{"$schema":"https://json.schemastore.org/sarif-2.1.0.json","version":"2.1.0","runs":[{"tool":{"driver":{"name":"codehealth","informationUri":"https://codehealth.canine.dev","rules":[{"id":"D1","name":"Cyclomatic Complexity","shortDescription":{"text":"Cyclomatic Complexity"},"helpUri":"https://codehealth.canine.dev/dimensions/D1"},{"id":"D2","name":"Cognitive Complexity","shortDescription":{"text":"Cognitive Complexity"},"helpUri":"https://codehealth.canine.dev/dimensions/D2"},{"id":"D3","name":"God Classes","shortDescription":{"text":"God Classes"},"helpUri":"https://codehealth.canine.dev/dimensions/D3"},{"id":"D4","name":"Code Duplication","shortDescription":{"text":"Code Duplication"},"helpUri":"https://codehealth.canine.dev/dimensions/D4"},{"id":"D5","name":"Coupling","shortDescription":{"text":"Coupling"},"helpUri":"https://codehealth.canine.dev/dimensions/D5"},{"id":"D6","name":"Cohesion (LCOM4)","shortDescription":{"text":"Cohesion (LCOM4)"},"helpUri":"https://codehealth.canine.dev/dimensions/D6"},{"id":"D7","name":"Architectural Integrity","shortDescription":{"text":"Architectural Integrity"},"helpUri":"https://codehealth.canine.dev/dimensions/D7"},{"id":"D8","name":"Code Coverage","shortDescription":{"text":"Code Coverage"},"helpUri":"https://codehealth.canine.dev/dimensions/D8"},{"id":"D9","name":"Test Distribution","shortDescription":{"text":"Test Distribution"},"helpUri":"https://codehealth.canine.dev/dimensions/D9"},{"id":"D10","name":"Test Quality","shortDescription":{"text":"Test Quality"},"helpUri":"https://codehealth.canine.dev/dimensions/D10"},{"id":"D11","name":"Test Reliability","shortDescription":{"text":"Test Reliability"},"helpUri":"https://codehealth.canine.dev/dimensions/D11"},{"id":"D12","name":"Dependency Hygiene","shortDescription":{"text":"Dependency Hygiene"},"helpUri":"https://codehealth.canine.dev/dimensions/D12"},{"id":"D13","name":"Secret Scanning","shortDescription":{"text":"Secret Scanning"},"helpUri":"https://codehealth.canine.dev/dimensions/D13","relationships":[{"target":{"id":"CWE-798","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-259","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]}],"properties":{"cwe":["CWE-798","CWE-259"]}},{"id":"D14","name":"License Compliance","shortDescription":{"text":"License Compliance"},"helpUri":"https://codehealth.canine.dev/dimensions/D14"},{"id":"D15","name":"Churn \u00D7 Complexity Hotspots","shortDescription":{"text":"Churn \u00D7 Complexity Hotspots"},"helpUri":"https://codehealth.canine.dev/dimensions/D15"},{"id":"D16","name":"Bus Factor","shortDescription":{"text":"Bus Factor"},"helpUri":"https://codehealth.canine.dev/dimensions/D16"},{"id":"D17","name":"Explicit Debt","shortDescription":{"text":"Explicit Debt"},"helpUri":"https://codehealth.canine.dev/dimensions/D17"},{"id":"D18","name":"Solution Shape","shortDescription":{"text":"Solution Shape"},"helpUri":"https://codehealth.canine.dev/dimensions/D18"},{"id":"D19","name":"Documentation Quality","shortDescription":{"text":"Documentation Quality"},"helpUri":"https://codehealth.canine.dev/dimensions/D19"},{"id":"D20","name":"ADR Quality","shortDescription":{"text":"ADR Quality"},"helpUri":"https://codehealth.canine.dev/dimensions/D20"},{"id":"D21","name":"Naming Consistency","shortDescription":{"text":"Naming Consistency"},"helpUri":"https://codehealth.canine.dev/dimensions/D21"},{"id":"D24","name":"Comment Value","shortDescription":{"text":"Comment Value"},"helpUri":"https://codehealth.canine.dev/dimensions/D24"},{"id":"D25","name":"ADR Conformance","shortDescription":{"text":"ADR Conformance"},"helpUri":"https://codehealth.canine.dev/dimensions/D25"},{"id":"D26","name":"Project Cohesion","shortDescription":{"text":"Project