{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"codehealth","informationUri":"https://codehealth.canine.dev","rules":[{"id":"D4","name":"Code Duplication","shortDescription":{"text":"Code Duplication"},"helpUri":"https://codehealth.canine.dev/dimensions/D4"},{"id":"D12","name":"Dependency Hygiene","shortDescription":{"text":"Dependency Hygiene"},"helpUri":"https://codehealth.canine.dev/dimensions/D12"},{"id":"D13","name":"Secret Scanning","shortDescription":{"text":"Secret Scanning"},"helpUri":"https://codehealth.canine.dev/dimensions/D13","relationships":[{"target":{"id":"CWE-798","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-259","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]}],"properties":{"cwe":["CWE-798","CWE-259"]}},{"id":"D14","name":"License Compliance","shortDescription":{"text":"License Compliance"},"helpUri":"https://codehealth.canine.dev/dimensions/D14"},{"id":"D16","name":"Bus Factor","shortDescription":{"text":"Bus Factor"},"helpUri":"https://codehealth.canine.dev/dimensions/D16"},{"id":"D17","name":"Explicit Debt","shortDescription":{"text":"Explicit Debt"},"helpUri":"https://codehealth.canine.dev/dimensions/D17"},{"id":"D19","name":"Documentation Quality","shortDescription":{"text":"Documentation Quality"},"helpUri":"https://codehealth.canine.dev/dimensions/D19"},{"id":"D20","name":"ADR Quality","shortDescription":{"text":"ADR Quality"},"helpUri":"https://codehealth.canine.dev/dimensions/D20"},{"id":"D21","name":"Naming Consistency","shortDescription":{"text":"Naming Consistency"},"helpUri":"https://codehealth.canine.dev/dimensions/D21"},{"id":"D26","name":"Project Cohesion","shortDescription":{"text":"Project Cohesion"},"helpUri":"https://codehealth.canine.dev/dimensions/D26"},{"id":"D28","name":"Secrets (history)","shortDescription":{"text":"Secrets (history)"},"helpUri":"https://codehealth.canine.dev/dimensions/D28","relationships":[{"target":{"id":"CWE-798","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-259","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]}],"properties":{"cwe":["CWE-798","CWE-259"]}},{"id":"D29","name":"Static Analysis (SAST)","shortDescription":{"text":"Static Analysis (SAST)"},"helpUri":"https://codehealth.canine.dev/dimensions/D29","relationships":[{"target":{"id":"CWE-79","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-89","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-78","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-94","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-77","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]}],"properties":{"cwe":["CWE-79","CWE-89","CWE-78","CWE-94","CWE-77"]}},{"id":"D30","name":"Dependency Vulnerabilities","shortDescription":{"text":"Dependency Vulnerabilities"},"helpUri":"https://codehealth.canine.dev/dimensions/D30","relationships":[{"target":{"id":"CWE-1395","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-937","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]}],"properties":{"cwe":["CWE-1395","CWE-937"]}},{"id":"D34","name":"Knowledge Freshness","shortDescription":{"text":"Knowledge Freshness"},"helpUri":"https://codehealth.canine.dev/dimensions/D34"},{"id":"D35","name":"Change Coupling","shortDescription":{"text":"Change Coupling"},"helpUri":"https://codehealth.canine.dev/dimensions/D35"},{"id":"D36","name":"Supply-chain Provenance \u0026 Signing","shortDescription":{"text":"Supply-chain Provenance \u0026 Signing"},"helpUri":"https://codehealth.canine.dev/dimensions/D36","relationships":[{"target":{"id":"CWE-1357","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-494","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]}],"properties":{"cwe":["CWE-1357","CWE-494"]}},{"id":"D43","name":"Malicious Dependencies","shortDescription":{"text":"Malicious Dependencies"},"helpUri":"https://codehealth.canine.dev/dimensions/D43","relationships":[{"target":{"id":"CWE-506","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]}],"properties":{"cwe":["CWE-506"]}},{"id":"D44","name":"Platform End-of-Life","shortDescription":{"text":"Platform End-of-Life"},"helpUri":"https://codehealth.canine.dev/dimensions/D44"},{"id":"AC1","name":"Text alternatives","shortDescription":{"text":"Text alternatives"},"helpUri":"https://codehealth.canine.dev/dimensions/AC1"},{"id":"AC2","name":"Forms \u0026 labels","shortDescription":{"text":"Forms \u0026 labels"},"helpUri":"https://codehealth.canine.dev/dimensions/AC2"},{"id":"AC3","name":"Page structure","shortDescription":{"text":"Page structure"},"helpUri":"https://codehealth.canine.dev/dimensions/AC3"},{"id":"AC5","name":"ARIA correctness","shortDescription":{"text":"ARIA correctness"},"helpUri":"https://codehealth.canine.dev/dimensions/AC5"},{"id":"AC6","name":"Visual \u0026 motion safety","shortDescription":{"text":"Visual \u0026 motion safety"},"helpUri":"https://codehealth.canine.dev/dimensions/AC6"},{"id":"AC7","name":"A11y enforcement","shortDescription":{"text":"A11y enforcement"},"helpUri":"https://codehealth.canine.dev/dimensions/AC7"},{"id":"AX10","name":"Code composition","shortDescription":{"text":"Code composition"},"helpUri":"https://codehealth.canine.dev/dimensions/AX10"},{"id":"AXB2","name":"Runtime readiness","shortDescription":{"text":"Runtime readiness"},"helpUri":"https://codehealth.canine.dev/dimensions/AXB2"},{"id":"DM6","name":"Domain \u2194 infrastructure boundary","shortDescription":{"text":"Domain \u2194 infrastructure boundary"},"helpUri":"https://codehealth.canine.dev/dimensions/DM6"},{"id":"M1","name":"Documentation (README)","shortDescription":{"text":"Documentation (README)"},"helpUri":"https://codehealth.canine.dev/dimensions/M1"},{"id":"M2","name":"Architecture documentation","shortDescription":{"text":"Architecture documentation"},"helpUri":"https://codehealth.canine.dev/dimensions/M2"},{"id":"M3","name":"Folder \u0026 project structure","shortDescription":{"text":"Folder \u0026 project structure"},"helpUri":"https://codehealth.canine.dev/dimensions/M3"},{"id":"M4","name":"Documentation accuracy","shortDescription":{"text":"Documentation accuracy"},"helpUri":"https://codehealth.canine.dev/dimensions/M4"},{"id":"P1","name":"CI/CD gates","shortDescription":{"text":"CI/CD gates"},"helpUri":"https://codehealth.canine.dev/dimensions/P1"},{"id":"P12","name":"CI test-gate honesty","shortDescription":{"text":"CI test-gate honesty"},"helpUri":"https://codehealth.canine.dev/dimensions/P12"},{"id":"P2","name":"Observability","shortDescription":{"text":"Observability"},"helpUri":"https://codehealth.canine.dev/dimensions/P2"},{"id":"P3","name":"Security \u0026 performance tooling","shortDescription":{"text":"Security \u0026 performance tooling"},"helpUri":"https://codehealth.canine.dev/dimensions/P3"},{"id":"P4","name":"Deployment \u0026 Rollback","shortDescription":{"text":"Deployment \u0026 Rollback"},"helpUri":"https://codehealth.canine.dev/dimensions/P4"},{"id":"P8","name":"Schema migrations","shortDescription":{"text":"Schema migrations"},"helpUri":"https://codehealth.canine.dev/dimensions/P8"},{"id":"PF3","name":"Async \u0026 latency hygiene","shortDescription":{"text":"Async \u0026 latency hygiene"},"helpUri":"https://codehealth.canine.dev/dimensions/PF3"},{"id":"R1","name":"Type Safety","shortDescription":{"text":"Type Safety"},"helpUri":"https://codehealth.canine.dev/dimensions/R1"},{"id":"R10","name":"Code Duplication","shortDescription":{"text":"Code Duplication"},"helpUri":"https://codehealth.canine.dev/dimensions/R10"},{"id":"R2","name":"Cyclomatic Complexity","shortDescription":{"text":"Cyclomatic Complexity"},"helpUri":"https://codehealth.canine.dev/dimensions/R2"},{"id":"R3","name":"Large Files","shortDescription":{"text":"Large Files"},"helpUri":"https://codehealth.canine.dev/dimensions/R3"},{"id":"R6","name":"Tooling","shortDescription":{"text":"Tooling"},"helpUri":"https://codehealth.canine.dev/dimensions/R6"},{"id":"R7","name":"Dead Code","shortDescription":{"text":"Dead Code"},"helpUri":"https://codehealth.canine.dev/dimensions/R7"},{"id":"R8","name":"Dependency Hygiene","shortDescription":{"text":"Dependency Hygiene"},"helpUri":"https://codehealth.canine.dev/dimensions/R8"},{"id":"R9","name":"Circular Imports","shortDescription":{"text":"Circular Imports"},"helpUri":"https://codehealth.canine.dev/dimensions/R9"},{"id":"S1","name":"Web-Security Posture","shortDescription":{"text":"Web-Security Posture"},"helpUri":"https://codehealth.canine.dev/dimensions/S1"},{"id":"SC1","name":"Supply-chain hygiene","shortDescription":{"text":"Supply-chain hygiene"},"helpUri":"https://codehealth.canine.dev/dimensions/SC1"},{"id":"X9","name":"Subsumed condition operand","shortDescription":{"text":"Subsumed condition operand"},"helpUri":"https://codehealth.canine.dev/dimensions/X9"}]}},"results":[{"ruleId":"D4","level":"warning","message":{"text":"Duplicated block (5 lines \u00D7 2): app/controllers/admin/reports/lesson_completions_controller.rb:22-26 | app/controllers/admin/reports/users_controller.rb:22-26 \u2014 the copies sit in sibling files of one directory, so a shared home is within easy reach: extract the block into a single shared function the call sites can all reach \u2014 a file they already depend on, or a new one alongside them \u2014 and call it from both call sites, so a change lands once."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/controllers/admin/reports/lesson_completions_controller.rb"},"region":{"startLine":22}}}],"partialFingerprints":{"codehealthFindingId/v1":"70a23413dfb55fc62c9951ea6676d25d9d72547cd114c3f3c00d2d2af66e8274"}},{"ruleId":"D4","level":"warning","message":{"text":"Duplicated block (5 lines \u00D7 3): app/controllers/admin/reports/lesson_completions_controller.rb:14-18 | app/controllers/admin/reports/paths_controller.rb:17-21 | app/controllers/admin/reports/users_controller.rb:14-18 \u2014 the copies sit in sibling files of one directory, so a shared home is within easy reach: extract the block into a single shared function the call sites can all reach \u2014 a file they already depend on, or a new one alongside them \u2014 and call it from all 3 call sites, so a change lands once."