{
  "repositoryName": "achieveradarsh/realtimechat",
  "overallScore": 71,
  "scanDate": "2026-07-20T04:23:34.354Z",
  "totalTests": 18,
  "summary": {
    "passed": 3,
    "warnings": 13,
    "failed": 2,
    "errors": 0
  },
  "results": [
    {
      "testSuiteId": "build-verification",
      "status": "WARN",
      "message": "No supported build manifest found for npm, Maven, Gradle, Cargo, dotnet, or Go.",
      "severity": "low",
      "executionTime": 12199,
      "testName": "Suite 1 - Build Verification",
      "sectionName": "Quality"
    },
    {
      "testSuiteId": "static-code-quality",
      "status": "WARN",
      "message": "ESLint reported issues.",
      "severity": "medium",
      "details": {
        "eslint": "Oops! Something went wrong! :(\n\nESLint: 10.6.0\n\nYou are linting \".\", but all of the files matching the glob pattern \".\" are ignored.\n\nIf you don't want to lint these files, remove the pattern \".\" from the list of arguments passed to ESLint.\n\nIf you do want to lint these files, explicitly list one or more of the files from this glob that you'd like to lint to see more details about why they are ignored.\n\n  * If the file is ignored because of a matching ignore pattern, check global ignores in your config file.\n    https://eslint.org/docs/latest/use/configure/ignore\n\n  * If the file is ignored because no matching configuration was supplied, check file patterns in your config file.\n    https://eslint.org/docs/latest/use/configure/configuration-files#specify-files-with-arbitrary-extensions\n\n  * If the file is ignored because it is located outside of the base path, change the location of your config file to be in a parent directory.",
        "staticScan": {
          "scannedFiles": 10,
          "codeSmellCount": 6,
          "unsafeAnyCount": 1,
          "duplicatedSymbolCount": 14
        }
      },
      "executionTime": 4898,
      "testName": "Suite 2 - Static Code Quality",
      "sectionName": "Quality"
    },
    {
      "testSuiteId": "testing",
      "status": "WARN",
      "message": "No runnable test script was found for Jest, Vitest, Playwright, Cypress, or coverage.",
      "severity": "medium",
      "details": {
        "availableScripts": [
          "start",
          "dev"
        ]
      },
      "executionTime": 0,
      "testName": "Suite 3 - Testing",
      "sectionName": "Quality"
    },
    {
      "testSuiteId": "sast",
      "status": "FAIL",
      "message": "Fallback SAST scan found high-risk code patterns.",
      "severity": "critical",
      "details": {
        "findings": [
          {
            "name": "Unsafe eval",
            "count": 0,
            "severity": "high"
          },
          {
            "name": "Command execution",
            "count": 0,
            "severity": "high"
          },
          {
            "name": "SQL string construction",
            "count": 2,
            "severity": "high"
          },
          {
            "name": "Weak crypto",
            "count": 0,
            "severity": "medium"
          },
          {
            "name": "Prototype pollution sink",
            "count": 0,
            "severity": "medium"
          },
          {
            "name": "Path traversal risk",
            "count": 10,
            "severity": "medium"
          }
        ],
        "scannedFiles": 10
      },
      "executionTime": 91,
      "testName": "Suite 4 - SAST",
      "sectionName": "Security"
    },
    {
      "testSuiteId": "secret-detection",
      "status": "PASS",
      "message": "Fallback secret scan did not find known secret patterns.",
      "severity": "medium",
      "details": {
        "envFiles": [],
        "findings": [
          {
            "name": "AWS access key",
            "count": 0
          },
          {
            "name": "OpenAI key",
            "count": 0
          },
          {
            "name": "Private key",
            "count": 0
          },
          {
            "name": "JWT",
            "count": 0
          },
          {
            "name": "Generic secret assignment",
            "count": 0
          }
        ],
        "scannedFiles": 13,
        "includeGitHistory": false
      },
      "executionTime": 84,
      "testName": "Suite 5 - Secret Detection",
      "sectionName": "Security"
    },
    {
      "testSuiteId": "dependency-security",
      "status": "FAIL",
      "message": "Dependency audit reported vulnerable packages.",
      "severity": "critical",
      "details": {
        "tool": "npm audit",
