{
  "repositoryName": "achieveradarsh/schedula-app-model",
  "overallScore": 70,
  "scanDate": "2026-07-25T14:21:29.664Z",
  "totalTests": 18,
  "summary": {
    "passed": 4,
    "warnings": 11,
    "failed": 3,
    "errors": 0
  },
  "results": [
    {
      "testSuiteId": "build-verification",
      "status": "FAIL",
      "message": "Build failed with compilation or runtime build errors.",
      "severity": "high",
      "details": {
        "output": "spawn pnpm ENOENT",
        "runner": "pnpm",
        "command": "pnpm run build",
        "aiDiagnosis": {
          "reason": "openai/gpt-oss-120b: fetch failed | google/gemma-4-31B-it: fetch failed | deepseek-ai/DeepSeek-R1-Distill-Qwen-32B: fetch failed",
          "available": false,
          "modelsAttempted": [
            "openai/gpt-oss-120b",
            "google/gemma-4-31B-it",
            "deepseek-ai/DeepSeek-R1-Distill-Qwen-32B"
          ]
        },
        "runtimeDependencyInstall": {
          "output": "spawn pnpm ENOENT",
          "command": "pnpm install --ignore-scripts --no-frozen-lockfile",
          "attempted": true,
          "installed": false,
          "missingTool": true
        }
      },
      "executionTime": 46,
      "testName": "Suite 1 - Build Verification",
      "sectionName": "Quality"
    },
    {
      "testSuiteId": "static-code-quality",
      "status": "WARN",
      "message": "Lint script failed. TypeScript compiler reported errors. Fallback static scan found elevated smell, any-type, or duplicate-symbol counts.",
      "severity": "medium",
      "details": {
        "lint": "spawn pnpm ENOENT",
        "staticScan": {
          "scannedFiles": 105,
          "codeSmellCount": 13,
          "unsafeAnyCount": 65,
          "duplicatedSymbolCount": 126
        },
        "typescript": "npm error code ENOENT\nnpm error syscall mkdir\nnpm error path /home/sbx_user1051\nnpm error errno ENOENT\nnpm error enoent Invalid response body while trying to fetch https://registry.npmjs.org/tsc: ENOENT: no such file or directory, mkdir '/home/sbx_user1051'\nnpm error enoent This is related to npm not being able to find a file.\nnpm error enoent\nnpm error Log files were not written due to an error writing to the directory: /home/sbx_user1051/.npm/_logs\nnpm error You can rerun the command with `--loglevel=verbose` to see the logs in your terminal"
      },
      "executionTime": 1071,
      "testName": "Suite 2 - Static Code Quality",
      "sectionName": "Quality"
    },
    {
      "testSuiteId": "testing",
      "status": "WARN",
      "message": "No runnable test script was found for Jest, Vitest, Playwright, Cypress, or coverage.",
      "severity": "medium",
      "details": {
        "availableScripts": [
          "build",
          "dev",
          "lint",
          "start"
        ]
      },
      "executionTime": 0,
      "testName": "Suite 3 - Testing",
      "sectionName": "Quality"
    },
    {
      "testSuiteId": "sast",
      "status": "FAIL",
      "message": "Fallback SAST scan found high-risk code patterns.",
      "severity": "critical",
      "details": {
        "findings": [
          {
            "name": "Unsafe eval",
            "count": 0,
            "severity": "high"
          },
          {
            "name": "Command execution",
            "count": 0,
            "severity": "high"
          },
          {
            "name": "SQL string construction",
            "count": 22,
            "severity": "high"
          },
          {
            "name": "Weak crypto",
            "count": 0,
            "severity": "medium"
          },
          {
            "name": "Prototype pollution sink",
            "count": 0,
            "severity": "medium"
          },
          {
            "name": "Path traversal risk",
            "count": 0,
            "severity": "medium"
          }
        ],
        "scannedFiles": 103
      },
      "executionTime": 23,
      "testName": "Suite 4 - SAST",
      "sectionName": "Security"
    },
    {