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/controllers/admin/reports/lesson_completions_controller.rb"},"region":{"startLine":14}}}],"partialFingerprints":{"codehealthFindingId/v1":"3adfcb8bc6c251328119945d727f53c036643bc255ee933162835040fbbf23c9"}},{"ruleId":"D13","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"6b0e3b7cf6d2a893afb418fab91068ad4a793be60dd5fd7d948b2825c36a3986"},"taxa":[{"id":"CWE-259","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-798","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D13","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"2714d57dadbf25c0bd2d98520ff3e2e7e25fb24d55e434737f2028f81fbe9065"},"taxa":[{"id":"CWE-259","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-798","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D14","level":"error","message":{"text":"Banned license: sidekiq: \u0060sidekiq\u0060 8.1.6 is published on rubygems.org under LGPL-3.0, which this policy bans, and it is in the RUNTIME closure of this repository\u0027s Bundler manifests \u2014 so it is installed by everything that installs this repository, not just by its test harness. Replace it, or record an accepted exception."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"f2ccf793e5d862f5ff908d78be7562fe47f34e2447b819062896349d638d0a11"}},{"ruleId":"D16","level":"note","message":{"text":"Off-boarding risk: anonymized user #1: If anonymized user #1 becomes unavailable, 1 significant file(s) lose their only recent owner: db/seeds/success_stories.rb. Pair on, review, or document these before any departure."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"5b01cc4687e183f1e0b4220a31b00801814626ec056095d4d3a1b20ab226eec5"}},{"ruleId":"D17","level":"warning","message":{"text":"TodoComment: # TODO: Consider setting this to auto \u2014 source code is not a task system: move the work to your tracker and leave a reference instead (e.g. \u0060# REF: #123\u0060), so the task is planned where tasks live and the ticket links back to the code."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"config/puma.rb"},"region":{"startLine":44}}}],"partialFingerprints":{"codehealthFindingId/v1":"a14ad0f1fb0f3ff3f04926eb2ec1c1247cd3f93f203123aa9960361bf988c35c"}},{"ruleId":"D17","level":"warning","message":{"text":"TodoComment: # TODO: This is resolved on the Heroku side now, should be a performance boost to \u2014 source code is not a task system: move the work to your tracker and leave a reference instead (e.g. \u0060# REF: #123\u0060), so the task is planned where tasks live and the ticket links back to the code."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"config/puma.rb"},"region":{"startLine":47}}}],"partialFingerprints":{"codehealthFindingId/v1":"331e57efe346486900cae2686f56a593648e71b9ba1fb1aca79399f03c088348"}},{"ruleId":"D17","level":"warning","message":{"text":"TodoComment: # TODO: Consider adding bin/setup \u2014 source code is not a task system: move the work to your tracker and leave a reference instead (e.g. \u0060# REF: #123\u0060), so the task is planned where tasks live and the ticket links back to the code."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"config/ci.rb"},"region":{"startLine":4}}}],"partialFingerprints":{"codehealthFindingId/v1":"d84b0a72db97caa25f1116eab06c9230f03eebfa14cf3c86fabe14c7a749490a"}},{"ruleId":"D19","level":"note","message":{"text":"Documentation: no installation or build instructions: The README does not state how to install or build the repository locally. Add installation and build commands, such as cloning the repo and running \u0060npm install \u0026\u0026 npm run dev\u0060."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"1fa6bfcd5c6ae231d1b8ee99bced50b832d1f61cde9da6cbb533467b879a57db"}},{"ruleId":"D19","level":"note","message":{"text":"Documentation: no usage examples: There are no usage examples showing how to run the TOP app or access its features. Add a short example of starting the app and navigating through lessons."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"1355eb4e127a4bc9236772ce1c46f09510aa9286e7a06d1e47f308229df19049"}},{"ruleId":"D19","level":"note","message":{"text":"Documentation: no contributor guidance: The README links to CONTRIBUTING.md but does not explain what PRs or issues are accepted for this repo. Briefly describe acceptable pull request types (e.g. bug fixes, docs) and how to open one."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.md"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"620f29787918fa3406ae55cb63eefa1b50410845435c4e47bda852816aaea084"}},{"ruleId":"D20","level":"note","message":{"text":"No ADRs found: No ADRs found. No recognised ADR directory (\u0060docs/adr/\u0060, \u0060docs/decisions/\u0060, \u0060adr/\u0060, \u0060docs/rfcs/\u0060, an \u0060ADR0001/\u0060 folder, or their siblings) exists anywhere in this tree. What was searched, so you can tell an empty log from a search that missed one: every directory under the tree (build output, dependencies and VCS metadata excepted), for a document that is either any non-index page inside a recognised ADR directory, whatever its name and however deeply nested (\u0060docs/adr/use-postgres.md\u0060, \u0060docs/adr/2024/0001-x.md\u0060); or a file anywhere whose name is ADR-shaped (\u00600001-use-postgres.md\u0060, \u0060adr-012-caching.md\u0060); or, when neither turned anything up, a document carrying the decision-record signature (an \u0022Architecture Decision Record\u0022 heading, or Status / Context / Decision / Consequences as section headings). A decision log that clears none of these \u2014 unnumbered files outside any recognised directory, without those headings \u2014 is not seen by this check and this row is then wrong. If that is your case, say so rather than renaming anything; otherwise, consider recording architectural decisions in \u0060docs/adr/\u0060."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"d2bea044ff79d7d275f5a91a6e2f548586178eaf480274c33960ad020c854631"}},{"ruleId":"D26","level":"note","message":{"text":"Projects may be oversized for their cohesion: 1 of 1 project(s) overshoot their size bounds, lowering Project Cohesion to 0.0/10. The most over is \u0060(repository root)\u0060 (8994 LoC, 337 public types across 67 directories). Review these for cohesion \u2014 draw the boundary inside the module first (group each responsibility into its own package or directory and keep the cross-boundary members non-public), since splitting a published package moves types between packages and breaks consumers."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"d5a94650dc74886a0f1f08eb9fb6775f1fc395279ef7e901c970c9d26f767a72"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"af1c769299fd7b9be97559049ad0a3feed679506dd17bc4e509477a69c8b71c4"},"properties":{"commitSha":"89b939681c90fa53970d9f76564369f7bc5d7c29"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"8ff7876218b4e56f0d48417650f75bb922e3b2750001d2731530fe90cc05dd56"},"properties":{"commitSha":"8d7900cbbb72fe64e60baf5cc8d079ad8200f139"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"4faf9cfd0ec88512176ff810a5e6e5a41d864de90dbe5578cc5ee40344a22cca"},"properties":{"commitSha":"07a4d00de1cb5db425a17390a46f15bdd929c2d8"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"a4ef0ca594d7d0c63ec8f2a21fc32c3724915ea8c141890daa33538afe99fc79"},"properties":{"commitSha":"92187c2ceda4b6cc971f10232715d88907f563c4"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"b760c9fa235decf2d84cc47a93afa522289caa6825d7359b12f495767ba50ed5"},"properties":{"commitSha":"00e1126d01aa0ac3429a9257180eb5436e46e406"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"7ad575845785079cedb8d6e0007c75db5b68dca395197c540a65c089a9216c87"},"properties":{"commitSha":"a4dab9d38125ccd00b5f2fbc8ef43817ccb6f9de"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"ad9a86456309aed7d059570551911046da166ef9fb070afbb9498f6e2a3602af"},"properties":{"commitSha":"b3969176df5f33fa3c9bbdca4df07f73f4bbfdeb"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"c10d68562d933cd4ce840290d575304552c8bdfc699add6984ba885e8feef3d7"},"properties":{"commitSha":"8c6c9a25005a68d23809bfd50478d69611606c46"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"f7d6b0317701e3004ff05c17bd9da78f5e66c483c5c7b8d1c761f6464858e036"},"properties":{"commitSha":"b60f1b80b043bf416c3b069966ea50682d1e0764"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"6e13b30567764c900a4000e9929d5dc2302597fb269389eb1f3ab793b7ae46af"},"properties":{"commitSha":"b60f1b80b043bf416c3b069966ea50682d1e0764"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"c8324a8a31516862dd947d2b86652868567e08aba90b22ab871602b6402440d7"},"properties":{"commitSha":"261b6000d2e5dac150ca551dfdee082eb1fb9f04"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"cfe6f3487776946720cea6c224135f51b66f2d5ddb8ee60d99dea8107762ee49"},"properties":{"commitSha":"b3969176df5f33fa3c9bbdca4df07f73f4bbfdeb"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"98b4fb7e00e03d561d8f7cfc1dc7eaa08bc884bd9154632dd0786e8999fe6f1e"},"properties":{"commitSha":"13575779a8be35b45fef4beadf382de68069b2a3"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"f7df32717fa473d4ee7fa5b28eeda48b9a94b988d19a56f3a16a5d1d9c91397d"},"properties":{"commitSha":"702b95752a60d984f7fc0d5f636cbd869d89c421"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"0bb3da0b24f2358b65f173dc1670bc9603c27b1cd2c261c2437fe432c629a147"},"properties":{"commitSha":"702b95752a60d984f7fc0d5f636cbd869d89c421"}},{"ruleId":"D28","level":"note","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"3cdfd7beb31b791ae18dcb425e21eb157c842e7bbcd522cc330573c1a6538db1"}},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"d5b8f11381d61a58459ffc7c595fd52d09c03c711894a63a9578043d2338412b"},"taxa":[{"id":"CWE-829","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"703b990f6d9a60db46de372b4bc3713bc769740b61be7dfed2b23b523664ac12"},"taxa":[{"id":"CWE-1357","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-353","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"e6672404dcfa6df521e34e5e53b08d92bd9f31e3221d37e96dc6fb4a0529e6cb"},"taxa":[{"id":"CWE-1357","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-353","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"de24fb5b2f9808dee7349e0f8b4bf4e8fc0b77a05b8578184e5f23b813b48863"},"taxa":[{"id":"CWE-1357","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-353","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"bc26593caf509b487cb3dff9d1a587737a02c72fc5e13e59c1a151f7d6412ad4"},"taxa":[{"id":"CWE-1357","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-353","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"6aa6b458c318eb70ddaac128ebb35b65c2726847f587a1d02868fe26107ca663"},"taxa":[{"id":"CWE-1357","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-353","