        "output": "{\n  \"auditReportVersion\": 2,\n  \"vulnerabilities\": {\n    \"nodemailer\": {\n      \"name\": \"nodemailer\",\n      \"severity\": \"high\",\n      \"isDirect\": true,\n      \"via\": [\n        {\n          \"source\": 1109804,\n          \"name\": \"nodemailer\",\n          \"dependency\": \"nodemailer\",\n          \"title\": \"Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict\",\n          \"url\": \"https://github.com/advisories/GHSA-mm7p-fcc7-pg87\",\n          \"severity\": \"moderate\",\n          \"cwe\": [\n            \"CWE-20\",\n            \"CWE-436\"\n          ],\n          \"cvss\": {\n            \"score\": 0,\n            \"vectorString\": null\n          },\n          \"range\": \"<7.0.7\"\n        },\n        {\n          \"source\": 1115470,\n          \"name\": \"nodemailer\",\n          \"dependency\": \"nodemailer\",\n          \"title\": \"Nodemailer has SMTP command injection due to unsanitized `envelope.size` parameter\",\n          \"url\": \"https://github.com/advisories/GHSA-c7w3-x93f-qmm8\",\n          \"severity\": \"low\",\n          \"cwe\": [\n            \"CWE-93\"\n          ],\n          \"cvss\": {\n            \"score\": 0,\n            \"vectorString\": null\n          },\n          \"range\": \"<8.0.4\"\n        },\n        {\n          \"source\": 1116270,\n          \"name\": \"nodemailer\",\n          \"dependency\": \"nodemailer\",\n          \"title\": \"Nodemailer Vulnerable to SMTP Command Injection via CRLF in Transport name Option (EHLO/HELO) \",\n          \"url\": \"https://github.com/advisories/GHSA-vvjj-xcjg-gr5g\",\n          \"severity\": \"moderate\",\n          \"cwe\": [\n            \"CWE-93\"\n          ],\n          \"cvss\": {\n            \"score\": 4.9,\n            \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N\"\n          },\n          \"range\": \"<=8.0.4\"\n        },\n        {\n          \"source\": 1120795,\n          \"name\": \"nodemailer\",\n          \"dependency\": \"nodemailer\",\n          \"title\": \"Nodemailer: CRLF injection in Nodemailer List-* header comments allows arbitrary message header injection\",\n          \"url\": \"https://github.com/advisories/GHSA-268h-hp4c-crq3\",\n          \"severity\": \"moderate\",\n          \"cwe\": [\n            \"CWE-93\"\n          ],\n          \"cvss\": {\n            \"score\": 5.4,\n            \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\"\n          },\n          \"range\": \"<=8.0.8\"\n        },\n        {\n          \"source\": 1120796,\n          \"name\": \"nodemailer\",\n          \"dependency\": \"nodemailer\",\n          \"title\": \"Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization\",\n          \"url\": \"https://github.com/advisories/GHSA-wqvq-jvpq-h66f\",\n          \"severity\": \"moderate\",\n          \"cwe\": [\n            \"CWE-862\"\n          ],\n          \"cvss\": {\n            \"score\": 5.4,\n            \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N\"\n          },\n          \"range\": \"<=8.0.8\"\n        },\n        {\n          \"source\": 1120797,\n          \"name\": \"nodemailer\",\n          \"dependency\": \"nodemailer\",\n          \"title\": \"Nodemailer: Improper TLS Certificate Validation in OAuth2 Token Fetch Enables Credential Interception\",\n          \"url\": \"https://github.com/advisories/GHSA-r7g4-qg5f-qqm2\",\n          \"severity\": \"moderate\",\n          \"cwe\": [\n            \"CWE-295\"\n          ],\n          \"cvss\": {\n            \"score\": 6.5,\n            \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N\"\n          },\n          \"range\": \"<=8.0.7\"\n        },\n        {\n          \"source\": 1121191,\n          \"name\": \"nodemailer\",\n          \"dependency\": \"nodemailer\",\n          \"title\": \"Nodemailer: Message-level raw option bypasses disableFileAccess/disableUrlAccess, enabling arbitrary file read and full-response SSRF in the delivered message\",\n          \"url\": \"https://github.com/advisories/GHSA-p6gq-j5cr-w38f\",\n          \"severity\": \"high\",\n          \"cwe\": [\n            \"CWE-73\",\n            \"CWE-918\"\n          ],\n          \"cvss\": {\n            \"score\": 7.1,\n            \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR"
      },
      "executionTime": 1699,
      "testName": "Suite 6 - Dependency Security",
      "sectionName": "Security"
    },
    {
      "testSuiteId": "web-application-security",
      "status": "WARN",
      "message": "Custom web security rules found missing or undiscovered controls.",
      "severity": "medium",
      "details": {
        "hasCsp": false,
        "missing": [
          "hasCsp",
          "hasCsrfToken",
          "hasSecureCookie"
        ],
        "hasCsrfToken": false,
        "hasRateLimit": true,
        "scannedFiles": 13,
        "hasCorsConfig": true,
        "hasAuthzChecks": true,
        "hasSecureCookie": false
      },
      "executionTime": 48,
      "testName": "Suite 7 - Web Application Security",
      "sectionName": "Security"
    },
    {
      "testSuiteId": "api-security",
      "status": "PASS",
      "message": "API security rules found core validation and authorization signals.",
      "severity": "medium",
      "details": {
        "missing": [
          "hasGraphql"