      "testSuiteId": "secret-detection",
      "status": "PASS",
      "message": "Fallback secret scan did not find known secret patterns.",
      "severity": "medium",
      "details": {
        "envFiles": [],
        "findings": [
          {
            "name": "AWS access key",
            "count": 0
          },
          {
            "name": "OpenAI key",
            "count": 0
          },
          {
            "name": "Private key",
            "count": 0
          },
          {
            "name": "JWT",
            "count": 0
          },
          {
            "name": "Generic secret assignment",
            "count": 0
          }
        ],
        "scannedFiles": 109,
        "includeGitHistory": false
      },
      "executionTime": 14,
      "testName": "Suite 5 - Secret Detection",
      "sectionName": "Security"
    },
    {
      "testSuiteId": "dependency-security",
      "status": "WARN",
      "message": "pnpm audit could not be started on this machine.",
      "severity": "medium",
      "details": {
        "tool": "pnpm audit",
        "output": "spawn pnpm ENOENT"
      },
      "executionTime": 3,
      "testName": "Suite 6 - Dependency Security",
      "sectionName": "Security"
    },
    {
      "testSuiteId": "web-application-security",
      "status": "WARN",
      "message": "Custom web security rules found missing or undiscovered controls.",
      "severity": "medium",
      "details": {
        "hasCsp": false,
        "missing": [
          "hasCsp",
          "hasCorsConfig",
          "hasCsrfToken",
          "hasRateLimit",
          "hasSecureCookie"
        ],
        "hasCsrfToken": false,
        "hasRateLimit": false,
        "scannedFiles": 108,
        "hasCorsConfig": false,
        "hasAuthzChecks": true,
        "hasSecureCookie": false
      },
      "executionTime": 30,
      "testName": "Suite 7 - Web Application Security",
      "sectionName": "Security"
    },
    {
      "testSuiteId": "api-security",
      "status": "WARN",
      "message": "API security rules found missing or undiscovered JWT, authorization, or validation controls.",
      "severity": "medium",
      "details": {
        "missing": [
          "hasJwtValidation",
          "hasGraphql"
        ],
        "hasGraphql": false,
        "openApiFiles": [],
        "scannedFiles": 109,
        "hasJwtValidation": false,
        "hasInputValidation": true,
        "hasObjectAuthorization": true
      },
      "executionTime": 16,
      "testName": "Suite 8 - API Security",
      "sectionName": "Security"
    },
    {
      "testSuiteId": "git-history-secrets",
      "status": "WARN",
      "message": "No .git directory found, so historical secret scanning could not run.",
      "severity": "medium",
      "executionTime": 0,
      "testName": "Suite 9 - Secrets in Git History",
      "sectionName": "Security"
    },
    {
      "testSuiteId": "container-security",
      "status": "WARN",
      "message": "No Dockerfile was found, so container security checks could not run.",
      "severity": "low",
      "details": {
        "dockerfiles": []
      },
      "executionTime": 2,
      "testName": "Suite 10 - Container Security",
      "sectionName": "Infrastructure"
    },
    {
      "testSuiteId": "infrastructure-as-code",
      "status": "PASS",
      "message": "Fallback IaC scan found no obvious infrastructure risks.",
      "severity": "medium",
      "details": {
        "helmFiles": [],
        "composeFiles": [],
        "scannedFiles": 1,
        "riskyPatterns": [
          {
            "name": "Privileged containers",
            "count": 0
          },
          {
            "name": "Host networking",
            "count": 0
          },
          {
            "name": "Latest image tags",
            "count": 0
          },
          {
            "name": "Public ingress CIDR",
            "count": 0
          },
          {
            "name": "Plaintext secret resources",
            "count": 0
          }
        ],
