c", "scanner": "scanner-primary", "fingerprint": "571abaec42439b42", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ed06370c5edaf2fc", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/chat/IndependentSideChats.tsx (1572 lines)"}, "properties": {"repobilityId": "f8c95bb4fd35c010", "scanner": "scanner-primary", "fingerprint": "ed06370c5edaf2fc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6cd0beaf022e8a63", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/chat/TurnSettingsBar.tsx (1783 lines)"}, "properties": {"repobilityId": "c4fad358c0ffd515", "scanner": "scanner-primary", "fingerprint": "6cd0beaf022e8a63", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3bc4e8eb75359cbc", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/chat/ChatWorkspace.tsx (5174 lines)"}, "properties": {"repobilityId": "432385f66dbbcd9f", "scanner": "scanner-primary", "fingerprint": "3bc4e8eb75359cbc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-43c94de5ec28c652", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/chat/ChatTimelineItems.tsx (3239 lines)"}, "properties": {"repobilityId": "a5b4dbb66e4bcfb8", "scanner": "scanner-primary", "fingerprint": "43c94de5ec28c652", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b8a2a2efbf16b5ed", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/chat/ChatComposer.test.tsx (2946 lines)"}, "properties": {"repobilityId": "095bbd6ca860cfb9", "scanner": "scanner-primary", "fingerprint": "b8a2a2efbf16b5ed", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1e7bbf6abf683c11", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/chat/ChatWorkspace.test.tsx (5449 lines)"}, "properties": {"repobilityId": "d55903ffce0e7583", "scanner": "scanner-primary", "fingerprint": "1e7bbf6abf683c11", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1553a93146f56cf9", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/chat/SessionChatSurface.test.tsx (1367 lines)"}, "properties": {"repobilityId": "9fbb4ffb080e8789", "scanner": "scanner-primary", "fingerprint": "1553a93146f56cf9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-83f07f3ff5f49a6a", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/components/diffs/WorkspaceReviewPane.test.tsx (834 lines)"}, "properties": {"repobilityId": "a61f3e3c5ddac811", "scanner": "scanner-primary", "fingerprint": "83f07f3ff5f49a6a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0a7942d49f6b1a10", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/lib/chat-drafts.ts (1496 lines)"}, "properties": {"repobilityId": "8e6a9c9c557e7f00", "scanner": "scanner-primary", "fingerprint": "0a7942d49f6b1a10", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-92002aa34762196f", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/routes/_shell.tsx (1543 lines)"}, "properties": {"repobilityId": "869b5e2749c26e95", "scanner": "scanner-primary", "fingerprint": "92002aa34762196f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f68383a9855bc5bc", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/hooks/useBrowserView.test.tsx (2127 lines)"}, "properties": {"repobilityId": "b1c7fa564151cf62", "scanner": "scanner-primary", "fingerprint": "f68383a9855bc5bc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b8a8525ff3dcb132", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/hooks/useTerminalSession.test.tsx (1351 lines)"}, "properties": {"repobilityId": "6143104ee947270d", "scanner": "scanner-primary", "fingerprint": "b8a8525ff3dcb132", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-12a907586309e2ac", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/hooks/useConversation.test.tsx (1391 lines)"}, "properties": {"repobilityId": "2a85d881e5b5cd16", "scanner": "scanner-primary", "fingerprint": "12a907586309e2ac", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-aa2c0feecee797ed", "level": "note", "message": {"text": "Very large file: frontend/src/renderer/hooks/useConversation.ts (1956 lines)"}, "properties": {"repobilityId": "9ca0c75abbbfdffd", "scanner": "scanner-primary", "fingerprint": "aa2c0feecee797ed", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9667de6d08ddbaa8", "level": "note", "message": {"text": "Very large file: frontend/src/api/schema.ts (23266 lines)"}, "properties": {"repobilityId": "a812f3e81bd1554a", "scanner": "scanner-primary", "fingerprint": "9667de6d08ddbaa8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f3797fae31f6987b", "level": "note", "message": {"text": "Very large file: frontend/src/main/auto-updater.ts (2935 lines)"}, "properties": {"repobilityId": "6c098806804bd21f", "scanner": "scanner-primary", "fingerprint": "f3797fae31f6987b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-cd1af070331e00ea", "level": "note", "message": {"text": "Very large file: frontend/src/main/auto-updater.test.ts (4604 lines)"}, "properties": {"repobilityId": "d2a098081aa1e13b", "scanner": "scanner-primary", "fingerprint": "cd1af070331e00ea", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-28bb98852352123a", "level": "note", "message": {"text": "Very large file: frontend/src/main/browser-view-host.test.ts (6232 lines)"}, "properties": {"repobilityId": "045196884c64da9b", "scanner": "scanner-primary", "fingerprint": "28bb98852352123a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0befb0a6fe19cc7c", "level": "note", "message": {"text": "Very large file: frontend/src/main/remote-proxy.test.ts (1672 lines)"}, "properties": {"repobilityId": "f65b7d2689e4a521", "scanner": "scanner-primary", "fingerprint": "0befb0a6fe19cc7c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d1408ef002b11fd8", "level": "note", "message": {"text": "Very large file: frontend/src/main/browser-view-host.ts (6524 lines)"}, "properties": {"repobilityId": "590e917819609c65", "scanner": "scanner-primary", "fingerprint": "d1408ef002b11fd8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c0f2d67409af327c", "level": "note", "message": {"text": "Very large file: frontend/src/main/browser-profile-import.test.ts (1483 lines)"}, "properties": {"repobilityId": "6628375e4c5d7ffa", "scanner": "scanner-primary", "fingerprint": "c0f2d67409af327c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8e52e194e4625152", "level": "note", "message": {"text": "Very large file: frontend/src/main/browser-profile-import.ts (1705 lines)"}, "properties": {"repobilityId": "3f3c096a3cc6dd1b", "scanner": "scanner-primary", "fingerprint": "8e52e194e4625152", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a3da4646e5a6c6c9", "level": "note", "message": {"text": "Very large file: frontend/e2e/support/fake-bridge.ts (1272 lines)"}, "properties": {"repobilityId": "a5d6b21b5038fbbd", "scanner": "scanner-primary", "fingerprint": "a3da4646e5a6c6c9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9e45521932413c0c", "level": "note", "message": {"text": "Very large file: cloud/internal/workertransport/supervisor.go (1537 lines)"}, "properties": {"repobilityId": "02392faf21b67b77", "scanner": "scanner-primary", "fingerprint": "9e45521932413c0c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-07d77aa8402985d9", "level": "note", "message": {"text": "Very large file: cloud/internal/reconcile/reconciler.go (2101 lines)"}, "properties": {"repobilityId": "fff8f46565585d24", "scanner": "scanner-primary", "fingerprint": "07d77aa8402985d9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d240c98f647b6316", "level": "note", "message": {"text": "Very large file: cloud/internal/sandbox/coder/client_test.go (1433 lines)"}, "properties": {"repobilityId": "c26a8b1f7dd2942d", "scanner": "scanner-primary", "fingerprint": "d240c98f647b6316", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-274dfa1511372470", "level": "note", "message": {"text": "Very large file: cloud/internal/sandbox/coder/client.go (2404 lines)"}, "properties": {"repobilityId": "9d7844b6bc99e863", "scanner": "scanner-primary", "fingerprint": "274dfa1511372470", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a4402187d7f2f061", "level": "note", "message": {"text": "Very large file: cloud/internal/postgres/worker_transport_store.go (1706 lines)"}, "properties": {"repobilityId": "6737f1b994cacfa3", "scanner": "scanner-primary", "fingerprint": "a4402187d7f2f061", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c503e4618d7c6456", "level": "note", "message": {"text": "Very large file: cloud/internal/postgres/sandbox_store.go (1739 lines)"}, "properties": {"repobilityId": "ce999e0e648e0f9c", "scanner": "scanner-primary", "fingerprint": "c503e4618d7c6456", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-88b6613301488e90", "level": "note", "message": {"text": "Very large file: cloud/internal/postgres/billing_store.go (1436 