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"4ffcc1b724469248fcd864b1901b4fb0cedf5b911fb5d6075b57cf61232c29e8"},"taxa":[{"id":"CWE-1357","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-353","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"3fd648356a6ed355cb3b0546e0586a58b49d256bb01552217ec9b7e088c33177"},"taxa":[{"id":"CWE-1357","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-353","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"555c1334bd06107419c3334a589b5082e9cb5e2aaf33df8b30739ffec48aa488"},"taxa":[{"id":"CWE-522","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-829","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"0e51bdcc59a9ca8a313ce1c1e13045b12423fdd96678226f4409de6cf23c832e"},"taxa":[{"id":"CWE-522","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-829","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"f8dc2db2055707bd4dbde4c53269a65ebfeb0241b0d9b8241ef830b782061818"},"taxa":[{"id":"CWE-522","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-829","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"fb49153ecec4b80e15afad5264cdc5e3d29beee51341eedc6f5abe8a602f422d"},"taxa":[{"id":"CWE-1357","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-353","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"f8356142ba9ab53b89e131162014fd116c480243fc679dc79fcef23ccacbf4f9"},"taxa":[{"id":"CWE-522","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-829","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"a7ce92dabd3fccbabf5a28d721146fcc8328c91c55694455cc868e55973e575b"},"taxa":[{"id":"CWE-1357","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-353","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"589f805dde27144b546e732d23771b7a6a5f180215b0ae7f9a7a3fb11a2f9fa1"},"taxa":[{"id":"CWE-522","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-829","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"a874d8e748aef090924c3a021999abf9e86f6b32bb14dfa2a1d56e9ddd8529e8"},"taxa":[{"id":"CWE-522","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-829","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"37ac4e647a7f0db67792b2b6ccfe9c95da5619b566b7ae0306a3b0618f0b4b28"},"taxa":[{"id":"CWE-1357","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-353","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"9aecb2c839a35dbdbbe446fd1ac19237e145e50732c876fe9a09a59291015f8f"},"taxa":[{"id":"CWE-522","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-829","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"0e37d8c3080d3f8e690d19a540a352f863a9d0d11f51431a4df4b2e0a9df4df9"},"taxa":[{"id":"CWE-829","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"4236086d140b19ed1ac08fa82d925663c0ad7f782add1117b0de77b827ac7951"},"taxa":[{"id":"CWE-639","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"cab785a12fa62d07f8e91656cf264e13a82fd80ca648b847411db3b0647c10c7"},"taxa":[{"id":"CWE-639","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"eebed77774a16d8ffedfebfa38a01f90feb5534df84af337f6a83012720c22dd"},"taxa":[{"id":"CWE-639","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"70cade2800c7c0b4d098b58e846656f32d319b2ada2245f7b13a9e04744e0b6d"},"taxa":[{"id":"CWE-639","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"e7408b9c4bf55eaf750735a0619cc2ada7945e43543b00d91305e14350348ab9"},"taxa":[{"id":"CWE-639","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"c42e79f930a9485c7bdb865c7b44c6ae2921da330460ed79621b233c79d56209"},"taxa":[{"id":"CWE-639","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"5fb326d1f4c8482649861e1624d164c0b914eb0f7fe67ce5ff724b2caf32e733"},"taxa":[{"id":"CWE-639","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"7123032b118f9aa00fe14d95e1eda57c71d0da4b04dba323cee0e7a7c2cfc3ec"},"taxa":[{"id":"CWE-639","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"10d47783f3f62254569a37e4c02e13920ce8a83b95502411ba51c8c76742da9b"},"taxa":[{"id":"CWE-639","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"6abb4b820aa7a7553d6ebd2c5991d280a519484dcda1796c35f3db68eb5f11fb"},"taxa":[{"id":"CWE-639","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"9018bdbff6e7ad4196d1cc3369d217a6525369e37e5e8b9214877773f1a6c67e"},"taxa":[{"id":"CWE-639","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"b4deb95bef62c8eb44cab3c21ba78483f6e6722894e52144a1f8c54dba35298c"},"taxa":[{"id":"CWE-639","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"d3a048bbba7bba64e49be846b2a2db3b232a749644bc9626516f0aac8e2a7c7f"},"taxa":[{"id":"CWE-639","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"caacaf55a83ee0962ef9e6a79386d67816d83db4e66970b4610fa18f380625ec"},"taxa":[{"id":"CWE-639","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"ec1ab63f4a2c5ce872da880d764b8635347f3c707f23e0bcdd8b19a190f52bd2"},"taxa":[{"id":"CWE-639","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"1606d412cd09fece1c375229c098e4cba0b8344057323266d966758b08eccec0"},"taxa":[{"id":"CWE-639","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"766b701e505004ad759d9aafb9642c4d4657d5c07b2581cc611a7a39281ac8ea"},"taxa":[{"id":"CWE-639","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"76e132ca26ab5e6d282ebb91a093ca83ca2ad6603a9e7b99e4dafcffb6717213"},"taxa":[{"id":"CWE-639","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"08f8aea6f5119d9d121914da4bd6dc70f7095c8b6380d6ace459320593d830e9"},"taxa":[{"id":"CWE-639","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"c30568a56a2c8bc4e09547ad010fc185427a40b2e975e619c1528980b943c3a9"},"taxa":[{"id":"CWE-639","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"5459fd76d4f2dfa4479cd0e942aec496616845aa837f6a393c2b3fcaa4211f0b"},"taxa":[{"id":"CWE-639","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"0c490b0dc9acf53eb7bd94dfecab07e034deb535fbbcdcd47f21f4ba990e98e6"},"taxa":[{"id":"CWE-639","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"6093fe2020a8d04893e88144f865c9a2e1d17b2de3351e507f442e95436f551d"},"taxa":[{"id":"CWE-639","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"524ed0c51ed7b85cdc8f57a6ba9848be8885c9afb33ef3d71b6aaaf1b8f7f8b1"},"taxa":[{"id":"CWE-639","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"e77d6795f03201fabdb087dfb152b141de6dd091b3e205055e4dbe712256d451"},"taxa":[{"id":"CWE-639","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"71c75349b441c905dcb909f99dd37583fde6d229aa162cf4f9010772944e1797"},"taxa":[{"id":"CWE-639","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"0de402b197e5c0e8d8ee970832b451a175ce15f61c03c0d8afc063dd19e20841"},"taxa":[{"id":"CWE-639","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"bb3d398f1a59447d5904417520befa9a5f70ce2f37238f2323047e9b980a5e17"},"taxa":[{"id":"CWE-94","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"7c8202200f4eea84103c5159406a380924eedefd2b732b28466084ef86e5bd93"},"taxa":[{"id":"CWE-79","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"95740b583969c78c7132f35629806263a32606dcd6d14eefa8ad5abaeaae0af3"},"taxa":[{"id":"CWE-1104","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-1352","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"e0a6a76e357f79280fe1ed2631220f5ab2288335a7c53507bfa9e530ecbece13"},"taxa":[{"id":"CWE-1104","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-1352","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"c84736a2391a9b183c5dd652bc6627c4f370a844b816aa8b7b7c09589057bf87"},"taxa":[{"id":"CWE-601","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"c441a8c1d3688b3822efa2a93594b12e53b932a246ef6558092480bdecad7ec3"},"taxa":[{"id":"CWE-601","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"088404f385f15d8c70a47f2b8aeae8c472b64b96c1865d58c801694a783df666"},"taxa":[{"id":"CWE-601","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"05ab9e7d976f53b5d2a7eedd9ffd829337cb812c32df40b0013b1ee1934efe35"},"taxa":[{"id":"CWE-601","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"670f0459656bcec21b95a3c19a10f840539a739cd24705b65a8b9469f52b1f9d"},"taxa":[{"id":"CWE-601","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"ba422312df12671f9a7c3086a9d32fc0ffe1b2aec0ab3fb5f2c9663b7fdcaf61"},"taxa":[{"id":"CWE-295","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D29","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"6187db2ebc8f010f70bdbdaaa22761212f9b051c0f4c885751f2dc10d57dc402"},"taxa":[{"id":"CWE-295","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D30","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"83c4e672988cf61dd0a5ca8608ad3eee293ea388ec09b355ce03ae0ecbdd1507"},"properties":{"dependency":{"package":"activestorage","version":"8.1.3","advisory":"[GHSA redacted]","aliases":["[CVE redacted]"],"reachability":{"kind":"unknown"}}}},{"ruleId":"D30","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"1c9a61626e0d439eacda938bf7340276efbf3bfe3de024eb2bd43a16ebca4a59"},"properties":{"dependency":{"package":"tar","version":"6.2.1","advisory":"[GHSA redacted]","aliases":["[CVE redacted]","[CVE redacted]","[CVE redacted]","[CVE redacted]","[CVE redacted]","[CVE redacted]","[CVE redacted]","[CVE redacted]","[CVE redacted]","[CVE redacted]","[CVE redacted]","[CVE redacted]","[GHSA redacted]","[GHSA redacted]","[GHSA redacted]","[GHSA redacted]","[GHSA redacted]","[GHSA redacted]","[GHSA redacted]","[GHSA redacted]","[GHSA redacted]","[GHSA redacted]","[GHSA redacted]"],"reachability":{"kind":"not-imported"}}}},{"ruleId":"D30","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"340e8b8f0fee29d6d6cb45ccd0437e64701d655771d019c853915389e8336f74"},"properties":{"dependency":{"package":"minimatch","version":"9.0.5","advisory":"[GHSA redacted]","aliases":["[CVE redacted]","[CVE redacted]","[CVE redacted]","[GHSA redacted]","[GHSA redacted]"],"reachability":{"kind":"not-imported"}}}},{"ruleId":"D30","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"a391ce9cef75c0f5f2c3882c11153b0d2a515cd367720a185f3b6ef37e80c373"},"properties":{"dependency":{"package":"brace-expansion","version":"2.0.1","advisory":"[GHSA redacted]","aliases":["[CVE redacted]","[CVE redacted]","[CVE redacted]","[CVE redacted]","[CVE redacted]","[GHSA redacted]","[GHSA redacted]","[GHSA redacted]","[GHSA redacted]"],"reachability":{"kind":"not-imported"}}}},{"ruleId":"D30","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"c97bb13ddb170ed7dee8ab094ac5ae6e024ba62caf70d0e058dc63543f187f8d"},"properties":{"dependency":{"package":"brace-expansion","version":"5.0.6","advisory":"[GHSA redacted]","aliases":["[CVE redacted]","[CVE redacted]","[CVE