        "terraformFiles": [],
        "kubernetesFiles": []
      },
      "executionTime": 7,
      "testName": "Suite 11 - Infrastructure as Code",
      "sectionName": "Infrastructure"
    },
    {
      "testSuiteId": "ci-cd-security",
      "status": "WARN",
      "message": "No GitHub Actions, Azure DevOps, Jenkins, or GitLab CI definitions were found.",
      "severity": "low",
      "executionTime": 2,
      "testName": "Suite 12 - CI/CD Security",
      "sectionName": "Infrastructure"
    },
    {
      "testSuiteId": "network-readiness",
      "status": "PASS",
      "message": "Static network readiness scan found no obvious network risks.",
      "severity": "medium",
      "details": {
        "note": "Runtime Nmap or SSL analysis requires an explicit authorized target.",
        "weakTls": false,
        "openPorts": [],
        "hasDnsConfig": false,
        "scannedFiles": [
          "pnpm-lock.yaml"
        ],
        "publicExposure": false,
        "hasReverseProxy": false,
        "hasCertificateFiles": false
      },
      "executionTime": 2,
      "testName": "Suite 13 - Network Readiness",
      "sectionName": "Infrastructure"
    },
    {
      "testSuiteId": "repository-architecture",
      "status": "PASS",
      "message": "Architecture scan found organized repository structure and no obvious layer violations.",
      "severity": "medium",
      "details": {
        "dddSignals": [],
        "scannedFiles": 103,
        "topLevelDirs": [
          "app",
          "components",
          "hooks",
          "lib",
          "public",
          "services",
          "store",
          "styles",
          "types"
        ],
        "layerViolations": [],
        "microserviceSignals": [],
        "cleanArchitectureSignals": []
      },
      "executionTime": 11,
      "testName": "Suite 14 - Repository Architecture",
      "sectionName": "Architecture"
    },
    {
      "testSuiteId": "frontend-security",
      "status": "FAIL",
      "message": "Frontend scan found exposed env, public secret, or dangerous DOM API risks.",
      "severity": "high",
      "details": {
        "hasCsp": false,
        "envFiles": [],
        "backendUrls": 0,
        "scannedFiles": 95,
        "debugEndpoints": 0,
        "exposedEnvFiles": [],
        "dangerousDomApis": 1,
        "publicSecretNames": 0,
        "sourceMapsEnabled": false
      },
      "executionTime": 9,
      "testName": "Suite 15 - Frontend Security",
      "sectionName": "Architecture"
    },
    {
      "testSuiteId": "backend-security",
      "status": "WARN",
      "message": "Backend scan found missing or undiscovered security controls.",
      "severity": "medium",
      "details": {
        "missing": [
          "hasMiddleware",
          "hasAuthentication",
          "hasAuthorization",
          "hasRateLimiting"
        ],
        "hasLogging": true,
        "scannedFiles": 5,
        "hasMiddleware": false,
        "hasValidation": true,
        "hasRateLimiting": false,
        "hasAuthorization": false,
        "hasAuthentication": false,
        "hasExceptionHandling": true
      },
      "executionTime": 12,
      "testName": "Suite 16 - Backend Security",
      "sectionName": "Architecture"
    },
    {
      "testSuiteId": "data-layer",
      "status": "WARN",
      "message": "Data layer scan found missing ORM, pooling, or encryption signals.",
      "severity": "medium",
      "details": {
        "hasOrm": false,
        "hasPooling": false,
        "scannedFiles": 105,
        "hasEncryption": true,
        "databaseExposure": 0,
        "rawSqlConstruction": 0
      },
      "executionTime": 10,
      "testName": "Suite 17 - Data Layer",
      "sectionName": "Architecture"
    },
    {
      "testSuiteId": "cloud-architecture",
      "status": "WARN",
      "message": "No AWS, Azure, or GCP architecture artifacts were found.",
      "severity": "low",
      "executionTime": 1,
      "testName": "Suite 18 - Cloud Architecture",
      "sectionName": "Architecture"
    }
  ]
}