lines)"}, "properties": {"repobilityId": "3fb83c9588187ea7", "scanner": "scanner-primary", "fingerprint": "88b6613301488e90", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a5c08f6bc5b0529c", "level": "note", "message": {"text": "Very large file: cloud/internal/postgres/github_store.go (1861 lines)"}, "properties": {"repobilityId": "45321eb0c02928cc", "scanner": "scanner-primary", "fingerprint": "a5c08f6bc5b0529c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a4fa0d2db79e8a57", "level": "note", "message": {"text": "Very large file: cloud/internal/postgres/project_session_store.go (1591 lines)"}, "properties": {"repobilityId": "b8296c1ce06cecb6", "scanner": "scanner-primary", "fingerprint": "a4fa0d2db79e8a57", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-53ea071935f968a7", "level": "note", "message": {"text": "Very large file: cloud/internal/githubapp/service.go (1498 lines)"}, "properties": {"repobilityId": "bf017cf1abb92be2", "scanner": "scanner-primary", "fingerprint": "53ea071935f968a7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1ecd75f64d409833", "level": "note", "message": {"text": "Very large file: cloud/internal/agentbrowser/host/viewer.go (1680 lines)"}, "properties": {"repobilityId": "08ea86af4e7e4e34", "scanner": "scanner-primary", "fingerprint": "1ecd75f64d409833", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e8cbb936cebc9fd8", "level": "note", "message": {"text": "Very large file: cloud/internal/httpapi/worker_handlers.go (1586 lines)"}, "properties": {"repobilityId": "c777f8304fd47bd3", "scanner": "scanner-primary", "fingerprint": "e8cbb936cebc9fd8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5b414667f641af71", "level": "note", "message": {"text": "Very large file: cloud/internal/httpapi/resource_handlers.go (1448 lines)"}, "properties": {"repobilityId": "c576c6018cd2f412", "scanner": "scanner-primary", "fingerprint": "5b414667f641af71", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-63b6d2d4d00c9161", "level": "note", "message": {"text": "Very large file: cloud/cmd/ao-worker/main.go (1875 lines)"}, "properties": {"repobilityId": "be298e97cb330300", "scanner": "scanner-primary", "fingerprint": "63b6d2d4d00c9161", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-53b821895d9315a5", "level": "note", "message": {"text": "Very large file: packages/product-ui/src/SessionInspectorView.tsx (1607 lines)"}, "properties": {"repobilityId": "a2e742ec37770f18", "scanner": "scanner-primary", "fingerprint": "53b821895d9315a5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9560472a83ef6d24", "level": "note", "message": {"text": "Very large file: packages/mobile/lib/chat/ChatTimeline.tsx (1261 lines)"}, "properties": {"repobilityId": "f05115aa73430a36", "scanner": "scanner-primary", "fingerprint": "9560472a83ef6d24", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-cd5abee3f6592ed4", "level": "note", "message": {"text": "Very large file: packages/mobile/lib/session/TerminalSessionScreen.tsx (1713 lines)"}, "properties": {"repobilityId": "62b12867372dac6d", "scanner": "scanner-primary", "fingerprint": "cd5abee3f6592ed4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d39b56de78b53ac3", "level": "note", "message": {"text": "Very large file: packages/cloud-client/src/schema.ts (5869 lines)"}, "properties": {"repobilityId": "c473993f08a888d1", "scanner": "scanner-primary", "fingerprint": "d39b56de78b53ac3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-df04d7d0cba5f1aa", "level": "note", "message": {"text": "Very large file: backend/internal/adapters/agent/hermes/hermes_test.go (1878 lines)"}, "properties": {"repobilityId": "494b51e44878efdf", "scanner": "scanner-primary", "fingerprint": "df04d7d0cba5f1aa", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5b5ae243e96e62d2", "level": "note", "message": {"text": "Very large file: backend/internal/adapters/agent/hermes/hermes.go (1811 lines)"}, "properties": {"repobilityId": "bc72952021e00ab6", "scanner": "scanner-primary", "fingerprint": "5b5ae243e96e62d2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3c2a48845a5403d9", "level": "note", "message": {"text": "Very large file: backend/internal/adapters/agent/modelcatalog/catalog.go (1473 lines)"}, "properties": {"repobilityId": "ef86584b0292acfc", "scanner": "scanner-primary", "fingerprint": "3c2a48845a5403d9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-0eda847e0f78dd10", "level": "note", "message": {"text": "Very large file: backend/internal/adapters/agent/modelcatalog/catalog_test.go (1393 lines)"}, "properties": {"repobilityId": "e697baa3b5950632", "scanner": "scanner-primary", "fingerprint": "0eda847e0f78dd10", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6839157de28c6012", "level": "note", "message": {"text": "Very large file: backend/internal/adapters/agent/claudecode/claudecode_test.go (1700 lines)"}, "properties": {"repobilityId": "3972dd7ab14f47e3", "scanner": "scanner-primary", "fingerprint": "6839157de28c6012", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-42db181eae4fb499", "level": "note", "message": {"text": "Very large file: backend/internal/adapters/workspace/gitworktree/workspace.go (2343 lines)"}, "properties": {"repobilityId": "35f321343b4e3943", "scanner": "scanner-primary", "fingerprint": "42db181eae4fb499", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6ad59bb3a96f5086", "level": "note", "message": {"text": "Very large file: backend/internal/adapters/workspace/gitworktree/workspace_integration_test.go (1618 lines)"}, "properties": {"repobilityId": "576d752eb2de5646", "scanner": "scanner-primary", "fingerprint": "6ad59bb3a96f5086", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d02b4061634c6120", "level": "note", "message": {"text": "Very large file: backend/internal/adapters/scm/github/provider_test.go (1933 lines)"}, "properties": {"repobilityId": "a64d8b97826788da", "scanner": "scanner-primary", "fingerprint": "d02b4061634c6120", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-727f25f6153a3d7e", "level": "note", "message": {"text": "Very large file: backend/internal/adapters/scm/gitlab/provider_test.go (3237 lines)"}, "properties": {"repobilityId": "8db139a397175e20", "scanner": "scanner-primary", "fingerprint": "727f25f6153a3d7e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1844aa374cf3ed3a", "level": "note", "message": {"text": "Very large file: backend/internal/adapters/runtime/tmux/tmux_test.go (2327 lines)"}, "properties": {"repobilityId": "f730ad9857600753", "scanner": "scanner-primary", "fingerprint": "1844aa374cf3ed3a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9c3c039cebd77fd1", "level": "note", "message": {"text": "Very large file: backend/internal/adapters/runtime/tmux/tmux.go (1749 lines)"}, "properties": {"repobilityId": "4c0146ef3958b85c", "scanner": "scanner-primary", "fingerprint": "9c3c039cebd77fd1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-11985db54b5c2709", "level": "note", "message": {"text": "Very large file: backend/internal/adapters/chatdriver/codexappserver/driver_test.go (1865 lines)"}, "properties": {"repobilityId": "89b984d003a8a647", "scanner": "scanner-primary", "fingerprint": "11985db54b5c2709", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-541a17d1aa79d891", "level": "note", "message": {"text": "Very large file: backend/internal/adapters/chatdriver/codexappserver/normalize.go (1442 lines)"}, "properties": {"repobilityId": "98560bf329664e49", "scanner": "scanner-primary", "fingerprint": "541a17d1aa79d891", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-59c25f0bcead8936", "level": "note", "message": {"text": "Very large file: backend/internal/adapters/chatdriver/codexappserver/codexproto/protocol.gen.go (5365 lines)"}, "properties": {"repobilityId": "f136bf1fc1f22d87", "scanner": "scanner-primary", "fingerprint": "59c25f0bcead8936", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9d2df0702e6105c4", "level": "note", "message": {"text": "Very large file: backend/internal/adapters/chatdriver/acp/driver_test.go (5149 lines)"}, "properties": {"repobilityId": "249f5b1ca714eac2", "scanner": "scanner-primary", "fingerprint": "9d2df0702e6105c4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6159c9e4931a9872", "level": "note", "message": {"text": "Very large file: backend/internal/review/review.go (2039 lines)"}, "properties": {"repobilityId": "00db0fdb0d9149f2", "scanner": "scanner-primary", "fingerprint": "6159c9e4931a9872", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ee218438553cbd17", "level": "note", "message": {"text": "Very large file: backend/internal/review/review_test.go (3385 