redacted]","[GHSA redacted]","[GHSA redacted]"],"reachability":{"kind":"not-imported"}}}},{"ruleId":"D30","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"f959547bc7b6416191ab179cafc949f624fdd43260819ba97651a8d30b116c7a"},"properties":{"dependency":{"package":"glob","version":"10.4.5","advisory":"[GHSA redacted]","aliases":["[CVE redacted]"],"reachability":{"kind":"not-imported"}}}},{"ruleId":"D30","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"d3322cfa69f32b8fe1e33a0f5f0f552005af75b9130c549b9d4efb8f23387821"},"properties":{"dependency":{"package":"ip-address","version":"9.0.5","advisory":"[GHSA redacted]","aliases":["[CVE redacted]","[CVE redacted]","[GHSA redacted]"],"reachability":{"kind":"not-imported"}}}},{"ruleId":"D30","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"8ef33557430c0008e8fa29fa05b9f724a788f90c2ea64127655150f7863ba7f9"},"properties":{"dependency":{"package":"lodash-es","version":"4.17.23","advisory":"[GHSA redacted]","aliases":["[CVE redacted]","[CVE redacted]","[CVE redacted]","[CVE redacted]","[GHSA redacted]","[GHSA redacted]","[GHSA redacted]"],"reachability":{"kind":"not-imported"}}}},{"ruleId":"D30","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"1efa621b4c88062290ccee195a73f745d2265617defef9bf57fa373a34cb1aec"},"properties":{"dependency":{"package":"ajv","version":"6.12.6","advisory":"[GHSA redacted]","aliases":["[CVE redacted]"],"reachability":{"kind":"not-imported"}}}},{"ruleId":"D30","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"54ec9f428f2f74347fd5005b2f1c5eacfa544229f990118e571e66931feb9863"},"properties":{"dependency":{"package":"ajv","version":"8.17.1","advisory":"[GHSA redacted]","aliases":["[CVE redacted]"],"reachability":{"kind":"not-imported"}}}},{"ruleId":"D34","level":"note","message":{"text":"Orphaned files with no living knowledge: 1 of 11 analysed file(s) have no living knowledge left \u2014 their last meaningful change has decayed away, so if one breaks, no one currently understands it (counted over production source files of roughly 2,400 bytes or more, excluding vendored, generated and example/demo trees and test files identified by path convention, largest first; 11 of the 292 production source files in this repository met that bar). None is large enough to earn a read-through of its own, so this row stands in for the per-file rows rather than raising one each \u2014 most significant first: config/initializers/devise.rb. Attach the read to the next change that touches one of them: have a second person review that change, and leave behind a short comment or test recording what the file is for, so the knowledge comes back at the cost of a change you were making anyway."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"ce861fd78f6935114d3a342cb90ad25870f984e1042954fcbbe27c0e23be3658"}},{"ruleId":"D35","level":"warning","message":{"text":"Change coupling: ruby_on_rails_lessons.rb \u2194 rails.rb: \u0060db/fixtures/lessons/ruby_on_rails_lessons.rb\u0060 and \u0060db/fixtures/paths/full_stack_rails/courses/rails.rb\u0060 change together 79% of the time (11 of the 14 commits that touched whichever of the two files changed less often, counting a file under its earlier names as well \u2014 a repo-wide or module-wide sweep is evidence about the sweep rather than about any pair inside it and is left out of BOTH sides of this ratio, while a dependency bump, a formatter/rename sweep, or a commit whose edit to one of the two files was a tool directive such as //go:generate or whitespace only is left out of the shared count ONLY, so the two sides are not taken over identical commit sets) with no explicit dependency \u2014 the edge is real but nothing declares it. Read the pair before acting: if one registers itself into the other through a hook or an initialiser, the missing dependency is DELIBERATE \u2014 the registration is the link, and it is meant not to be an import \u2014 and the thing to add is a comment on each side naming the other, not a merge; if they simply belong together, co-locate them; if neither holds, the coupling is hidden and worth breaking. You can check this without leaving the row: of the 11 shared commits counted here, the most recent 3 are \u0060e46880d1\u0060 feat(db/fixtures): rename ROR path capstone projects (#5196); \u0060a184c486\u0060 feat(fixture): update blog app project to store app project. (#5190); \u0060cd83e0dd\u0060 Update: Replace RoR/Flickr API lesson with RoR/Pexels API lesson (#5016) \u2014 run \u0060git show\u0060 on any of them."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"db/fixtures/lessons/ruby_on_rails_lessons.rb"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"80b558e892cbf6384d2d0fc17915619a8e3dc5cc614c096ca0666829d41ed321"}},{"ruleId":"D35","level":"warning","message":{"text":"Change coupling: ruby_lessons.rb \u2194 ruby.rb: \u0060db/fixtures/lessons/ruby_lessons.rb\u0060 and \u0060db/fixtures/paths/full_stack_rails/courses/ruby.rb\u0060 change together 69% of the time (9 of the 13 commits that touched whichever of the two files changed less often, counting a file under its earlier names as well \u2014 a repo-wide or module-wide sweep is evidence about the sweep rather than about any pair inside it and is left out of BOTH sides of this ratio, while a dependency bump, a formatter/rename sweep, or a commit whose edit to one of the two files was a tool directive such as //go:generate or whitespace only is left out of the shared count ONLY, so the two sides are not taken over identical commit sets) with no explicit dependency \u2014 the edge is real but nothing declares it. Read the pair before acting: if one registers itself into the other through a hook or an initialiser, the missing dependency is DELIBERATE \u2014 the registration is the link, and it is meant not to be an import \u2014 and the thing to add is a comment on each side naming the other, not a merge; if they simply belong together, co-locate them; if neither holds, the coupling is hidden and worth breaking. You can check this without leaving the row: of the 9 shared commits counted here, the most recent 3 are \u0060e46880d1\u0060 feat(db/fixtures): rename ROR path capstone projects (#5196); \u006036739e1f\u0060 Feat: Drop Event Manager from Files and Serialisation (#4967); \u0060c5272566\u0060 Feature: add Ruby Project Management and Linting lessons (#4540) \u2014 run \u0060git show\u0060 on any of them."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"db/fixtures/lessons/ruby_lessons.rb"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"d2fb074892f3999576d3ce972635f35d35cb3f8d09abb24472b1795abf198e3b"}},{"ruleId":"D35","level":"warning","message":{"text":"Change coupling: intermediate_html_css.rb \u2194 intermediate_html_css.rb: \u0060db/fixtures/paths/full_stack_javascript/courses/intermediate_html_css.rb\u0060 and \u0060db/fixtures/paths/full_stack_rails/courses/intermediate_html_css.rb\u0060 change together 69% of the time (11 of the 16 commits that touched whichever of the two files changed less often, counting a file under its earlier names as well \u2014 a repo-wide or module-wide sweep is evidence about the sweep rather than about any pair inside it and is left out of BOTH sides of this ratio, while a dependency bump, a formatter/rename sweep, or a commit whose edit to one of the two files was a tool directive such as //go:generate or whitespace only is left out of the shared count ONLY, so the two sides are not taken over identical commit sets) with no explicit dependency \u2014 the edge is real but nothing declares it. Read the pair before acting: if one registers itself into the other through a hook or an initialiser, the missing dependency is DELIBERATE \u2014 the registration is the link, and it is meant not to be an import \u2014 and the thing to add is a comment on each side naming the other, not a merge; if they simply belong together, co-locate them; if neither holds, the coupling is hidden and worth breaking. You can check this without leaving the row: of the 11 shared commits counted here, the most recent 3 are \u0060d3d20087\u0060 Feature: Remove Emmet lesson from curriculum (#5394); \u0060ff10c5c5\u0060 Create new section \u0027Forms\u0027 in the intermediate_html_css course; \u00607c715678\u0060 Update grid conclusion lesson title \u2014 run \u0060git show\u0060 on any of them."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"db/fixtures/paths/full_stack_javascript/courses/intermediate_html_css.rb"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"72d066b655f3925a4c2cf97ee5413f9ffc207dac837182239d1ce1c95f4af47f"}},{"ruleId":"D35","level":"warning","message":{"text":"Change coupling: foundation_lessons.rb \u2194 seed.rb: \u0060db/fixtures/lessons/foundation_lessons.rb\u0060 and \u0060db/fixtures/paths/foundations/seed.rb\u0060 change together 61% of the time (22 of the 36 commits that touched whichever of the two files changed less often, counting a file under its earlier names as well \u2014 a repo-wide or module-wide sweep is evidence about the sweep rather than about any pair inside it and is left out of BOTH sides of this ratio, while a dependency bump, a formatter/rename sweep, or a commit whose edit to one of the two files was a tool directive such as //go:generate or whitespace only is left out of the shared count ONLY, so the two sides are not taken over identical commit sets) with no explicit dependency \u2014 the edge is real but nothing declares it. Read the pair before acting: if one registers itself into the other through a hook or an initialiser, the missing dependency is DELIBERATE \u2014 the registration is the link, and it is meant not to be an import \u2014 and the thing to add is a comment on each side naming the other, not a merge; if they simply belong together, co-locate them; if neither holds, the coupling is hidden and worth breaking. You can check this without leaving the row: of the 22 shared commits counted here, the most recent 3 are \u0060b3e951ad\u0060 Remove Installation Overview lesson; \u006085dbe371\u0060 Chore: Remove Computer Basics Lesson Fixture (#5227); \u00601330515e\u0060 Feature: Rename \u0022Arrays and Loops\u0022 lesson to \u0022Loops and Arrays\u0022 (#5000) \u2014 run \u0060git show\u0060 on any of them."