Cohesion"},"helpUri":"https://codehealth.canine.dev/dimensions/D26"},{"id":"D27","name":"Navigability","shortDescription":{"text":"Navigability"},"helpUri":"https://codehealth.canine.dev/dimensions/D27"},{"id":"D28","name":"Secrets (history)","shortDescription":{"text":"Secrets (history)"},"helpUri":"https://codehealth.canine.dev/dimensions/D28","relationships":[{"target":{"id":"CWE-798","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-259","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]}],"properties":{"cwe":["CWE-798","CWE-259"]}},{"id":"D29","name":"Static Analysis (SAST)","shortDescription":{"text":"Static Analysis (SAST)"},"helpUri":"https://codehealth.canine.dev/dimensions/D29","relationships":[{"target":{"id":"CWE-79","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-89","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-78","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-94","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-77","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]}],"properties":{"cwe":["CWE-79","CWE-89","CWE-78","CWE-94","CWE-77"]}},{"id":"D31","name":"IaC \u0026 Container Security","shortDescription":{"text":"IaC \u0026 Container Security"},"helpUri":"https://codehealth.canine.dev/dimensions/D31","relationships":[{"target":{"id":"CWE-1032","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-732","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]},{"target":{"id":"CWE-16","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},"kinds":["relevant"]}],"properties":{"cwe":["CWE-1032","CWE-732","CWE-16"]}},{"id":"D34","name":"Knowledge Freshness","shortDescription":{"text":"Knowledge Freshness"},"helpUri":"https://codehealth.canine.dev/dimensions/D34"},{"id":"D35","name":"Change Coupling","shortDescription":{"text":"Change Coupling"},"helpUri":"https://codehealth.canine.dev/dimensions/D35"}]}},"results":[{"ruleId":"D4","level":"warning","message":{"text":"Duplicated block (9 lines \u00D7 3): src/Starter/Contracts/EventBus/Persistent/ContractsOutboxWorker.cs:18-26 | src/Starter/Offers/EventBus/Persistent/OffersOutboxWorker.cs:19-27 | src/Starter/Passes/EventBus/Persistent/PassesOutboxWorker.cs:20-28 \u2014 the copies span different directories, so extracting a shared function means choosing where it lives: put it somewhere all 3 call sites can already reach \u2014 a location they all depend on today, or a new shared one if there is none \u2014 and call it from each site; until then, every change has to be made 3 times. Read the line range as the matched WINDOW rather than a finished unit: at \u0060src/Starter/Contracts/EventBus/Persistent/ContractsOutboxWorker.cs:18\u0060 it begins part-way through the construct above it, so those exact lines cannot be lifted as they stand \u2014 widen the region to the smallest complete statement or declaration that contains it, and extract that."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/Starter/Contracts/EventBus/Persistent/ContractsOutboxWorker.cs"},"region":{"startLine":18}}}],"partialFingerprints":{"codehealthFindingId/v1":"4aeaeb9ee20f20727d77edd2284902f201ec189d7275759a604cafb4857eb401"}},{"ruleId":"D5","level":"warning","message":{"text":"Off the main sequence: Starter.Common: Starter.Common: abstractness 0.17, instability 0.00, distance 0.83 \u2014 the shape a shared-kernel / building-block library has BY DESIGN \u2014 concrete and widely depended-on is what makes it useful, and this dimension does not penalise it (the distance is reported for completeness, not as a defect). Worth a look only if it has grown past one coherent kernel into an everything-bucket."