lines)"}, "properties": {"repobilityId": "af4809af901c957f", "scanner": "scanner-primary", "fingerprint": "ee218438553cbd17", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a6193900c55aaf60", "level": "note", "message": {"text": "Very large file: backend/internal/cli/hooks_test.go (2452 lines)"}, "properties": {"repobilityId": "e07a57b34ce650c6", "scanner": "scanner-primary", "fingerprint": "a6193900c55aaf60", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-68a20ffeb74df2d6", "level": "note", "message": {"text": "Very large file: backend/internal/cli/spawn_test.go (1174 lines)"}, "properties": {"repobilityId": "c3668789ae23512c", "scanner": "scanner-primary", "fingerprint": "68a20ffeb74df2d6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ab0f7b0597fba130", "level": "note", "message": {"text": "Very large file: backend/internal/observe/usage/ingestor_integration_test.go (1272 lines)"}, "properties": {"repobilityId": "81b3486721af3016", "scanner": "scanner-primary", "fingerprint": "ab0f7b0597fba130", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c8199f5962be20c0", "level": "note", "message": {"text": "Very large file: backend/internal/observe/usage/parser_test.go (1185 lines)"}, "properties": {"repobilityId": "7660a23cd115fadd", "scanner": "scanner-primary", "fingerprint": "c8199f5962be20c0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-1491d1349c875f20", "level": "note", "message": {"text": "Very large file: backend/internal/observe/scm/observer_test.go (3561 lines)"}, "properties": {"repobilityId": "01f00050a5cc2e05", "scanner": "scanner-primary", "fingerprint": "1491d1349c875f20", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d8a1add272a292e9", "level": "note", "message": {"text": "Very large file: backend/internal/observe/scm/observer.go (2297 lines)"}, "properties": {"repobilityId": "8f356d4a963b97d3", "scanner": "scanner-primary", "fingerprint": "d8a1add272a292e9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ce10772916640aca", "level": "note", "message": {"text": "Very large file: backend/internal/httpd/apispec/specgen/build.go (3720 lines)"}, "properties": {"repobilityId": "fae356cd7d34cc3c", "scanner": "scanner-primary", "fingerprint": "ce10772916640aca", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5803bddb2435a963", "level": "note", "message": {"text": "Very large file: backend/internal/httpd/controllers/conversations.go (1770 lines)"}, "properties": {"repobilityId": "4bf8cf78ef37369c", "scanner": "scanner-primary", "fingerprint": "5803bddb2435a963", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-27749776d4ac9903", "level": "note", "message": {"text": "Very large file: backend/internal/httpd/controllers/sessions_test.go (5237 lines)"}, "properties": {"repobilityId": "3b23645ab3d09937", "scanner": "scanner-primary", "fingerprint": "27749776d4ac9903", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2212741c0c140efd", "level": "note", "message": {"text": "Very large file: backend/internal/httpd/controllers/sessions.go (3187 lines)"}, "properties": {"repobilityId": "6dd8bddc1d1d6e07", "scanner": "scanner-primary", "fingerprint": "2212741c0c140efd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9c334d41bdba760e", "level": "note", "message": {"text": "Very large file: backend/internal/httpd/controllers/dto.go (3807 lines)"}, "properties": {"repobilityId": "05f5164fc0008367", "scanner": "scanner-primary", "fingerprint": "9c334d41bdba760e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-782434daf005c354", "level": "note", "message": {"text": "Very large file: backend/internal/lifecycle/manager_test.go (4970 lines)"}, "properties": {"repobilityId": "6cad37047f430c02", "scanner": "scanner-primary", "fingerprint": "782434daf005c354", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-034f93d86438a180", "level": "note", "message": {"text": "Very large file: backend/internal/lifecycle/manager.go (1888 lines)"}, "properties": {"repobilityId": "e5e0b3f5a39177b6", "scanner": "scanner-primary", "fingerprint": "034f93d86438a180", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6fd5575d184c8605", "level": "note", "message": {"text": "Very large file: backend/internal/daemon/daemon.go (1388 lines)"}, "properties": {"repobilityId": "9cc5680f869859d8", "scanner": "scanner-primary", "fingerprint": "6fd5575d184c8605", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-8888981ac80fe253", "level": "note", "message": {"text": "Very large file: backend/internal/service/usage/collector.go (2361 lines)"}, "properties": {"repobilityId": "6958e69454ace2a4", "scanner": "scanner-primary", "fingerprint": "8888981ac80fe253", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d0b84ba76274825c", "level": "note", "message": {"text": "Very large file: backend/internal/service/usage/collector_test.go (2270 lines)"}, "properties": {"repobilityId": "2c840b9c6a0deccc", "scanner": "scanner-primary", "fingerprint": "d0b84ba76274825c", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-836cf732c45e1f06", "level": "note", "message": {"text": "Very large file: backend/internal/service/shellterm/service_test.go (2306 lines)"}, "properties": {"repobilityId": "3ff61ae459d44baf", "scanner": "scanner-primary", "fingerprint": "836cf732c45e1f06", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5e46df9d5befb198", "level": "note", "message": {"text": "Very large file: backend/internal/service/agent/catalog_test.go (2794 lines)"}, "properties": {"repobilityId": "c71e94e87d29c6d3", "scanner": "scanner-primary", "fingerprint": "5e46df9d5befb198", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-364234e163765d61", "level": "note", "message": {"text": "Very large file: backend/internal/service/agent/codex_accounts_test.go (2513 lines)"}, "properties": {"repobilityId": "39ef0782288ccb1a", "scanner": "scanner-primary", "fingerprint": "364234e163765d61", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b8151efe43001d19", "level": "note", "message": {"text": "Very large file: backend/internal/service/chat/history.go (1227 lines)"}, "properties": {"repobilityId": "a08d6ebc3ffc205e", "scanner": "scanner-primary", "fingerprint": "b8151efe43001d19", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-08e44fb94ee2d9ad", "level": "note", "message": {"text": "Very large file: backend/internal/service/chat/controller_test.go (7219 lines)"}, "properties": {"repobilityId": "1b192c94776082a2", "scanner": "scanner-primary", "fingerprint": "08e44fb94ee2d9ad", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-60f0c8cdbb91a9b5", "level": "note", "message": {"text": "Very large file: backend/internal/service/chat/controller.go (4012 lines)"}, "properties": {"repobilityId": "54a18789773be17b", "scanner": "scanner-primary", "fingerprint": "60f0c8cdbb91a9b5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c5401d38ea2a570b", "level": "note", "message": {"text": "Very large file: backend/internal/service/chat/history_test.go (2951 lines)"}, "properties": {"repobilityId": "e2db368033aa87b7", "scanner": "scanner-primary", "fingerprint": "c5401d38ea2a570b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2c375ae29d763e31", "level": "note", "message": {"text": "Very large file: backend/internal/service/chat/hibernate_test.go (1231 lines)"}, "properties": {"repobilityId": "f1ee23c422120ccc", "scanner": "scanner-primary", "fingerprint": "2c375ae29d763e31", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-26ad4924e2fa9a88", "level": "note", "message": {"text": "Very large file: backend/internal/service/chat/service.go (3046 lines)"}, "properties": {"repobilityId": "7e420c423657e3e6", "scanner": "scanner-primary", "fingerprint": "26ad4924e2fa9a88", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4d4fd8e0a23e35e6", "level": "note", "message": {"text": "Very large file: backend/internal/service/chat/side.go (2043 lines)"}, "properties": {"repobilityId": "9e02fe56ebaa6b5c", "scanner": "scanner-primary", "fingerprint": "4d4fd8e0a23e35e6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-e2bb5e2b73b859a9", "level": "note", "message": {"text": "Very large file: backend/internal/service/systeminstall/systeminstall.go (2037 lines)"}, "properties": {"repobilityId": "407a2c8f7c520371", "scanner": "scanner-primary", "fingerprint": "e2bb5e2b73b859a9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-bbca66a4fd480773", "level": "note", "message": {"text": "Very large file: backend/internal/service/systeminstall/systeminstall_test.go (2038 lines)"}, "properties": {"repobilityId": "e75590cda8503c16", "scanner": "scanner-primary", "fingerprint": "bbca66a4fd480773", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-3082361ecb610afb", "level": "note", "message": {"text": "Very large file: backend/internal/service/session/workspace_files.go (2939 lines)"}, "properties": {"repobilityId": "0d9e510ff9d46df9", "scanner": "scanner-primary", "fingerprint": "3082361ecb610afb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-dac701352b52da36", "level": "note", "message": {"text": "Very large file: backend/internal/service/session/service_test.go (5986 lines)"}, "properties": {"repobilityId": "97f25a2ceb586651", "scanner": "scanner-primary", "fingerprint": "dac701352b52da36", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-c688d2e7b097bfd4", "level": "note", "message": {"text": "Very large file: backend/internal/service/session/service.go (1714 lines)"}, "properties": {"repobilityId": "9c32100c52040f58", "scanner": "scanner-primary", "fingerprint": "c688d2e7b097bfd4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-831a83faa7b026a5", "level": "note", "message": {"text": "Very large file: backend/internal/service/project/service_test.go (2497 lines)"}, "properties": {"repobilityId": "f974a6216e1ef4c3", "scanner": "scanner-primary", "fingerprint": "831a83faa7b026a5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2f072ecc18776c6d", "level": "note", "message": {"text": "Very large file: backend/internal/ports/chat.go (1280 lines)"}, "properties": {"repobilityId": "9be2137663c01060", "scanner": "scanner-primary", "fingerprint": "2f072ecc18776c6d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7f4cf778e4f380d7", "level": "note", "message": {"text": "Very large file: backend/internal/session_manager/chat_spawn_test.go (2019 lines)"}, "properties": {"repobilityId": "7547f97b627fe8e2", "scanner": "scanner-primary", "fingerprint": "7f4cf778e4f380d7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-38c11b11fc22d1d1", "level": "note", "message": {"text": "Very large file: backend/internal/session_manager/manager_test.go (11998 lines)"}, "properties": {"repobilityId": "a652b26767c630d6", "scanner": "scanner-primary", "fingerprint": "38c11b11fc22d1d1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5ddd41dbf519abe0", "level": "note", "message": {"text": "Very large file: backend/internal/session_manager/interface_transition.go (1904 lines)"}, "properties": {"repobilityId": "511968f2b4670e3b", "scanner": "scanner-primary", "fingerprint": "5ddd41dbf519abe0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-51c6488ca64b0bc5", "level": "note", "message": {"text": "Very large file: backend/internal/session_manager/manager.go (7070 lines)"}, "properties": {"repobilityId": "2adbffee5a947be7", "scanner": "scanner-primary", "fingerprint": "51c6488ca64b0bc5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-82dc3e56bc4e66d8", "level": "note", "message": {"text": "Very large file: backend/internal/session_manager/interface_transition_test.go (3390 lines)"}, "properties": {"repobilityId": "d4b6fdeb648946be", "scanner": "scanner-primary", "fingerprint": "82dc3e56bc4e66d8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-a0582912ed11f4dc", "level": "note", "message": {"text": "Very large file: backend/internal/storage/sqlite/db.go (2311 lines)"}, "properties": {"repobilityId": "fec586316ef1cdf7", "scanner": "scanner-primary", "fingerprint": "a0582912ed11f4dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5a60ef4fd2f816af", "level": "note", "message": {"text": "Very large file: backend/internal/storage/sqlite/gen/usage.sql.go (1785 lines)"}, "properties": {"repobilityId": "a2469bb3b10190a4", "scanner": "scanner-primary", "fingerprint": "5a60ef4fd2f816af", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-73f4832dd0d6f168", "level": "note", "message": {"text": "Very large file: backend/internal/storage/sqlite/gen/conversations.sql.go (4839 lines)"}, "properties": {"repobilityId": "f05a627287d63db0", "scanner": "scanner-primary", "fingerprint": "73f4832dd0d6f168", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b21a22dceed0fa8f", "level": "note", "message": {"text": "Very large file: backend/internal/storage/sqlite/gen/sessions.sql.go (2254 lines)"}, "properties": {"repobilityId": "9a366675ff109003", "scanner": "scanner-primary", "fingerprint": "b21a22dceed0fa8f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-d5830396971244c2", "level": "note", "message": {"text": "Very large file: backend/internal/storage/sqlite/store/conversation_branch_store_test.go (1250 lines)"}, "properties": {"repobilityId": "e8dab48a1ee9067c", "scanner": "scanner-primary", "fingerprint": "d5830396971244c2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-9c0184cb7333d091", "level": "note", "message": {"text": "Very large file: backend/internal/storage/sqlite/store/store_test.go (2545 lines)"}, "properties": {"repobilityId": "a3b6698fa5b90e3d", "scanner": "scanner-primary", "fingerprint": "9c0184cb7333d091", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2e99e00ae8ff0363", "level": "note", "message": {"text": "Very large file: backend/internal/storage/sqlite/store/session_store.go (1288 lines)"}, "properties": {"repobilityId": "1e2c8a2b91409788", "scanner": "scanner-primary", "fingerprint": "2e99e00ae8ff0363", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7a686787ee9c564b", "level": "note", "message": {"text": "Very large file: backend/internal/storage/sqlite/store/usage_store_test.go (2110 lines)"}, "properties": {"repobilityId": "c3310470ea4d0733", "scanner": "scanner-primary", "fingerprint": "7a686787ee9c564b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f39cd22ea1325d9d", "level": "note", "message": {"text": "Very large file: backend/internal/storage/sqlite/store/conversation_store.go (4603 lines)"}, "properties": {"repobilityId": "06ec947f59ff3e2d", "scanner": "scanner-primary", "fingerprint": "f39cd22ea1325d9d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-978f2136b993d868", "level": "note", "message": {"text": "Very large file: backend/internal/storage/sqlite/store/conversation_history_store_test.go (1752 lines)"}, "properties": {"repobilityId": "1d00aad12268fe83", "scanner": "scanner-primary", "fingerprint": "978f2136b993d868", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-2e2c9b1ab3b906d5", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/ao/package.json"}, "properties": {"repobilityId": "50d9d9a352c3fc9a", "scanner": "scanner-primary", "fingerprint": "2e2c9b1ab3b906d5", "layer": "dependencies", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/ao/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "451eb4a05fd61402", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "1c1af8d22a43e644", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "61c07ec0e0e3df0b", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "97e2ffac575eafb8", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-a3d768a9c62612a0", "level": "warning", "message": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 frontend/src/main.ts:671"}, "properties": {"repobilityId": "49032df6cf178e38", "scanner": "scanner-primary", "fingerprint": "a3d768a9c62612a0", "layer": "quality", "severity": "medium", "confidence": 0.9, "tags": ["integrity", "fragile-runtime", "robustness", "unhandled-promise"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/main.ts"}, "region": {"startLine": 671}}}]}, {"ruleId": "scanner-68d1ca0150e43926", "level": "note", "message": {"text": "Legacy-named symbol `clearsLegacy` in frontend/src/renderer/components/AutomationsView.tsx:259"}, "properties": {"repobilityId": "beabbd563d45d7f2", "scanner": "scanner-primary", "fingerprint": "68d1ca0150e43926", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b893f831710f438d", "level": "warning", "message": {"text": "Fire-and-forget `fetch()` has no rejection handler \u2014 frontend/src/renderer/lib/event-transport.ts:83"}, "properties": {"repobilityId": "678f6ed8ffba8464", "scanner": "scanner-primary", "fingerprint": "b893f831710f438d", "layer": "quality", "severity": "medium", "confidence": 0.9, "tags": ["integrity", "fragile-runtime", "robustness", "unhandled-promise"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/renderer/lib/event-transport.ts"}, "region": {"startLine": 83}}}]}, {"ruleId": "scanner-b3000bd1d687a1db", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 cloud/scripts/verify-ecs-service.py:18"}, "properties": {"repobilityId": "f9e9eba47acd76ed", "scanner": "scanner-primary", "fingerprint": "b3000bd1d687a1db", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud/scripts/verify-ecs-service.py"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-d3072c65de877431", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 cloud/scripts/configure-offering-monitoring.py:81"}, "properties": {"repobilityId": "0b5432ea94efc437", "scanner": "scanner-primary", "fingerprint": "d3072c65de877431", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud/scripts/configure-offering-monitoring.py"}, "region": {"startLine": 