        ],
        "hasGraphql": false,
        "openApiFiles": [],
        "scannedFiles": 13,
        "hasJwtValidation": true,
        "hasInputValidation": true,
        "hasObjectAuthorization": true
      },
      "executionTime": 8,
      "testName": "Suite 8 - API Security",
      "sectionName": "Security"
    },
    {
      "testSuiteId": "git-history-secrets",
      "status": "WARN",
      "message": "No .git directory found, so historical secret scanning could not run.",
      "severity": "medium",
      "executionTime": 0,
      "testName": "Suite 9 - Secrets in Git History",
      "sectionName": "Security"
    },
    {
      "testSuiteId": "container-security",
      "status": "WARN",
      "message": "No Dockerfile was found, so container security checks could not run.",
      "severity": "low",
      "details": {
        "dockerfiles": []
      },
      "executionTime": 1,
      "testName": "Suite 10 - Container Security",
      "sectionName": "Infrastructure"
    },
    {
      "testSuiteId": "infrastructure-as-code",
      "status": "WARN",
      "message": "No Terraform, Kubernetes, Helm, or Docker Compose files were found.",
      "severity": "low",
      "executionTime": 2,
      "testName": "Suite 11 - Infrastructure as Code",
      "sectionName": "Infrastructure"
    },
    {
      "testSuiteId": "ci-cd-security",
      "status": "WARN",
      "message": "No GitHub Actions, Azure DevOps, Jenkins, or GitLab CI definitions were found.",
      "severity": "low",
      "executionTime": 1,
      "testName": "Suite 12 - CI/CD Security",
      "sectionName": "Infrastructure"
    },
    {
      "testSuiteId": "network-readiness",
      "status": "WARN",
      "message": "No network configuration files or authorized runtime target were provided.",
      "severity": "low",
      "details": {
        "note": "Runtime Nmap or SSL analysis requires an explicit authorized target.",
        "weakTls": false,
        "openPorts": [],
        "hasDnsConfig": false,
        "scannedFiles": [],
        "publicExposure": false,
        "hasReverseProxy": false,
        "hasCertificateFiles": false
      },
      "executionTime": 1,
      "testName": "Suite 13 - Network Readiness",
      "sectionName": "Infrastructure"
    },
    {
      "testSuiteId": "repository-architecture",
      "status": "WARN",
      "message": "Architecture scan found folder-structure or layer-boundary risks.",
      "severity": "medium",
      "details": {
        "dddSignals": [],
        "scannedFiles": 10,
        "topLevelDirs": [
          "config",
          "middleware",
          "models",
          "routes"
        ],
        "layerViolations": [],
        "microserviceSignals": [],
        "cleanArchitectureSignals": []
      },
      "executionTime": 6,
      "testName": "Suite 14 - Repository Architecture",
      "sectionName": "Architecture"
    },
    {
      "testSuiteId": "frontend-security",
      "status": "WARN",
      "message": "Frontend scan found CSP, source map, backend URL, or debug endpoint gaps.",
      "severity": "medium",
      "details": {
        "hasCsp": false,
        "envFiles": [],
        "backendUrls": 0,
        "scannedFiles": 0,
        "debugEndpoints": 0,
        "exposedEnvFiles": [],
        "dangerousDomApis": 0,
        "publicSecretNames": 0,
        "sourceMapsEnabled": false
      },
      "executionTime": 9,
      "testName": "Suite 15 - Frontend Security",
      "sectionName": "Architecture"
    },
    {
      "testSuiteId": "backend-security",
      "status": "PASS",
      "message": "Backend scan found core backend security controls or no obvious gaps.",
      "severity": "medium",
      "details": {
        "missing": [
          "hasAuthorization",
          "hasRateLimiting"
        ],
        "hasLogging": true,
        "scannedFiles": 4,
        "hasMiddleware": true,
        "hasValidation": true,
        "hasRateLimiting": false,
        "hasAuthorization": false,
        "hasAuthentication": true,
        "hasExceptionHandling": true
      },
      "executionTime": 6,
      "testName": "Suite 16 - Backend Security",
      "sectionName": "Architecture"
    },
    {
      "testSuiteId": "data-layer",
      "status": "WARN",
      "message": "Data layer scan found missing ORM, pooling, or encryption signals.",
      "severity": "medium",
      "details": {
        "hasOrm": true,
        "hasPooling": false,
        "scannedFiles": 10,
        "hasEncryption": false,
        "databaseExposure": 0,
        "rawSqlConstruction": 0
      },
      "executionTime": 5,
      "testName": "Suite 17 - Data Layer",
      "sectionName": "Architecture"
    },
    {
      "testSuiteId": "cloud-architecture",
      "status": "WARN",
      "message": "No AWS, Azure, or GCP architecture artifacts were found.",
      "severity": "low",
      "executionTime": 2,
      "testName": "Suite 18 - Cloud Architecture",
      "sectionName": "Architecture"
    }
  ]
}