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"697aa3f56b289b861f2f39c9de5951b3e7ca32f9dd41323f060e0a4acb299f4d"}},{"ruleId":"D12","level":"error","message":{"text":"Vulnerable: OpenTelemetry.Exporter.OpenTelemetryProtocol: OpenTelemetry.Exporter.OpenTelemetryProtocol 1.10.0 \u2014 Moderate severity. https://github.com/advisories/[GHSA redacted]"},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"b2ae471f3f46f8e0ebd7a2b459bd973c6817dbb6b5f84135c5c19d9a005499a4"}},{"ruleId":"D12","level":"error","message":{"text":"Vulnerable: MailKit: MailKit 4.8.0 \u2014 Moderate severity. https://github.com/advisories/[GHSA redacted]"},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"ad4f2a38eb922510975ba7d88a44c631589975067536fd77080a53584f6d1380"}},{"ruleId":"D12","level":"warning","message":{"text":"Deprecated: FluentValidation.AspNetCore: FluentValidation.AspNetCore 11.3.0 \u2014 Legacy"},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"c121fe39eaa15140bc3e6db44975ad976f90ca0ef505592ab96df7811261bcf1"}},{"ruleId":"D12","level":"warning","message":{"text":"Deprecated: Microsoft.IdentityModel.Abstractions: Microsoft.IdentityModel.Abstractions 7.4.0 \u2014 Legacy"},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"28eb7484ef95cbc43ed1f2e4306d941ddaceb4ed707e14ada9551befef380192"}},{"ruleId":"D12","level":"warning","message":{"text":"Deprecated: Microsoft.IdentityModel.JsonWebTokens: Microsoft.IdentityModel.JsonWebTokens 7.4.0 \u2014 Legacy"},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"2571ab845af878e02115fe880b6c06959d575e4d543f21a8731d086a0640c005"}},{"ruleId":"D12","level":"warning","message":{"text":"Deprecated: Microsoft.IdentityModel.Logging: Microsoft.IdentityModel.Logging 7.4.0 \u2014 Legacy"},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"0d0ce789aa38d9247d6f0649735a0aaeb2bce4dc3494fb72bf9447164dcee404"}},{"ruleId":"D12","level":"warning","message":{"text":"Deprecated: Microsoft.IdentityModel.Protocols: Microsoft.IdentityModel.Protocols 7.4.0 \u2014 Legacy"},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"2a035d8d110965f643378972a7d2fedb1dded172a83cd7c4388d9a4d8fe12be9"}},{"ruleId":"D12","level":"warning","message":{"text":"Deprecated: Microsoft.IdentityModel.Protocols.OpenIdConnect: Microsoft.IdentityModel.Protocols.OpenIdConnect 7.4.0 \u2014 Legacy,CriticalBugs"},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"f8a45861927b9700985696763af8f258743a725257013009006b5e42788ec01f"}},{"ruleId":"D12","level":"warning","message":{"text":"Deprecated: Microsoft.IdentityModel.Tokens: Microsoft.IdentityModel.Tokens 7.4.0 \u2014 Legacy"},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"b70d0defafe70817061da00bcd869f5476cf3ba93fdebc03fec715defec785e9"}},{"ruleId":"D12","level":"warning","message":{"text":"Deprecated: System.IdentityModel.Tokens.Jwt: System.IdentityModel.Tokens.Jwt 7.4.0 \u2014 Legacy"},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"5e25a2addd53321a5f56d70917c9cacbd45ad10a65768c7f7d77713591bd3d37"}},{"ruleId":"D12","level":"warning","message":{"text":"Deprecated: xunit: xunit 2.9.2 \u2014 Legacy \u2014 the publisher\u0027s replacement is \u0060xunit.v3\u0060; migrate the reference to it."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"d37c8c0e8046c9e8358e976373216abfb78e9fdef63ed53d3edcaa7d2238edcd"}},{"ruleId":"D12","level":"warning","message":{"text":"Deprecated: Verify.Xunit: Verify.Xunit 28.4.0 \u2014 Legacy \u2014 the publisher\u0027s replacement is \u0060Verify.XunitV3\u0060; migrate the reference to it."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"bf99145017f5a240a4ba5d7c5c05d1cac881add7f172454bff7084cffedda576"}},{"ruleId":"D12","level":"warning","message":{"text":"Deprecated: Microsoft.AspNetCore.Mvc.ApiExplorer: Microsoft.AspNetCore.Mvc.ApiExplorer 2.2.0 \u2014 Other,Legacy"},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"43ca266b1fc6920bc691dabdc31575f523d98361b1b4fba717675fd1e2bacfc0"}},{"ruleId":"D12","level":"warning","message":{"text":"Prerelease dependency: OpenTelemetry.Exporter.Prometheus.AspNetCore: OpenTelemetry.Exporter.Prometheus.AspNetCore resolves to 1.8.0-rc.1, a prerelease build. Prerelease packages carry no support policy, may change breaking between previews and can be unlisted \u2014 pin a stable release before shipping, or record the reason this preview is required."