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"db/fixtures/lessons/foundation_lessons.rb"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"cc8b0d2113e0e3efb363532b6db73642072ca1b6f5fcd40a8fa9ae49f3d83c04"}},{"ruleId":"D35","level":"warning","message":{"text":"Change coupling: javascript_lessons.rb \u2194 javascript.rb: \u0060db/fixtures/lessons/javascript_lessons.rb\u0060 and \u0060db/fixtures/paths/full_stack_javascript/courses/javascript.rb\u0060 change together 56% of the time (15 of the 27 commits that touched whichever of the two files changed less often, counting a file under its earlier names as well \u2014 a repo-wide or module-wide sweep is evidence about the sweep rather than about any pair inside it and is left out of BOTH sides of this ratio, while a dependency bump, a formatter/rename sweep, or a commit whose edit to one of the two files was a tool directive such as //go:generate or whitespace only is left out of the shared count ONLY, so the two sides are not taken over identical commit sets) with no explicit dependency \u2014 the edge is real but nothing declares it. Read the pair before acting: if one registers itself into the other through a hook or an initialiser, the missing dependency is DELIBERATE \u2014 the registration is the link, and it is meant not to be an import \u2014 and the thing to add is a comment on each side naming the other, not a merge; if they simply belong together, co-locate them; if neither holds, the coupling is hidden and worth breaking. You can check this without leaving the row: of the 15 shared commits counted here, the most recent 3 are \u00601fb5f98d\u0060 Feature: Add new JavaScript \u0022Organizing Code with Objects\u0022 lesson (#5\u2026; \u00606502750c\u0060 Feature: Remove archived JavaScript course intro lessons (#5224); \u0060bc97027b\u0060 Feature: Remove JS Dynamic UI lesson (#5203) \u2014 run \u0060git show\u0060 on any of them."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"db/fixtures/lessons/javascript_lessons.rb"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"ab35e1ecb98de9bb83d938146901ead4795278349321f99aef42f1abfb5f067c"}},{"ruleId":"D35","level":"warning","message":{"text":"Change coupling: html_and_css_lessons.rb \u2194 intermediate_html_css.rb: \u0060db/fixtures/lessons/html_and_css_lessons.rb\u0060 and \u0060db/fixtures/paths/full_stack_javascript/courses/intermediate_html_css.rb\u0060 change together 55% of the time (11 of the 20 commits that touched whichever of the two files changed less often, counting a file under its earlier names as well \u2014 a repo-wide or module-wide sweep is evidence about the sweep rather than about any pair inside it and is left out of BOTH sides of this ratio, while a dependency bump, a formatter/rename sweep, or a commit whose edit to one of the two files was a tool directive such as //go:generate or whitespace only is left out of the shared count ONLY, so the two sides are not taken over identical commit sets) with no explicit dependency \u2014 the edge is real but nothing declares it. Read the pair before acting: if one registers itself into the other through a hook or an initialiser, the missing dependency is DELIBERATE \u2014 the registration is the link, and it is meant not to be an import \u2014 and the thing to add is a comment on each side naming the other, not a merge; if they simply belong together, co-locate them; if neither holds, the coupling is hidden and worth breaking. You can check this without leaving the row: of the 11 shared commits counted here, the most recent 3 are \u0060d3d20087\u0060 Feature: Remove Emmet lesson from curriculum (#5394); \u0060ff10c5c5\u0060 Create new section \u0027Forms\u0027 in the intermediate_html_css course; \u00607c715678\u0060 Update grid conclusion lesson title \u2014 run \u0060git show\u0060 on any of them."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"db/fixtures/lessons/html_and_css_lessons.rb"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"f2383dd54011db47695b3ae3113498c92838051a92155bd0fa6bbef4b5a5d800"}},{"ruleId":"D35","level":"warning","message":{"text":"Change coupling: javascript.rb \u2194 javascript.rb: \u0060db/fixtures/paths/full_stack_javascript/courses/javascript.rb\u0060 and \u0060db/fixtures/paths/full_stack_rails/courses/javascript.rb\u0060 change together 52% of the time (14 of the 27 commits that touched whichever of the two files changed less often, counting a file under its earlier names as well \u2014 a repo-wide or module-wide sweep is evidence about the sweep rather than about any pair inside it and is left out of BOTH sides of this ratio, while a dependency bump, a formatter/rename sweep, or a commit whose edit to one of the two files was a tool directive such as //go:generate or whitespace only is left out of the shared count ONLY, so the two sides are not taken over identical commit sets) with no explicit dependency \u2014 the edge is real but nothing declares it. Read the pair before acting: if one registers itself into the other through a hook or an initialiser, the missing dependency is DELIBERATE \u2014 the registration is the link, and it is meant not to be an import \u2014 and the thing to add is a comment on each side naming the other, not a merge; if they simply belong together, co-locate them; if neither holds, the coupling is hidden and worth breaking. You can check this without leaving the row: of the 14 shared commits counted here, the most recent 3 are \u00601fb5f98d\u0060 Feature: Add new JavaScript \u0022Organizing Code with Objects\u0022 lesson (#5\u2026; \u00606502750c\u0060 Feature: Remove archived JavaScript course intro lessons (#5224); \u0060bc97027b\u0060 Feature: Remove JS Dynamic UI lesson (#5203) \u2014 run \u0060git show\u0060 on any of them."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"db/fixtures/paths/full_stack_javascript/courses/javascript.rb"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"ec216cb88b83e0040a15745f48ec1559c664e9b4ea92706b933316277f1160ac"}},{"ruleId":"D36","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"9658270ba49f37ed04e99ab1263b6393cd42aed8bdfb7aafd9fa1070f5491895"}},{"ruleId":"AC1","level":"warning","message":{"text":"\u003Ccanvas\u003E without a text alternative: A \u003Ccanvas\u003E with no aria-label/title and no inner fallback content can\u0027t be described by assistive tech. Add a name or fallback content."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/components/charts/horizontal_bar_chart_component.html.erb"},"region":{"startLine":2}}}],"partialFingerprints":{"codehealthFindingId/v1":"2030482e95cac74dcfef7e31f24f345d5badbb2643fffc85c6f95c155450d622"}},{"ruleId":"AC1","level":"warning","message":{"text":"\u003Ccanvas\u003E without a text alternative: A \u003Ccanvas\u003E with no aria-label/title and no inner fallback content can\u0027t be described by assistive tech. Add a name or fallback content."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/components/charts/line_chart_component.html.erb"},"region":{"startLine":2}}}],"partialFingerprints":{"codehealthFindingId/v1":"1ccbfca4099f105704415e205511113a2b081cebbc9036d75a0c12c6c458eea7"}},{"ruleId":"AC3","level":"warning","message":{"text":"Heading level jumps from h1 to h3: Skipping heading levels breaks the document outline assistive tech relies on. Don\u0027t jump levels \u2014 increase by at most one."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/views/admin/dashboard/show.html.erb"},"region":{"startLine":25}}}],"partialFingerprints":{"codehealthFindingId/v1":"2bbff38888ebc8b5fd3af41ce1502aca8a4930a40ccbf123e87284e4fa677ba2"}},{"ruleId":"AC3","level":"warning","message":{"text":"Heading level jumps from h1 to h3: Skipping heading levels breaks the document outline assistive tech relies on. Don\u0027t jump levels \u2014 increase by at most one."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/views/admin/reports/paths/show.html.erb"},"region":{"startLine":29}}}],"partialFingerprints":{"codehealthFindingId/v1":"02824952d0b474ef515879dcdb191380a4e0afb77b148981484ef66412f7e05d"}},{"ruleId":"AC3","level":"warning","message":{"text":"Heading level jumps from h1 to h3: Skipping heading levels breaks the document outline assistive tech relies on. Don\u0027t jump levels \u2014 increase by at most one."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/views/admin/reports/users/index.html.erb"},"region":{"startLine":21}}}],"partialFingerprints":{"codehealthFindingId/v1":"7487d6499d1cda4703ef469c9e3155e92ff80579335fda117edcb18068ee158b"}},{"ruleId":"AC3","level":"warning","message":{"text":"Heading level jumps from h1 to h3: Skipping heading levels breaks the document outline assistive tech relies on. Don\u0027t jump levels \u2014 increase by at most one."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/views/admin/team_members/index.html.erb"},"region":{"startLine":37}}}],"partialFingerprints":{"codehealthFindingId/v1":"6503f07394342f1b34f1a342582600d80cfbf25d250c69bf9b8a0d0528c2acb4"}},{"ruleId":"AC3","level":"warning","message":{"text":"Page without a main landmark: No \u003Cmain\u003E (or role=\u0022main\u0022) means no \u0022skip to content\u0022 target and a weaker landmark map. Wrap the primary content in \u003Cmain\u003E."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/views/layouts/application.html.erb"},"region":{"startLine":2}}}],"partialFingerprints":{"codehealthFindingId/v1":"13e845227d3201e174756626572ef80f2616ddff099286291fbc93fbc860c250"}},{"ruleId":"AC3","level":"error","message":{"text":"\u003Chtml\u003E without a lang: The page declares no language, so assistive tech can\u0027t pick the right pronunciation. Add lang (e.g. lang=\u0022en\u0022)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/views/layouts/component_preview.html.erb"},"region":{"startLine":2}}}],"partialFingerprints":{"codehealthFindingId/v1":"c1fb75a5fcf4cd85f4610eb807f18c07c235f5811dd7387f5257ce7cb0224e7a"}},{"ruleId":"AC3","level":"warning","message":{"text":"Page without a main landmark: No \u003Cmain\u003E (or role=\u0022main\u0022) means no \u0022skip to content\u0022 target and a weaker landmark map. Wrap the primary content in \u003Cmain\u003E."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/views/layouts/component_preview.html.erb"},"region":{"startLine":2}}}],"partialFingerprints":{"codehealthFindingId/v1":"f94fd0d80805c88ff323c4e2b68f93ffb71170486f331f583f5a0ea4db4f4455"}},{"ruleId":"AC3","level":"error","message":{"text":"\u003Chtml\u003E without a lang: The page declares no language, so assistive tech can\u0027t pick the right pronunciation. Add lang (e.g. lang=\u0022en\u0022)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/views/layouts/errors.html.erb"},"region":{"startLine":2}}}],"partialFingerprints":{"codehealthFindingId/v1":"7c48fc31073b216ae970f10cafddbb0f6f66cba9b94618d5167b1890f49f7dee"}},{"ruleId":"AC3","level":"warning","message":{"text":"Heading level jumps from h1 to h3: Skipping heading levels breaks the document outline assistive tech relies on. Don\u0027t jump levels \u2014 increase by at most one."