81}}}]}, {"ruleId": "scanner-fefcae27e6271e53", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 cloud/scripts/configure-monitoring.py:17"}, "properties": {"repobilityId": "59d95f8a9b0f5c00", "scanner": "scanner-primary", "fingerprint": "fefcae27e6271e53", "layer": "quality", "severity": "medium", "confidence": 0.85, "tags": ["integrity", "fragile-runtime", "robustness"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "cloud/scripts/configure-monitoring.py"}, "region": {"startLine": 17}}}]}, {"ruleId": "scanner-ebbfbb7098bc1529", "level": "none", "message": {"text": "Commented-code block (7 lines) in packages/mobile/lib/theme.ts:3"}, "properties": {"repobilityId": "97aababcf07f6fc8", "scanner": "scanner-primary", "fingerprint": "ebbfbb7098bc1529", "layer": "quality", "severity": "info", "confidence": 0.72, "tags": ["integrity", "commented-code", "dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/mobile/lib/theme.ts"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-b510aba8874ac1df", "level": "note", "message": {"text": "Legacy-named symbol `firstOld` in packages/mobile/lib/files/model.ts:151"}, "properties": {"repobilityId": "ce4e03749d086442", "scanner": "scanner-primary", "fingerprint": "b510aba8874ac1df", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-66bce55719c47e5f", "level": "note", "message": {"text": "92 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "95e0bcbf5ae0de77", "scanner": "scanner-primary", "fingerprint": "66bce55719c47e5f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-af78b763ccb22eec", "level": "warning", "message": {"text": "Vulnerable dependency dompurify 3.4.14: GHSA-6688-9rhm-gjv2"}, "properties": {"repobilityId": "bb4b79ab78a8b393", "scanner": "scanner-primary", "fingerprint": "af78b763ccb22eec", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-6688-9rhm-gjv2"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2f31d4512ab168cc", "level": "warning", "message": {"text": "Vulnerable dependency dompurify 3.4.14: GHSA-p98j-92pf-mc4p"}, "properties": {"repobilityId": "7d22807f80f0f735", "scanner": "scanner-primary", "fingerprint": "2f31d4512ab168cc", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-p98j-92pf-mc4p"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fff719fdfb6d2bc6", "level": "error", "message": {"text": "Vulnerable dependency vite 8.0.16: GHSA-587h-7wmj-h5pm"}, "properties": {"repobilityId": "056213a379eb05bb", "scanner": "scanner-primary", "fingerprint": "fff719fdfb6d2bc6", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-587h-7wmj-h5pm", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d7114fb2db47b878", "level": "warning", "message": {"text": "Vulnerable dependency vite 8.0.16: GHSA-698v-4r3x-3vcv"}, "properties": {"repobilityId": "aecc1ec46ef63954", "scanner": "scanner-primary", "fingerprint": "d7114fb2db47b878", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-698v-4r3x-3vcv", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-efe16c5d7a3bcea8", "level": "note", "message": {"text": "Vulnerable dependency vite 8.0.16: GHSA-9jrq-w75r-8gcw"}, "properties": {"repobilityId": "ffdc099dcf7bd106", "scanner": "scanner-primary", "fingerprint": "efe16c5d7a3bcea8", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-9jrq-w75r-8gcw", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-75883af3802831db", "level": "warning", "message": {"text": "Vulnerable dependency vite 8.0.16: GHSA-r825-w8mm-5pxw"}, "properties": {"repobilityId": "c2263b965e413680", "scanner": "scanner-primary", "fingerprint": "75883af3802831db", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-r825-w8mm-5pxw", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6658870ec2fac2c1", "level": "warning", "message": {"text": "Vulnerable dependency vite 8.0.16: GHSA-rq7h-c2jc-7f22"}, "properties": {"repobilityId": "d55897e0d0b19295", "scanner": "scanner-primary", "fingerprint": "6658870ec2fac2c1", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rq7h-c2jc-7f22", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-caebe3537d7697c4", "level": "warning", "message": {"text": "Vulnerable dependency vitest 4.1.8: GHSA-82fw-gwwq-j7x9"}, "properties": {"repobilityId": "d78e9708d59416f1", "scanner": "scanner-primary", "fingerprint": "caebe3537d7697c4", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-82fw-gwwq-j7x9", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8056188a51053e9f", "level": "warning", "message": {"text": "Vulnerable dependency next 16.2.11: GHSA-2xp9-vwfh-vxw4"}, "properties": {"repobilityId": "92cdeb8a17c5a4a2", "scanner": "scanner-primary", "fingerprint": "8056188a51053e9f", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-2xp9-vwfh-vxw4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/docs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b3c418f48d2c1e3b", "level": "warning", "message": {"text": "Vulnerable dependency next 16.2.11: GHSA-39w2-rjm5-chcv"}, "properties": {"repobilityId": "7403fd0ff7adc4b0", "scanner": "scanner-primary", "fingerprint": "b3c418f48d2c1e3b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-39w2-rjm5-chcv"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/docs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a2c40dddb129fd1b", "level": "warning", "message": {"text": "Vulnerable dependency next 16.2.11: GHSA-4jqv-mc3x-m676"}, "properties": {"repobilityId": "16b0cbbd2245de8b", "scanner": "scanner-primary", "fingerprint": "a2c40dddb129fd1b", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-4jqv-mc3x-m676"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/docs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a7d0b5c4d7976bbf", "level": "warning", "message": {"text": "Vulnerable dependency next 16.2.11: GHSA-cjq9-62q9-8jv4"}, "properties": {"repobilityId": "01466644c9e621c4", "scanner": "scanner-primary", "fingerprint": "a7d0b5c4d7976bbf", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-cjq9-62q9-8jv4"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/docs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-de1f6e7e3d0d1da4", "level": "warning", "message": {"text": "Vulnerable dependency next 16.2.11: GHSA-f87g-xv8r-7p7x"}, "properties": {"repobilityId": "227d6414b589b818", "scanner": "scanner-primary", "fingerprint": "de1f6e7e3d0d1da4", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-f87g-xv8r-7p7x"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/docs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4145bf5e051924cb", "level": "warning", "message": {"text": "Vulnerable dependency next 16.2.11: GHSA-mcj8-r9mp-w47p"}, "properties": {"repobilityId": "13a639d0b27ff696", "scanner": "scanner-primary", "fingerprint": "4145bf5e051924cb", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-mcj8-r9mp-w47p"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/docs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f84f3e2f481445c8", "level": "warning", "message": {"text": "Vulnerable dependency next 16.2.11: GHSA-p293-qw3h-jr36"}, "properties": {"repobilityId": "dbd59c41ed4cde50", "scanner": "scanner-primary", "fingerprint": "f84f3e2f481445c8", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-p293-qw3h-jr36"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/docs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a857558437b3d553", "level": "warning", "message": {"text": "Vulnerable dependency next 16.2.11: GHSA-vcvr-r3jv-pc5j"}, "properties": {"repobilityId": "24e4d8e183374618", "scanner": "scanner-primary", "fingerprint": "a857558437b3d553", "layer": "dependencies", "severity": "medium", "confidence": 1.0, "tags": ["dependency", "sca", "osv", "GHSA-vcvr-r3jv-pc5j"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/docs/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4917e7c20564ceab", "level": "error", "message": {"text": "Vulnerable dependency vite 8.2.1: GHSA-587h-7wmj-h5pm"}, "properties": {"repobilityId": "1b8f45329786d196", "scanner": "scanner-primary", "fingerprint": "4917e7c20564ceab", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-587h-7wmj-h5pm", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/product-ui/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c316d1f0d4228300", "level": "warning", "message": {"text": "Vulnerable dependency vite 8.2.1: GHSA-698v-4r3x-3vcv"}, "properties": {"repobilityId": "3a4e4642ebe4c215", "scanner": "scanner-primary", "fingerprint": "c316d1f0d4228300", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-698v-4r3x-3vcv", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/product-ui/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fd29a0babd5d5bc0", "level": "note", "message": {"text": "Vulnerable