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"374a942dab3621b8f5d661aa15ff3ab19650b896e978375b911ad7a29c15a9ba"}},{"ruleId":"D13","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"cbf4fb29f4da9cea95f23e9f0b88721b128cbd2d7c47b23ec8015c6e07644fad"},"taxa":[{"id":"CWE-259","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}},{"id":"CWE-798","toolComponent":{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d"}}]},{"ruleId":"D14","level":"error","message":{"text":"Banned license: SonarAnalyzer.CSharp: SonarAnalyzer.CSharp 9.32.0.97167 is licensed LGPL-3.0-only (banned by policy)."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"b7d0f7ddc58416ee4550f6aa0ccea13bc0c1edc17b74880969f7028b82f43680"}},{"ruleId":"D16","level":"warning","message":{"text":"dormant codebase \u2014 no living knowledge left to concentrate: All 5 significant source file(s) were last meaningfully changed so long ago that no living knowledge remains \u2014 nothing since has been substantial enough to re-establish ownership (a broad, mechanical sweep that touches many files shallowly does not count, and neither does no activity at all). There is no concentration to measure, so the bus factor is not scored. This is not a clean bill: nobody currently holds working knowledge of this code (see D34 Knowledge Freshness)."},"locations":[],"partialFingerprints":{"codehealthFindingId/v1":"569d55ea5cb0330f13c125b289d07e5abdfcceac947a2c2645277937942e7d5f"}},{"ruleId":"D17","level":"warning","message":{"text":"BarePragmaDisable: #pragma warning disable S6966 \u2014 the disable has no matching restore, so it does not end with the construct that needed it: it runs to the end of the file and silences the rule for everything written below, including code added years later. Close it with the matching restore directive immediately after the construct it covers, or fix the cause and drop the directive entirely."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/Starter/Program.cs"},"region":{"startLine":56}}}],"partialFingerprints":{"codehealthFindingId/v1":"ed366aa0b78ad2155ce2a3cc04ea1a73023adbb3f3b519b8d47243703faf1b7d"}},{"ruleId":"D17","level":"warning","message":{"text":"Dead code: SetFakeSystemClock: Method SetFakeSystemClock \u2014 no references found in solution."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/Starter.IntegrationTests/Common/TestEngine/Configuration/ConfigurationExtensions.cs"},"region":{"startLine":45}}}],"partialFingerprints":{"codehealthFindingId/v1":"7b8525ef3939d76a5234db395951f587c957c6576946cde35a31bb4efcfcdd6b"}},{"ruleId":"D19","level":"note","message":{"text":"The Getting Started section omits a prerequisite for Keycloak authentication, which is critical to local development and appears in the Local Development Guide link.: Add a Prerequisites subsection under Getting Started noting that Docker Compose must be configured with Keycloak credentials (or an environment variable) so the up command runs successfully."