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/views/notifications/index.html.erb"},"region":{"startLine":10}}}],"partialFingerprints":{"codehealthFindingId/v1":"20b08d20f094996e1630222f55f0c5b15fd0b1ff64a44968428ffb155c46f436"}},{"ruleId":"AC3","level":"warning","message":{"text":"Heading level jumps from h1 to h3: Skipping heading levels breaks the document outline assistive tech relies on. Don\u0027t jump levels \u2014 increase by at most one."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/views/static_pages/privacy_policy.html.erb"},"region":{"startLine":10}}}],"partialFingerprints":{"codehealthFindingId/v1":"cebfa7b91969ef546ce0b4189a8fbcc51b1b27937549828373b0c4032c0d5965"}},{"ruleId":"AC3","level":"warning","message":{"text":"Heading level jumps from h1 to h3: Skipping heading levels breaks the document outline assistive tech relies on. Don\u0027t jump levels \u2014 increase by at most one."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/views/static_pages/terms_of_use.html.erb"},"region":{"startLine":9}}}],"partialFingerprints":{"codehealthFindingId/v1":"dc264b9cc715f5840189d2d1402b314053fc2d2579816774d1c0d6354c6e8a8a"}},{"ruleId":"AC6","level":"warning","message":{"text":"Low contrast Tailwind colour pair (2.5:1): This element\u0027s Tailwind text/background colour utilities fall below the 4.5:1 WCAG AA minimum for normal text. Pick a darker or lighter shade."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/components/overlays/modal_component.html.erb"},"region":{"startLine":36}}}],"partialFingerprints":{"codehealthFindingId/v1":"d73f966fc531c480e9a75732c9cccb6229a41f4e8d8b12ab29a8ec5db64c0e9e"}},{"ruleId":"AC7","level":"warning","message":{"text":"Accessibility enforcement below the top rung: No accessibility enforcement found \u2014 no a11y linter (an accessibility check that can read your UI \u2014 no component framework was detected and your pages are rendered by server-side templates, which neither the JSX/Vue ESLint plugins nor the HTML-template linters can parse; run axe/pa11y over the rendered pages, or assert the accessibility invariants over that rendered HTML in the test suite you already have) and no axe/pa11y/Lighthouse in tests or CI. Start by running that check over your rendered pages in CI. What was searched, so you can tell an absence from a miss: the 153 markup file(s) this pass actually assessed, the linter configuration checked in beside them, and this repository\u0027s test and CI files \u2014 matched by name against the accessibility checkers this dimension carries. An audit run outside the repository, a hosted scanner, or a check whose name is not one of those, is not seen here."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"d46019b86eff5ddad9db289e6802ac158899e980df54c34f67722442787ead62"}},{"ruleId":"DM6","level":"error","message":{"text":"Domain fused to persistence infrastructure: AdminUser: \u0060AdminUser\u0060 is a domain concept fused to persistence ON ITS OWN DECLARATION (Rails ActiveRecord \u2014 \u0060ApplicationRecord\u0060) \u2014 the domain entity IS the ActiveRecord row (active-record), and it carries domain behaviour on the persistence type. A schema/persistence change ripples straight into the domain. Keep the ORM/table mapping on a boundary data-model \u002B a mapper, and the domain entity framework-free (map row\u2194domain through a repository)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/models/admin_user.rb"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"bd83afc46e8e0e34789be174719c6071bc11257b57d02b60d845f03846fe55af"}},{"ruleId":"DM6","level":"error","message":{"text":"Domain fused to persistence infrastructure: Flag: \u0060Flag\u0060 is a domain concept fused to persistence ON ITS OWN DECLARATION (Rails ActiveRecord \u2014 \u0060ApplicationRecord\u0060) \u2014 the domain entity IS the ActiveRecord row (active-record), and it carries domain behaviour on the persistence type. A schema/persistence change ripples straight into the domain. Keep the ORM/table mapping on a boundary data-model \u002B a mapper, and the domain entity framework-free (map row\u2194domain through a repository)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/models/flag.rb"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"f28f1d27f7ff745e680f3958b02864ac2c39a147edf5ebd775ec33656a160e9c"}},{"ruleId":"DM6","level":"error","message":{"text":"Domain fused to persistence infrastructure: Lesson: \u0060Lesson\u0060 is a domain concept fused to persistence ON ITS OWN DECLARATION (Rails ActiveRecord \u2014 \u0060ApplicationRecord\u0060) \u2014 the domain entity IS the ActiveRecord row (active-record), and it carries domain behaviour on the persistence type. A schema/persistence change ripples straight into the domain. Keep the ORM/table mapping on a boundary data-model \u002B a mapper, and the domain entity framework-free (map row\u2194domain through a repository)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/models/lesson.rb"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"55f5239afc89dbf4f148174db919ae2a29d363b84c1bd0769bf7c4ab591b0c21"}},{"ruleId":"DM6","level":"error","message":{"text":"Domain fused to persistence infrastructure: Notification: \u0060Notification\u0060 is a domain concept fused to persistence ON ITS OWN DECLARATION (Rails ActiveRecord \u2014 \u0060ApplicationRecord\u0060) \u2014 the domain entity IS the ActiveRecord row (active-record), and it carries domain behaviour on the persistence type. A schema/persistence change ripples straight into the domain. Keep the ORM/table mapping on a boundary data-model \u002B a mapper, and the domain entity framework-free (map row\u2194domain through a repository)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/models/notification.rb"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"f0886a7376a346d33967be34b50ced0d1d0bf37c0bd7ba554266b4c4e7a40cc8"}},{"ruleId":"DM6","level":"error","message":{"text":"Domain fused to persistence infrastructure: User: \u0060User\u0060 is a domain concept fused to persistence ON ITS OWN DECLARATION (Rails ActiveRecord \u2014 \u0060ApplicationRecord\u0060) \u2014 the domain entity IS the ActiveRecord row (active-record), and it carries domain behaviour on the persistence type. A schema/persistence change ripples straight into the domain. Keep the ORM/table mapping on a boundary data-model \u002B a mapper, and the domain entity framework-free (map row\u2194domain through a repository)."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/models/user.rb"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"65eaef449c757115c7383c0bf6e223c91522160052aff8cfe40806c1de1c04b2"}},{"ruleId":"M1","level":"warning","message":{"text":"README may be stale: 69 code files changed in the last 6 months but the README was not touched \u2014 it may no longer reflect the system."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"e973e7a8d5d866995cbf78b120250fe7f132bf928812d48ca62e69aba11b9910"}},{"ruleId":"M2","level":"note","message":{"text":"No ADRs: No Architecture Decision Records found \u2014 no conventional ADR directory, no numbered \u0060NNNN-title\u0060 documents in any markup this check reads, and nothing ADR-shaped by content. Design rationale recorded elsewhere (a design-notes tree, a mailing list, pull-request discussion) is not visible to this check and is not re-findable per decision, so a future maintainer cannot ask why one choice was made and get an answer."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"670b3d6e36a756d63097d0dfbf90afd5fc761308800b9354894a07c3f4e4aa14"}},{"ruleId":"P2","level":"note","message":{"text":"Logging is not universal: Only 1/2 runnable modules use logging (modules with no entry point or server are excluded \u2014 they are libraries a runnable module hosts). Silent: \u0060.\u0060."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"91a94e21d6d4d0e6a2003f94505b0b02b157176f0b24c4820f3f82b4447a97fe"}},{"ruleId":"P4","level":"note","message":{"text":"No release approval gate: The release is automated and no gate that pauses it for a human is DECLARED IN THIS REPOSITORY\u0027S PIPELINE FILES. What was read: every file under \u0060.github/workflows/\u0060, \u0060.forgejo/workflows/\u0060, \u0060.gitea/workflows/\u0060, \u0060.azuredevops/\u0060 and \u0060.azure-pipelines/\u0060, plus \u0060.gitlab-ci*\u0060 and \u0060azure-pipelines*\u0060 \u2014 with comment text stripped, so documenting a gate is not declaring one. What would have counted: GitLab\u0027s \u0060when: manual\u0060, CircleCI\u0027s \u0060type: approval\u0060, an Azure \u0060ManualValidation@\u0060 task or an \u0060approvals:\u0060 block, a Jenkins \u0060input\u0060 step, a \u0060uses:\u0060 step naming an approval action, an \u0060environment:\u0060 paired with \u0060reviewers\u0060 / \u0060required_reviewers\u0060 / \u0060protection\u0060 / \u0060wait-timer\u0060 / \u0060deployment_branch_policy\u0060, a draft-release step, a \u0060workflow_dispatch\u0060 promotion, or a release-event gate. \u2605 What this cannot see, because none of it is a file: a GitHub environment whose required reviewers are configured in repo SETTINGS, a branch protection rule, or an organisation deployment policy \u2014 all of them real, enforced gates that live outside the repository. If yours is one of those, this row is wrong and nothing in the tree could have told us. Otherwise: whatever the release trigger points at is published to users unreviewed, so a mistagged or unverified commit ships and the only remedy is a follow-up release."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"6c11e2dbd483b4b423b95ac61bfcc7af1d55351b28a20d2b1105b31cfe38cc60"}},{"ruleId":"R1","level":"warning","message":{"text":"Type Safety: 0 typed \u00B7 29 plain JS \u2014 the untyped files are app/components/lessons/sidebar_toggle_controller.js, app/components/overlays/dialog_controller.js, app/components/project_submissions/item_controller.js, app/javascript/controllers/announcement_controller.js, app/javascript/controllers/autosort_controller.js, app/javascript/controllers/autosubmit_controller.js (\u002B23 more)."