dependency vite 8.2.1: GHSA-9jrq-w75r-8gcw"}, "properties": {"repobilityId": "e96702adca03ddc6", "scanner": "scanner-primary", "fingerprint": "fd29a0babd5d5bc0", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-9jrq-w75r-8gcw", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/product-ui/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-160beed3328fb274", "level": "warning", "message": {"text": "Vulnerable dependency vite 8.2.1: GHSA-r825-w8mm-5pxw"}, "properties": {"repobilityId": "992397176fdaa0d2", "scanner": "scanner-primary", "fingerprint": "160beed3328fb274", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-r825-w8mm-5pxw", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/product-ui/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d5d4a7510072137a", "level": "warning", "message": {"text": "Vulnerable dependency vite 8.2.1: GHSA-rq7h-c2jc-7f22"}, "properties": {"repobilityId": "c78030f5eaf63a0c", "scanner": "scanner-primary", "fingerprint": "d5d4a7510072137a", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rq7h-c2jc-7f22", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/product-ui/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-63de8127349310bb", "level": "warning", "message": {"text": "Vulnerable dependency vite 8.2.1: GHSA-vfpm-58rq-9qcg"}, "properties": {"repobilityId": "92faba07ff0a0017", "scanner": "scanner-primary", "fingerprint": "63de8127349310bb", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-vfpm-58rq-9qcg", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/product-ui/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-dc79c915c47aa77e", "level": "warning", "message": {"text": "Vulnerable dependency vitest 4.1.10: GHSA-82fw-gwwq-j7x9"}, "properties": {"repobilityId": "66f0479cb20f8442", "scanner": "scanner-primary", "fingerprint": "dc79c915c47aa77e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-82fw-gwwq-j7x9", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cloud-client/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a04a5f1b104cdae1", "level": "error", "message": {"text": "Vulnerable dependency vite 8.2.2: GHSA-587h-7wmj-h5pm"}, "properties": {"repobilityId": "d9c75f485a5732af", "scanner": "scanner-primary", "fingerprint": "a04a5f1b104cdae1", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-587h-7wmj-h5pm", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/mobile/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9e4edcc3b1b35187", "level": "warning", "message": {"text": "Vulnerable dependency vite 8.2.2: GHSA-698v-4r3x-3vcv"}, "properties": {"repobilityId": "4b23f5649e436730", "scanner": "scanner-primary", "fingerprint": "9e4edcc3b1b35187", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-698v-4r3x-3vcv", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/mobile/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f37a752d1714f684", "level": "note", "message": {"text": "Vulnerable dependency vite 8.2.2: GHSA-9jrq-w75r-8gcw"}, "properties": {"repobilityId": "b004388fb044b844", "scanner": "scanner-primary", "fingerprint": "f37a752d1714f684", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-9jrq-w75r-8gcw", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/mobile/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4228033814a8d2a2", "level": "warning", "message": {"text": "Vulnerable dependency vite 8.2.2: GHSA-r825-w8mm-5pxw"}, "properties": {"repobilityId": "64a86eaa1a6130f8", "scanner": "scanner-primary", "fingerprint": "4228033814a8d2a2", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-r825-w8mm-5pxw", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/mobile/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-68c9377ebaa09330", "level": "warning", "message": {"text": "Vulnerable dependency vite 8.2.2: GHSA-rq7h-c2jc-7f22"}, "properties": {"repobilityId": "791a81bac55073b5", "scanner": "scanner-primary", "fingerprint": "68c9377ebaa09330", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rq7h-c2jc-7f22", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/mobile/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a36d0725c0938f5c", "level": "warning", "message": {"text": "Vulnerable dependency vite 8.2.2: GHSA-vfpm-58rq-9qcg"}, "properties": {"repobilityId": "95aada6ee53fc941", "scanner": "scanner-primary", "fingerprint": "a36d0725c0938f5c", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-vfpm-58rq-9qcg", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/mobile/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-71e98deddbb5e021", "level": "warning", "message": {"text": "Vulnerable dependency fast-uri 3.1.6: GHSA-58mr-gqgx-xq4g"}, "properties": {"repobilityId": "4a0e9677d014e22e", "scanner": "scanner-primary", "fingerprint": "71e98deddbb5e021", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-58mr-gqgx-xq4g", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/acp-runtime/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9f00762fb5e84dc0", "level": "warning", "message": {"text": "Vulnerable dependency fast-uri 3.1.6: GHSA-hrr3-gc8f-f4qj"}, "properties": {"repobilityId": "e08224068d12664a", "scanner": "scanner-primary", "fingerprint": "9f00762fb5e84dc0", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-hrr3-gc8f-f4qj", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/acp-runtime/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c58c63739761c60b", "level": "warning", "message": {"text": "Vulnerable dependency fast-uri 3.1.6: GHSA-qw65-cvwx-89v3"}, "properties": {"repobilityId": "178d9e82109810db", "scanner": "scanner-primary", "fingerprint": "c58c63739761c60b", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-qw65-cvwx-89v3", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/acp-runtime/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-927e8ae7d918a3d7", "level": "warning", "message": {"text": "Vulnerable dependency ip-address 10.5.0: GHSA-2vr4-cq9g-pvrc"}, "properties": {"repobilityId": "5349f65d5f7468f6", "scanner": "scanner-primary", "fingerprint": "927e8ae7d918a3d7", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-2vr4-cq9g-pvrc", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/acp-runtime/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fb38d8bf25ab029c", "level": "warning", "message": {"text": "Vulnerable dependency ip-address 10.5.0: GHSA-h3mg-xc3c-68pw"}, "properties": {"repobilityId": "b0ab253c3c113006", "scanner": "scanner-primary", "fingerprint": "fb38d8bf25ab029c", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-h3mg-xc3c-68pw", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/acp-runtime/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-caedc7aaa2cff90d", "level": "warning", "message": {"text": "Vulnerable dependency ip-address 10.5.0: GHSA-j6r3-76f7-8jcv"}, "properties": {"repobilityId": "5c5009921d9aae5e", "scanner": "scanner-primary", "fingerprint": "caedc7aaa2cff90d", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-j6r3-76f7-8jcv", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/acp-runtime/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3677a4173cc02cbe", "level": "warning", "message": {"text": "Vulnerable dependency ip-address 10.5.0: GHSA-rpw4-54j3-4h4q"}, "properties": {"repobilityId": "b09697cf0854fcf9", "scanner": "scanner-primary", "fingerprint": "3677a4173cc02cbe", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rpw4-54j3-4h4q", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/acp-runtime/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-56d85870cf45a322", "level": "warning", "message": {"text": "Vulnerable dependency proxy-addr 2.0.7: GHSA-jqcg-44mw-7w3h"}, "properties": {"repobilityId": "58757858d8270c14", "scanner": "scanner-primary", "fingerprint": "56d85870cf45a322", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-jqcg-44mw-7w3h", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/acp-runtime/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4de4f2693cda9cff", "level": "warning", "message": {"text": "Vulnerable dependency qs 6.15.3: GHSA-4mjr-xmp4-gh2g"}, "properties": {"repobilityId": "3b782425a59b5a50", "scanner": "scanner-primary", "fingerprint": "4de4f2693cda9cff", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-4mjr-xmp4-gh2g", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/acp-runtime/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0fb04e715d1c7621", "level": "warning", "message": {"text": "Vulnerable dependency qs 6.15.3: GHSA-x5fp-wj9c-mxmx"}, "properties": {"repobilityId": "65273cf1e13ce159", "scanner": "scanner-primary", "fingerprint": "0fb04e715d1c7621", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-x5fp-wj9c-mxmx", "transitive"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/acp-runtime/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a6d0f7906830bd98", "level": "error", "message": {"text": "Vulnerable dependency tar 6.2.1: GHSA-23hp-3jrh-7fpw"}, "properties": {"repobilityId": "2b31f5b015f63b19", "scanner": "scanner-primary", "fingerprint": "a6d0f7906830bd98", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-23hp-3jrh-7fpw", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-18a336547e134f24", "level": "warning", "message": {"text": "Vulnerable dependency tar 6.2.1: GHSA-34x7-hfp2-rc4v"}, "properties": {"repobilityId": "6278a266c23d1504", "scanner": "scanner-primary", "fingerprint": "18a336547e134f24", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-34x7-hfp2-rc4v", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ace77adcf2f46b1f", "level": "warning", "message": {"text": "Vulnerable dependency tar 6.2.1: GHSA-83g3-92jg-28cx"}, "properties": {"repobilityId": "de5b704a7f8378d1", "scanner": "scanner-primary", "fingerprint": "ace77adcf2f46b1f", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-83g3-92jg-28cx", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2acb01ad2fb5175c", "level": "warning", "message": {"text": "Vulnerable dependency tar 6.2.1: GHSA-8qq5-rm4j-mr97"}, "properties": {"repobilityId": "f87ce42440b8ea48", "scanner": "scanner-primary", "fingerprint": "2acb01ad2fb5175c", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-8qq5-rm4j-mr97", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cad9d55f863c0622", "level": "warning", "message": {"text": "Vulnerable dependency tar 6.2.1: GHSA-8x88-c5mf-7j5w"}, "properties": {"repobilityId": "a97460913e322b17", "scanner": "scanner-primary", "fingerprint": "cad9d55f863c0622", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-8x88-c5mf-7j5w", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c0652d174da962da", "level": "warning", "message": {"text": "Vulnerable dependency tar 6.2.1: GHSA-9ppj-qmqm-q256"}, "properties": {"repobilityId": "ba7848efc0447c3d", "scanner": "scanner-primary", "fingerprint": "c0652d174da962da", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-9ppj-qmqm-q256", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-59f8d00e3c78a9f3", "level": "warning", "message": {"text": "Vulnerable dependency tar 6.2.1: GHSA-gvwx-54wh-qm9j"}, "properties": {"repobilityId": "af4ef3e7bc207515", "scanner": "scanner-primary", "fingerprint": "59f8d00e3c78a9f3", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-gvwx-54wh-qm9j", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a2b1f9b1ccaa2f9b", "level": "warning", "message": {"text": "Vulnerable dependency tar 6.2.1: GHSA-qffp-2rhf-9h96"}, "properties": {"repobilityId": "2cc0d011c816508c", "scanner": "scanner-primary", "fingerprint": "a2b1f9b1ccaa2f9b", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-qffp-2rhf-9h96", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b8318fc8febe2ae4", "level": "warning", "message": {"text": "Vulnerable dependency tar 6.2.1: GHSA-r292-9mhp-454m"}, "properties": {"repobilityId": "4f27b729ab5c153f", "scanner": "scanner-primary", "fingerprint": "b8318fc8febe2ae4", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-r292-9mhp-454m", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-77377b8c5d8fe93e", "level": "warning", "message": {"text": "Vulnerable dependency tar 6.2.1: GHSA-r6q2-hw4h-h46w"}, "properties": {"repobilityId": "9d2e042e0c9a08f0", "scanner": "scanner-primary", "fingerprint": "77377b8c5d8fe93e", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-r6q2-hw4h-h46w", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2a3cec1879a4e374", "level": "warning", "message": {"text": "Vulnerable dependency tar 6.2.1: GHSA-vmf3-w455-68vh"}, "properties": {"repobilityId": "120517fd80ea2fcd", "scanner": "scanner-primary", "fingerprint": "2a3cec1879a4e374", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-vmf3-w455-68vh", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6d60371c6f718dfc", "level": "warning", "message": {"text": "Vulnerable dependency tar 6.2.1: GHSA-w8wr-v893-vjvp"}, "properties": {"repobilityId": "7b9b54b883d7996a", "scanner": "scanner-primary", "fingerprint": "6d60371c6f718dfc", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-w8wr-v893-vjvp", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5452e01a31bf09c9", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 1.1.15: GHSA-3jxr-9vmj-r5cp"}, "properties": {"repobilityId": "004c409b50374135", "scanner": "scanner-primary", "fingerprint": "5452e01a31bf09c9", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3jxr-9vmj-r5cp", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9d7997b6f12ae840", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 1.1.15: GHSA-6j4f-fj2g-mc7p"}, "properties": {"repobilityId": "723bd178f6f0bb79", "scanner": "scanner-primary", "fingerprint": "9d7997b6f12ae840", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-6j4f-fj2g-mc7p", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-53788ae09cb4aafc", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 1.1.15: GHSA-mh99-v99m-4gvg"}, "properties": {"repobilityId": "8032c271226f95ff", "scanner": "scanner-primary", "fingerprint": "53788ae09cb4aafc", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-mh99-v99m-4gvg", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4dcc93db8ccc0e8b", "level": "warning", "message": {"text": "Vulnerable dependency brace-expansion 1.1.15: GHSA-q2hr-2g5m-vwhr"}, "properties": {"repobilityId": "91b0662050ed7db9", "scanner": "scanner-primary", "fingerprint": "4dcc93db8ccc0e8b", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-q2hr-2g5m-vwhr", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3b117644a3df6da6", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 1.1.15: GHSA-qhr7-859c-m2p7"}, "properties": {"repobilityId": "7a879bb3975be548", "scanner": "scanner-primary", "fingerprint": "3b117644a3df6da6", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-qhr7-859c-m2p7", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-18bb41d994b2bd69", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 1.1.15: GHSA-rgw5-rvv9-x895"}, "properties": {"repobilityId": "aa5ed735e419e17b", "scanner": "scanner-primary", "fingerprint": "18bb41d994b2bd69", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rgw5-rvv9-x895", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-87f15d3b75156184", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 2.1.1: GHSA-3jxr-9vmj-r5cp"}, "properties": {"repobilityId": "91dc449d0086dea5", "scanner": "scanner-primary", "fingerprint": "87f15d3b75156184", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-3jxr-9vmj-r5cp", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6a7a3b63d6527a88", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 2.1.1: GHSA-6j4f-fj2g-mc7p"}, "properties": {"repobilityId": "b62ca04d4e98db6d", "scanner": "scanner-primary", "fingerprint": "6a7a3b63d6527a88", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-6j4f-fj2g-mc7p", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-9774b68c979fc4f4", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 2.1.1: GHSA-mh99-v99m-4gvg"}, "properties": {"repobilityId": "5f1cd03f7e83ea55", "scanner": "scanner-primary", "fingerprint": "9774b68c979fc4f4", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-mh99-v99m-4gvg", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fbc6bff27f7c98f9", "level": "warning", "message": {"text": "Vulnerable dependency brace-expansion 2.1.1: GHSA-q2hr-2g5m-vwhr"}, "properties": {"repobilityId": "80ec0266fe786bdf", "scanner": "scanner-primary", "fingerprint": "fbc6bff27f7c98f9", "layer": "dependencies", "severity": "medium", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-q2hr-2g5m-vwhr", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e634214dc5a52edd", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 2.1.1: GHSA-qhr7-859c-m2p7"}, "properties": {"repobilityId": "ee02f2db85520813", "scanner": "scanner-primary", "fingerprint": "e634214dc5a52edd", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-qhr7-859c-m2p7", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1943f6da2f7496d4", "level": "error", "message": {"text": "Vulnerable dependency brace-expansion 2.1.1: GHSA-rgw5-rvv9-x895"}, "properties": {"repobilityId": "a9c4591fd7c08769", "scanner": "scanner-primary", "fingerprint": "1943f6da2f7496d4", "layer": "dependencies", "severity": "high", "confidence": 0.9, "tags": ["dependency", "sca", "osv", "GHSA-rgw5-rvv9-x895", "transitive", "dev-dependency"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package-lock.