},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"README.adoc"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"d8564167ad9fe8bdb43dd25da3ceda5c6af6d6cca8d487b6de3d672cac1271e6"}},{"ruleId":"D20","level":"warning","message":{"text":"No context/problem and no consequences for not recording decisions (e.g. lost or duplicated work) are stated: Add a Context section explaining why records matter (e.g. prevents duplication, clarifies intent) and a Consequences section on the cost of not recording (lost traceability, hard to refactor against)"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"docs/ArchitectureDecisionLog/0001-record-architecture-decisions.adoc"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"e4732028e9f687d725afdaaa4dc67902d6bb2446ad60df72e28740d62c693e24"}},{"ruleId":"D20","level":"warning","message":{"text":"Decision is generic (\u0027We decided to use Docker\u0027) with no context (why not a different container platform) or trade-offs beyond the listed consequences: State why Docker was chosen over alternatives and note the trade-offs: learning curve for new developers, dependency versioning complexity, and the cost of maintaining an image repository"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"docs/ArchitectureDecisionLog/0006-use-docker.adoc"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"e7e01f4b5f9dd2eeddff11d543c65c5fbe9ce8be218a1fdc86eae8b45dae20f9"}},{"ruleId":"D24","level":"note","message":{"text":"redundant comment: \u0022Global using directives\u0022 \u2014 delete - the comment restates the global directive block"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/Starter.Common/GlobalUsings.cs"},"region":{"startLine":1}}}],"partialFingerprints":{"codehealthFindingId/v1":"ba8e06e9e567c2298e17fcc1052f9ca106019aabf6c53a489ece642e65d1fef8"}},{"ruleId":"D24","level":"note","message":{"text":"redundant comment: \u0022Formatting numbers, dates, etc.\u0022 \u2014 delete - already obvious from the opts comment"},"locations":[{"physicalLocation":{"artifactLocation":{"uri":"src/Starter.Common/Localizations/LocalizationModule.cs"},"region":{"startLine":27}}}],"partialFingerprints":{"codehealthFindingId/v1":"ddfa1ff096f5b1298c23ee08acaa9ca87faea36b56a8abb5804990b5efa774b2"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"da20373b3d1f143bec689694404ed00481c8f92fa567edf0d3208d69afc0aa91"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"3f8265a51da24e68b1eeb307438787edcd455f1e2dc09b85d55dd61c0dfaaaf8"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"6974b61f9c5730a93d073e9c25e122e93dfc9cabc4b93965e28366bfd524bdd0"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"78f85a8c23ba9a679f79d5383208181ed0cf571cb61bda31026e971612e81711"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"0ca0e2b961190ba3d6613e5364fbbd614510ba96b2421b24e32fecc86466c1ec"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"ec07b24c24aee22e7eed77d75704a0a8ef5a5a5b956d7a1522f771aa1997aee4"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"15dcdff9a8ade2b3ab8005ae1de3c3795d1be1751b94f05e39b37188b4aa7674"}},{"ruleId":"D28","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"731fd8486f8946a1fa04ddb4cebffce7f09c3328bbcaae79d56a9e2b5cb07ede"}},{"ruleId":"D28","level":"note","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"3cdfd7beb31b791ae18dcb425e21eb157c842e7bbcd522cc330573c1a6538db1"}},{"ruleId":"D31","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"7a38d802a1ca375a747dc0707f4bd1f525f0ef12185730a5617e206cf4795188"}},{"ruleId":"D31","level":"error","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"479d2d6173d88c0b6a96997c62fb037be243a83d0658fd548548426751a09f79"}},{"ruleId":"D31","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"b7f78311f4647e28229cd2a79e31c2b052e3feffe74f5fc670a2b2b5da227d27"}},{"ruleId":"D31","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"0a94ec224b8c56d23d52f539747662ead566f92c3be92d600a1d9772084df513"}},{"ruleId":"D31","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"e27f5ab033192bca6d03a90660d5f483a3bc7e375f27df82225fdc9133818a0a"}},{"ruleId":"D31","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"bd4bc63a7067c69a8b5824f3b2fab6cc3adeb78ffaf5930d760e853bafb42392"}},{"ruleId":"D31","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"948e0ba2bc6bf38236944611d7b5d3ca8c7641fbafbf31e971713ed322148e1c"}},{"ruleId":"D31","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"b4c0589b581fab039cd434d7c7eb52e2378266ede42fc714c84f2df4da38969b"}},{"ruleId":"D31","level":"warning","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"babd32345a5a5b7ff630e0aee7098765c8df5570b6c5f81ad0fc77bf7cded7e7"}},{"ruleId":"D31","level":"note","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"f21fb46433b6ad6d99fd016641f15ba3a9f49569520c7e2f675d02b3b1273407"}},{"ruleId":"D31","level":"note","message":{"text":"A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."},"partialFingerprints":{"codehealthFindingId/v1":"980bc9e56918449dc3e81a39374cdc4e647e59987109c008bea6a0b0f6b7915a"}}],"taxonomies":[{"name":"CWE","guid":"c3a2b1d0-7f3e-4b2a-9c1d-5e6f7a8b9c0d","organization":"MITRE","informationUri":"https://cwe.mitre.org/","isComprehensive":false,"shortDescription":{"text":"The MITRE Common Weakness Enumeration (CWE)."},"taxa":[{"id":"CWE-1032","guid":"5f21e517-68aa-a650-9a25-5771ef024637","name":"OWASP Top Ten \u2014 Security Misconfiguration category","shortDescription":{"text":"OWASP Top Ten \u2014 Security Misconfiguration category"},"helpUri":"https://cwe.mitre.org/data/definitions/1032.html"},{"id":"CWE-16","guid":"659db3ea-affc-8453-8add-c1218fbfcb92","name":"Configuration","shortDescription":{"text":"Configuration"},"helpUri":"https://cwe.mitre.org/data/definitions/16.html"},{"id":"CWE-259","guid":"ae9ad959-fbb6-9d5e-892d-3dca66da0b69","name":"Use of Hard-coded Password","shortDescription":{"text":"Use of Hard-coded Password"},"helpUri":"https://cwe.mitre.org/data/definitions/259.html"},{"id":"CWE-732","guid":"1da27e8f-b330-7650-ab63-bd61953eae5d","name":"Incorrect Permission Assignment for Critical Resource","shortDescription":{"text":"Incorrect Permission Assignment for Critical Resource"},"helpUri":"https://cwe.mitre.org/data/definitions/732.html"},{"id":"CWE-77","guid":"332c8ade-6612-9f56-a06b-d8d90b1a8750","name":"Command Injection","shortDescription":{"text":"Command Injection"},"helpUri":"https://cwe.mitre.org/data/definitions/77.html"},{"id":"CWE-78","guid":"2e31ceaf-c7ae-2e5e-9661-cfb1362789cf","name":"OS Command Injection","shortDescription":{"text":"OS Command Injection"},"helpUri":"https://cwe.mitre.org/data/definitions/78.html"},{"id":"CWE-79","guid":"fd45580b-e8c4-fc5e-8c2f-aa8fab0b4dbf","name":"Cross-site Scripting (XSS)","shortDescription":{"text":"Cross-site Scripting (XSS)"},"helpUri":"https://cwe.mitre.org/data/definitions/79.html"},{"id":"CWE-798","guid":"5e8f057d-fee3-995a-a0cb-9fc5b0d174d1","name":"Use of Hard-coded Credentials","shortDescription":{"text":"Use of Hard-coded Credentials"},"helpUri":"https://cwe.mitre.org/data/definitions/798.html"},{"id":"CWE-89","guid":"6d08fdad-37eb-c150-bbf0-d7d946863407","name":"SQL Injection","shortDescription":{"text":"SQL Injection"},"helpUri":"https://cwe.mitre.org/data/definitions/89.html"},{"id":"CWE-94","guid":"75e7f50c-6c2f-dd52-bf40-bf6c52b861fd","name":"Code Injection","shortDescription":{"text":"Code Injection"},"helpUri":"https://cwe.mitre.org/data/definitions/94.html"}]}],"properties":{"codehealthPublication":{"public":true,"notice":"This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings \u2014 which rule fired, in which file, on which line, and how to fix it \u2014 are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.","securityFindingsRedacted":21,"secretScannerRunsExcluded":0}},"redactionTokens":["A security finding was recorded here. Its details are withheld on the public artifact \u2014 ask the repository owner for the full report."]}]}