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"d00ee7953f55325a823d27e5db9657c80ca9b9861c0c0abf8fe487cd3fa586d3"}},{"ruleId":"R6","level":"warning","message":{"text":"No test or typecheck script: test \u2717 \u00B7 lint \u2713 \u00B7 typecheck \u2717 \u2014 read from this repository\u0027s package.json scripts and corroborated against its CI workflows. A script counts when its name or command matches the step: \u0060test\u0060 for the suite, \u0060lint\u0060 or \u0060prettier\u0060 for linting, \u0060typecheck\u0060/\u0060type-check\u0060/\u0060tsc\u0060 for type checking. \u2717 therefore means no script or CI step under those names was found, NOT that the step is absent from your pipeline \u2014 a task invoked by a runner this check does not read, or named something else entirely, is not seen and is worth confirming before acting on a cross. A \u2713 means the wiring is DECLARED \u2014 a script or CI step under those names exists. It is not a statement that the step passes, or that it runs at all: nothing here installs a dependency or executes a suite."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"53484d7d02bbf1aa1fb3d1163371a5b52fa0aa7301d11eed5ec2dc836c72924b"}},{"ruleId":"R7","level":"warning","message":{"text":"Dead file (~62 LoC): no import path from any entry point (2 application, 2 tooling, 0 test roots considered), and no other file in the scanned tree imports it \u2014 nothing in-repo names this module at all, which is the strongest form of this claim the import graph can make"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/javascript/controllers/lesson_toc_controller.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"2c9f5446b15c0d12802f6fa444bb54b92916b5a9a55c5521a9650d8dbe9a2f7d"}},{"ruleId":"R7","level":"warning","message":{"text":"Dead file (~61 LoC): no import path from any entry point (2 application, 2 tooling, 0 test roots considered), and no other file in the scanned tree imports it \u2014 nothing in-repo names this module at all, which is the strongest form of this claim the import graph can make"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/javascript/controllers/autosort_controller.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"3b106071015e47681e2494d6b6b3163a8895762c12df8020623fa7322a5882aa"}},{"ruleId":"R7","level":"warning","message":{"text":"Dead file (~53 LoC): no import path from any entry point (2 application, 2 tooling, 0 test roots considered), and no other file in the scanned tree imports it \u2014 nothing in-repo names this module at all, which is the strongest form of this claim the import graph can make"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/components/lessons/sidebar_toggle_controller.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"24daffbd6259421a41f65a6c80d4feaaf9f7bf1f5f902f3a7314bf03c4d45122"}},{"ruleId":"R7","level":"warning","message":{"text":"Dead file (~50 LoC): no import path from any entry point (2 application, 2 tooling, 0 test roots considered), and no other file in the scanned tree imports it \u2014 nothing in-repo names this module at all, which is the strongest form of this claim the import graph can make"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/javascript/controllers/visibility_controller.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"1c77f4dc1eef150edc7c6837a1cbfb7f6c55714853be0400e7e7957ff6660bfd"}},{"ruleId":"R7","level":"warning","message":{"text":"Dead file (~47 LoC): no import path from any entry point (2 application, 2 tooling, 0 test roots considered), but 1 in-repo import(s) from 1 other file(s) do name it (app/javascript/controllers/chart_with_crosshair_controller.js) \u2014 every one of those referrers is itself unreachable, so this file is dead only as a member of that cluster: if any referrer is in fact alive, this row falls with it"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/javascript/controllers/chart_controller.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"49ec5ab2e6637588feccfb3ef8ab9e2ecb5a0500f77f9f07185538cd9a8d76ac"}},{"ruleId":"R7","level":"warning","message":{"text":"Dead file (~43 LoC): no import path from any entry point (2 application, 2 tooling, 0 test roots considered), and no other file in the scanned tree imports it \u2014 nothing in-repo names this module at all, which is the strongest form of this claim the import graph can make"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/javascript/controllers/tabs_controller.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"d244645e7c39c7a50fd88546451f38f8dc2773345fd562df520997c75ce7831f"}},{"ruleId":"R7","level":"warning","message":{"text":"Dead file (~39 LoC): no import path from any entry point (2 application, 2 tooling, 0 test roots considered), and no other file in the scanned tree imports it \u2014 nothing in-repo names this module at all, which is the strongest form of this claim the import graph can make"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/javascript/controllers/chart_with_crosshair_controller.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"29b693ab657314f41bfdd826e9b2caba0f57fc9895b024202b751136a26df0b1"}},{"ruleId":"R7","level":"warning","message":{"text":"Dead file (~39 LoC): no import path from any entry point (2 application, 2 tooling, 0 test roots considered), and no other file in the scanned tree imports it \u2014 nothing in-repo names this module at all, which is the strongest form of this claim the import graph can make"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/javascript/controllers/modal_controller.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"8281e9c80366e9f0f2795b27f2024b1766d73d9187c401a3a6985c15386082df"}},{"ruleId":"R7","level":"warning","message":{"text":"Dead file (~31 LoC): no import path from any entry point (2 application, 2 tooling, 0 test roots considered), and no other file in the scanned tree imports it \u2014 nothing in-repo names this module at all, which is the strongest form of this claim the import graph can make"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/components/overlays/dialog_controller.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"72ab3ce93a0f4a398143171519a83406abac9a86febabab5d3fd735856d5e1c9"}},{"ruleId":"R7","level":"warning","message":{"text":"Dead file (~28 LoC): no import path from any entry point (2 application, 2 tooling, 0 test roots considered), and no other file in the scanned tree imports it \u2014 nothing in-repo names this module at all, which is the strongest form of this claim the import graph can make"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/javascript/controllers/date_picker_controller.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"58810ab0834ec1012e2f4a1ec2ab791deeba2b6fbf01b2b7c330a5ea6985e2cb"}},{"ruleId":"R7","level":"warning","message":{"text":"Dead file (~25 LoC): no import path from any entry point (2 application, 2 tooling, 0 test roots considered), and no other file in the scanned tree imports it \u2014 nothing in-repo names this module at all, which is the strongest form of this claim the import graph can make"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/components/project_submissions/item_controller.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"2f1ff67813ad99972613c128e257a319df8e2102e55793a7683ea50e34e1480b"}},{"ruleId":"R7","level":"warning","message":{"text":"Dead file (~24 LoC): no import path from any entry point (2 application, 2 tooling, 0 test roots considered), and no other file in the scanned tree imports it \u2014 nothing in-repo names this module at all, which is the strongest form of this claim the import graph can make"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/javascript/controllers/sticky_state_controller.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"0b2479d24e4b9cc1836605452098fe235320328745948ae6c6491934bafd1e9f"}},{"ruleId":"R7","level":"warning","message":{"text":"Dead file (~23 LoC): no import path from any entry point (2 application, 2 tooling, 0 test roots considered), and no other file in the scanned tree imports it \u2014 nothing in-repo names this module at all, which is the strongest form of this claim the import graph can make"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/javascript/controllers/share_preview_controller.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"81516eec293b9a665e85dde79cf53031f1e950cf5be45095ac6f6f92b70c07a0"}},{"ruleId":"R7","level":"warning","message":{"text":"Dead file (~17 LoC): no import path from any entry point (2 application, 2 tooling, 0 test roots considered), and no other file in the scanned tree imports it \u2014 nothing in-repo names this module at all, which is the strongest form of this claim the import graph can make"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/javascript/controllers/progress_controller.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"a50d448a574fe0ed2f0dc812d2280e0439c5ade9504996678813d1d2d830192a"}},{"ruleId":"R7","level":"warning","message":{"text":"Dead file (~17 LoC): no import path from any entry point (2 application, 2 tooling, 0 test roots considered), and no other file in the scanned tree imports it \u2014 nothing in-repo names this module at all, which is the strongest form of this claim the import graph can make"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/javascript/controllers/tooltip_controller.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"9867300680aea2741139861e9872e21e29c6a16d8bec6c27f2cdc4889edb40fa"}},{"ruleId":"R7","level":"warning","message":{"text":"Dead file (~16 LoC): no import path from any entry point (2 application, 2 tooling, 0 test roots considered), and no other file in the scanned tree imports it \u2014 nothing in-repo names this module at all, which is the strongest form of this claim the import graph can make"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/javascript/controllers/autosubmit_controller.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"ba204b76eca4dfa02fd6d5f51c4ef0670b977a94efabd9826c354a4f7eae4ff1"}},{"ruleId":"R7","level":"warning","message":{"text":"Dead file (~16 LoC): no import path from any entry point (2 application, 2 tooling, 0 test roots considered), and no other file in the scanned tree imports it \u2014 nothing in-repo names this module at all, which is the strongest form of this claim the import graph can make"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/javascript/controllers/clipboard_controller.