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-91de7b57ddc11545", "level": "note", "message": {"text": "Dependency @expo/ui is a major version behind"}, "properties": {"repobilityId": "743e401c259a6a0c", "scanner": "scanner-primary", "fingerprint": "91de7b57ddc11545", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/mobile/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-919d3862b3b276ec", "level": "note", "message": {"text": "Dependency @react-native-async-storage/async-storage is a major version behind"}, "properties": {"repobilityId": "e18a35a7ad8c7824", "scanner": "scanner-primary", "fingerprint": "919d3862b3b276ec", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/mobile/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-51e683bb9cf600bd", "level": "note", "message": {"text": "Dependency @sentry/electron is a major version behind"}, "properties": {"repobilityId": "d27cf0f239ab9f89", "scanner": "scanner-primary", "fingerprint": "51e683bb9cf600bd", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4c57c39d36095678", "level": "note", "message": {"text": "Dependency @workos-inc/node is a major version behind"}, "properties": {"repobilityId": "36028e64429867a2", "scanner": "scanner-primary", "fingerprint": "4c57c39d36095678", "layer": "dependencies", "severity": "low", "confidence": 0.9, "tags": ["dependency", "freshness", "outdated"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-421e035c996b6b3d", "level": "error", "message": {"text": "Dangling fetch: POST /api/cloud/v1/github/user/authorize (packages/cloud-client/src/client.ts:218)"}, "properties": {"repobilityId": "237b47977d5dfa2a", "scanner": "scanner-primary", "fingerprint": "421e035c996b6b3d", "layer": "api", "severity": "high", "confidence": 0.9, "tags": ["wiring", "dangling-fetch", "helper:request"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cloud-client/src/client.ts"}, "region": {"startLine": 218}}}]}, {"ruleId": "scanner-8fa0fe543a54437c", "level": "error", "message": {"text": "Dangling fetch: DELETE /api/cloud/v1/github/user (packages/cloud-client/src/client.ts:225)"}, "properties": {"repobilityId": "7870580749e7b05f", "scanner": "scanner-primary", "fingerprint": "8fa0fe543a54437c", "layer": "api", "severity": "high", "confidence": 0.9, "tags": ["wiring", "dangling-fetch", "helper:request"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cloud-client/src/client.ts"}, "region": {"startLine": 225}}}]}, {"ruleId": "scanner-1d85d193e118517f", "level": "error", "message": {"text": "Dangling fetch: POST /api/cloud/v1/worker/heartbeat (packages/cloud-client/src/client.ts:949)"}, "properties": {"repobilityId": "14f48373e7311613", "scanner": "scanner-primary", "fingerprint": "1d85d193e118517f", "layer": "api", "severity": "high", "confidence": 0.9, "tags": ["wiring", "dangling-fetch", "helper:request"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cloud-client/src/client.ts"}, "region": {"startLine": 949}}}]}, {"ruleId": "scanner-69f3552c884d9f46", "level": "error", "message": {"text": "Dangling fetch: POST /api/cloud/v1/worker/events (packages/cloud-client/src/client.ts:961)"}, "properties": {"repobilityId": "2196dd437dc6aa1f", "scanner": "scanner-primary", "fingerprint": "69f3552c884d9f46", "layer": "api", "severity": "high", "confidence": 0.9, "tags": ["wiring", "dangling-fetch", "helper:request"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cloud-client/src/client.ts"}, "region": {"startLine": 961}}}]}, {"ruleId": "scanner-acfacc417c90d659", "level": "error", "message": {"text": "Dangling fetch: POST /api/cloud/v1/worker/turns/claim (packages/cloud-client/src/client.ts:969)"}, "properties": {"repobilityId": "f1196d5fcf90bd47", "scanner": "scanner-primary", "fingerprint": "acfacc417c90d659", "layer": "api", "severity": "high", "confidence": 0.9, "tags": ["wiring", "dangling-fetch", "helper:request"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cloud-client/src/client.ts"}, "region": {"startLine": 969}}}]}, {"ruleId": "scanner-9a4c87a619f62d83", "level": "error", "message": {"text": "Dangling fetch: POST /api/cloud/v1/worker/turns/${encodeURIComponent(turnId)}/cancellation?${query.toString()} (packages/cloud-client/src/client.ts:982)"}, "properties": {"repobilityId": "d40fe8986deb652b", "scanner": "scanner-primary", "fingerprint": "9a4c87a619f62d83", "layer": "api", "severity": "high", "confidence": 0.9, "tags": ["wiring", "dangling-fetch", "helper:request"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cloud-client/src/client.ts"}, "region": {"startLine": 982}}}]}, {"ruleId": "scanner-2c95cc062027428f", "level": "error", "message": {"text": "Dangling fetch: GET /api/cloud/v1/worker/credential?reviewRunId=${encodeURIComponent(reviewRunId)} (packages/cloud-client/src/client.ts:1020)"}, "properties": {"repobilityId": "4fde399c049e5486", "scanner": "scanner-primary", "fingerprint": "2c95cc062027428f", "layer": "api", "severity": "high", "confidence": 0.9, "tags": ["wiring", "dangling-fetch", "helper:request"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cloud-client/src/client.ts"}, "region": {"startLine": 1020}}}]}, {"ruleId": "scanner-c6aaa4b0d9cf1074", "level": "error", "message": {"text": "Dangling fetch: POST /api/cloud/v1/worker/checkout-grant (packages/cloud-client/src/client.ts:1028)"}, "properties": {"repobilityId": "c51e6e4bbe8911ef", "scanner": "scanner-primary", "fingerprint": "c6aaa4b0d9cf1074", "layer": "api", "severity": "high", "confidence": 0.9, "tags": ["wiring", "dangling-fetch", "helper:request"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cloud-client/src/client.ts"}, "region": {"startLine": 1028}}}]}, {"ruleId": "scanner-e38c22ea162d334f", "level": "error", "message": {"text": "Dangling fetch: GET /api/cloud/v1/worker/children${suffix} (packages/cloud-client/src/client.ts:1042)"}, "properties": {"repobilityId": "5fcbeed45d3106d5", "scanner": "scanner-primary", "fingerprint": "e38c22ea162d334f", "layer": "api", "severity": "high", "confidence": 0.9, "tags": ["wiring", "dangling-fetch", "helper:request"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cloud-client/src/client.ts"}, "region": {"startLine": 1042}}}]}, {"ruleId": "scanner-5f0ece24a967d4cd", "level": "error", "message": {"text": "Dangling fetch: POST /api/cloud/v1/worker/children (packages/cloud-client/src/client.ts:1051)"}, "properties": {"repobilityId": "e33aa8c8ff8a1f45", "scanner": "scanner-primary", "fingerprint": "5f0ece24a967d4cd", "layer": "api", "severity": "high", "confidence": 0.9, "tags": ["wiring", "dangling-fetch", "helper:request"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cloud-client/src/client.ts"}, "region": {"startLine": 1051}}}]}, {"ruleId": "scanner-bbb227c824cf89c1", "level": "error", "message": {"text": "Dangling fetch: POST /api/cloud/v1/worker/children/${encodeURIComponent(sessionId)}/messages (packages/cloud-client/src/client.ts:1064)"}, "properties": {"repobilityId": "2e6e3d3db5927714", "scanner": "scanner-primary", "fingerprint": "bbb227c824cf89c1", "layer": "api", "severity": "high", "confidence": 0.9, "tags": ["wiring", "dangling-fetch", "helper:request"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cloud-client/src/client.ts"}, "region": {"startLine": 1064}}}]}, {"ruleId": "scanner-098eed23240f3675", "level": "error", "message": {"text": "Dangling fetch: POST /api/cloud/v1/worker/transport/${encodeURIComponent(requestId)}/complete (packages/cloud-client/src/client.ts:1103)"}, "properties": {"repobilityId": "77a0712cfd7d539b", "scanner": "scanner-primary", "fingerprint": "098eed23240f3675", "layer": "api", "severity": "high", "confidence": 0.9, "tags": ["wiring", "dangling-fetch", "helper:request"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cloud-client/src/client.ts"}, "region": {"startLine": 1103}}}]}, {"ruleId": "scanner-6cf80ff550f480c2", "level": "error", "message": {"text": "Dangling fetch: POST /api/cloud/v1/worker/terminals/${encodeURIComponent(terminalId)}/output (packages/cloud-client/src/client.ts:1135)"}, "properties": {"repobilityId": "c6d4666fad5dd3b2", "scanner": "scanner-primary", "fingerprint": "6cf80ff550f480c2", "layer": "api", "severity": "high", "confidence": 0.9, "tags": ["wiring", "dangling-fetch", "helper:request"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/cloud-client/src/client.ts"}, "region": {"startLine": 1135}}}]}, {"ruleId": "scanner-57442f17e477d110", "level": "note", "message": {"text": "1 backend endpoint not called by scanned frontend"}, "properties": {"repobilityId": "3c8e96670c5e1f9f", "scanner": "scanner-primary", "fingerprint": "57442f17e477d110", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}