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"146a6efac4fe02c81ba405b2417f961af5f0340ba681a42bc2963aa7d2e39c78"}},{"ruleId":"R7","level":"warning","message":{"text":"Dead file (~14 LoC): no import path from any entry point (2 application, 2 tooling, 0 test roots considered), and no other file in the scanned tree imports it \u2014 nothing in-repo names this module at all, which is the strongest form of this claim the import graph can make"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/javascript/controllers/announcement_controller.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"1bd6d72c307d8951bd0e11b3183b63b30e1977e2b3556f9dd79abf9f30bed187"}},{"ruleId":"R7","level":"warning","message":{"text":"Dead file (~14 LoC): no import path from any entry point (2 application, 2 tooling, 0 test roots considered), and no other file in the scanned tree imports it \u2014 nothing in-repo names this module at all, which is the strongest form of this claim the import graph can make"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/javascript/controllers/css_toggle_controller.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"cc4c72e4670d1550c27e9a849a88d18172927ed701161df52d22635a279170c1"}},{"ruleId":"R7","level":"warning","message":{"text":"Dead file (~13 LoC): no import path from any entry point (2 application, 2 tooling, 0 test roots considered), and no other file in the scanned tree imports it \u2014 nothing in-repo names this module at all, which is the strongest form of this claim the import graph can make"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/javascript/controllers/diagramming_controller.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"994bb15266109428b4a643ea6ce4da08134f8b5ecfa6a310591644ac234eacbb"}},{"ruleId":"R7","level":"warning","message":{"text":"Dead file (~13 LoC): no import path from any entry point (2 application, 2 tooling, 0 test roots considered), and no other file in the scanned tree imports it \u2014 nothing in-repo names this module at all, which is the strongest form of this claim the import graph can make"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/javascript/controllers/disable_controller.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"a38d2a21c221b8f21bfe546ceb950a37c39182200cb4746e340a0d8d74d3a67a"}},{"ruleId":"R7","level":"warning","message":{"text":"Dead file (~13 LoC): no import path from any entry point (2 application, 2 tooling, 0 test roots considered), and no other file in the scanned tree imports it \u2014 nothing in-repo names this module at all, which is the strongest form of this claim the import graph can make"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/javascript/controllers/flash_controller.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"e346ea9fdd3090202104e03f90de5cbf5f40941dd0584f5f5c0d0f8d6b36669d"}},{"ruleId":"R7","level":"warning","message":{"text":"Dead file (~11 LoC): no import path from any entry point (2 application, 2 tooling, 0 test roots considered), and no other file in the scanned tree imports it \u2014 nothing in-repo names this module at all, which is the strongest form of this claim the import graph can make"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/javascript/controllers/dialog_router_controller.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"58ec517c3c2cb01b80394e93da3937eafdba42f050e01ba4a8b14619fce766eb"}},{"ruleId":"R7","level":"warning","message":{"text":"Dead file (~9 LoC): no import path from any entry point (2 application, 2 tooling, 0 test roots considered), and no other file in the scanned tree imports it \u2014 nothing in-repo names this module at all, which is the strongest form of this claim the import graph can make"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/javascript/controllers/open_menu_controller.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"a583c570c189a240995b47796783aeba21536974505847d9c6c6ca23f75109b1"}},{"ruleId":"R7","level":"warning","message":{"text":"Dead file (~8 LoC): no import path from any entry point (2 application, 2 tooling, 0 test roots considered), and no other file in the scanned tree imports it \u2014 nothing in-repo names this module at all, which is the strongest form of this claim the import graph can make"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/javascript/controllers/syntax_highlighting_controller.js"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"eeb0c91a65a45f0f33a5cda4c98b2b8a5d6b129a83d8e4fe32bfe1f59deb6a3d"}},{"ruleId":"R7","level":"note","message":{"text":"Unused export \u0027default\u0027: Nothing imports this binding \u2014 it is safe to review for removal."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/javascript/controllers/index.js"},"region":{"startLine":21}}}],"partialFingerprints":{"codehealthFindingId/v1":"85f9ff199b4c0d534e25cde7d4a560c188315bd0d73b61a32f161097986a0f6d"}},{"ruleId":"S1","level":"warning","message":{"text":"Third-party script without Subresource Integrity: \u0060https://static.cloudflareinsights.com/beacon.min.js\u0060 is executed by this page with no Subresource Integrity. Whoever can answer that request \u2014 the CDN, anyone who compromises it, anyone on the network path \u2014 runs arbitrary script in this page\u0027s origin, with its session. The URL also names no version, so it resolves to whatever that origin serves at fetch time \u2014 the executed bytes can change with nobody touching this repository."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"app/views/shared/_analytics.html.erb"},"region":{"startLine":3}}}],"partialFingerprints":{"codehealthFindingId/v1":"ffa4063b6811e7fbf4da7d5f8346874f416db0c0cde7a7a75d3eb169e2c8da3b"}}],"taxonomies":[{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d","organization":"MITRE","informationUri":"https://cwe.mitre.org/","isComprehensive":false,"shortDescription":{"text":"The MITRE Common Weakness Enumeration (CWE)."},"taxa":[{"id":"CWE-1104","guid":"4c918cb5-b2a6-6c55-9963-a44ee464305e","name":"CWE-1104","shortDescription":{"text":"CWE-1104"},"helpUri":"https://cwe.mitre.org/data/definitions/1104.html"},{"id":"CWE-1352","guid":"5257f322-5cfc-6b52-bedd-0b9a526b4c7d","name":"CWE-1352","shortDescription":{"text":"CWE-1352"},"helpUri":"https://cwe.mitre.org/data/definitions/1352.html"},{"id":"CWE-1357","guid":"e4d2e772-757e-0a5c-bd7d-77052949d866","name":"Reliance on Insufficiently Trustworthy Component","shortDescription":{"text":"Reliance on Insufficiently Trustworthy Component"},"helpUri":"https://cwe.mitre.org/data/definitions/1357.html"},{"id":"CWE-1395","guid":"800e09e7-c11a-8654-9fa6-86f398995fed","name":"Dependency on Vulnerable Third-Party Component","shortDescription":{"text":"Dependency on Vulnerable Third-Party Component"},"helpUri":"https://cwe.mitre.org/data/definitions/1395.html"},{"id":"CWE-259","guid":"ae9ad959-fbb6-9d5e-892d-3dca66da0b69","name":"Use of Hard-coded Password","shortDescription":{"text":"Use of Hard-coded Password"},"helpUri":"https://cwe.mitre.org/data/definitions/259.html"},{"id":"CWE-295","guid":"a706c4e2-1232-8859-ae2e-17aa2d41f8e2","name":"CWE-295","shortDescription":{"text":"CWE-295"},"helpUri":"https://cwe.mitre.org/data/definitions/295.html"},{"id":"CWE-353","guid":"09d7e902-d4ee-f05d-ae6c-0a1554d0c18f","name":"CWE-353","shortDescription":{"text":"CWE-353"},"helpUri":"https://cwe.mitre.org/data/definitions/353.html"},{"id":"CWE-494","guid":"b8a65e0d-e459-4a55-a931-fc1136482375","name":"Download of Code Without Integrity Check","shortDescription":{"text":"Download of Code Without Integrity Check"},"helpUri":"https://cwe.mitre.org/data/definitions/494.html"},{"id":"CWE-506","guid":"401d6455-56e3-0552-9a39-f77461673e3f","name":"CWE-506","shortDescription":{"text":"CWE-506"},"helpUri":"https://cwe.mitre.org/data/definitions/506.html"},{"id":"CWE-522","guid":"71fb233e-ce6a-ae57-9419-ef8373540b09","name":"CWE-522","shortDescription":{"text":"CWE-522"},"helpUri":"https://cwe.mitre.org/data/definitions/522.html"},{"id":"CWE-601","guid":"9b8963d5-129b-475c-90cf-2d1766e66f2f","name":"CWE-601","shortDescription":{"text":"CWE-601"},"helpUri":"https://cwe.mitre.org/data/definitions/601.html"},{"id":"CWE-639","guid":"fd233662-97cf-025a-972b-66c9473efbcd","name":"CWE-639","shortDescription":{"text":"CWE-639"},"helpUri":"https://cwe.mitre.org/data/definitions/639.html"},{"id":"CWE-77","guid":"332c8ade-6612-9f56-a06b-d8d90b1a8750","name":"Command Injection","shortDescription":{"text":"Command Injection"},"helpUri":"https://cwe.mitre.org/data/definitions/77.html"},{"id":"CWE-78","guid":"2e31ceaf-c7ae-2e5e-9661-cfb1362789cf","name":"OS Command Injection","shortDescription":{"text":"OS Command Injection"},"helpUri":"https://cwe.mitre.org/data/definitions/78.html"},{"id":"CWE-79","guid":"fd45580b-e8c4-fc5e-8c2f-aa8fab0b4dbf","name":"Cross-site Scripting (XSS)","shortDescription":{"text":"Cross-site Scripting (XSS)"},"helpUri":"https://cwe.mitre.org/data/definitions/79.html"},{"id":"CWE-798","guid":"5e8f057d-fee3-995a-a0cb-9fc5b0d174d1","name":"Use of Hard-coded Credentials","shortDescription":{"text":"Use of Hard-coded Credentials"},"helpUri":"https://cwe.mitre.org/data/definitions/798.html"},{"id":"CWE-829","guid":"13c33925-97fb-5a5e-b40c-56d328b8a4d7","name":"CWE-829","shortDescription":{"text":"CWE-829"},"helpUri":"https://cwe.mitre.org/data/definitions/829.html"},{"id":"CWE-89","guid":"6d08fdad-37eb-c150-bbf0-d7d946863407","name":"SQL Injection","shortDescription":{"text":"SQL Injection"},"helpUri":"https://cwe.mitre.org/data/definitions/89.html"},{"id":"CWE-937","guid":"16f316ae-415c-b354-a59b-1f7905f756e9","name":"Using Components with Known Vulnerabilities","shortDescription":{"text":"Using Components with Known Vulnerabilities"},"helpUri":"https://cwe.mitre.org/data/definitions/937.html"},{"id":"CWE-94","guid":"75e7f50c-6c2f-dd52-bf40-bf6c52b861fd","name":"Code Injection","shortDescription":{"text":"Code Injection"},"helpUri":"https://cwe.mitre.org/data/definitions/94.html"}]}],"properties":{"codehealthPublication":{"public":true,"notice":"This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings \u2014 which rule fired, in which file, on which line, and how to fix it \u2014 are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.","securityFindingsRedacted":86,"secretScannerRunsExcluded":0}},"redactionTokens":["A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."]}]}