{
  "schema_version": "scan_result.v1",
  "scan_id": "b76120f2",
  "project_name": "venruk",
  "timestamp": "2026-06-27T12:52:13.913035+00:00",
  "scan_started_at": "2026-06-27T12:52:13.656991+00:00",
  "scan_completed_at": "2026-06-27T12:52:13.913035+00:00",
  "duration_seconds": 0.26,
  "scan_mode": "quick",
  "profile": null,
  "files_scanned": 6,
  "lines_scanned": 6,
  "languages": [
    "python"
  ],
  "frameworks": [],
  "scanners_run": [
    "secrets",
    "quality",
    "sast",
    "dependencies"
  ],
  "scores": {
    "security": 76.0,
    "quality": 100.0,
    "maintainability": 100.0,
    "architecture": 55.0,
    "compliance": 100.0,
    "overall": 86.0,
    "grade": "A"
  },
  "summary": {
    "total": 6,
    "critical": 3,
    "high": 3,
    "medium": 0,
    "low": 0,
    "info": 0
  },
  "findings": [
    {
      "schema_version": "finding.v1",
      "id": "CC-CRY-001",
      "title": "Hardcoded Credential \u2014 variable `API_KEY`",
      "description": "Variable `API_KEY` is assigned a hardcoded string literal.
Credentials in source code are exposed in version control and build artifacts.",
      "severity": "high",
      "category": "security",
      "confidence": "high",
      "location": {
        "file": "packages/worker/app.py",
        "start_line": 2,
        "end_line": 2,
        "start_col": 0,
        "end_col": 16,
        "snippet": null
      },
      "rule_id": "CC-CRY-001",
      "scanner": "sast",
      "cwe_id": "CWE-798",
      "owasp_id": "A07:2021",
      "cvss_score": null,
      "fix_suggestion": "Load `API_KEY` from an environment variable: 
`os.environ.get('API_KEY')`",
      "fix_diff": null,
      "effort_minutes": null,
      "references": [],
      "tags": [],
      "metadata": {
        "ownership_resolution_method": "Fallback",
        "reachability": {
          "status": "unknown",
          "confidence": "LOW",
          "entrypoint_ids": [],
          "attack_path_ids": [],
          "unresolved_call_count": 0,
          "analysis_version": "reachability.v2"
        }
      },
      "ai_status": null,
      "ai_confidence": null,
      "ai_reasoning": null,
      "is_root_cause": false,
      "related_findings": [],
      "owner": "Unknown",
      "fingerprint": "d26770c3f53d2f59",
      "timestamp": "2026-06-27T12:52:13.679926+00:00"
    },
    {
      "schema_version": "finding.v1",
      "id": "CC-CRY-001",
      "title": "Hardcoded Credential \u2014 variable `API_KEY`",
      "description": "Variable `API_KEY` is assigned a hardcoded string literal.
Credentials in source code are exposed in version control and build artifacts.",
      "severity": "high",
      "category": "security",
      "confidence": "high",
      "location": {
        "file": "packages/shared/app.py",
        "start_line": 2,
        "end_line": 2,
        "start_col": 0,
        "end_col": 16,
        "snippet": null
      },
      "rule_id": "CC-CRY-001",
      "scanner": "sast",
      "cwe_id": "CWE-798",
      "owasp_id": "A07:2021",
      "cvss_score": null,
      "fix_suggestion": "Load `API_KEY` from an environment variable: 
`os.environ.get('API_KEY')`",
      "fix_diff": null,
      "effort_minutes": null,
      "references": [],
      "tags": [],
      "metadata": {
        "ownership_resolution_method": "Fallback",
        "reachability": {
          "status": "unknown",
          "confidence": "LOW",
          "entrypoint_ids": [],
          "attack_path_ids": [],
          "unresolved_call_count": 0,
          "analysis_version": "reachability.v2"
        }
      },
      "ai_status": null,
      "ai_confidence": null,
      "ai_reasoning": null,
      "is_root_cause": false,
      "related_findings": [],
      "owner": "Unknown",
      "fingerprint": "0a6bc72dc59b22f4",
      "timestamp": "2026-06-27T12:52:13.679951+00:00"
    },
    {
      "schema_version": "finding.v1",
      "id": "CC-CRY-001",
      "title": "Hardcoded Credential \u2014 variable `API_KEY`",
      "description": "Variable `API_KEY` is assigned a hardcoded string literal.
Credentials in source code are exposed in version control and build artifacts.",
      "severity": "high",
      "category": "security",
      "confidence": "high",
      "location": {
        "file": "packages/api/app.py",
        "start_line": 2,
        "end_line": 2,
        "start_col": 0,
        "end_col": 16,
        "snippet": null
      },
      "rule_id": "CC-CRY-001",
      "scanner": "sast",
      "cwe_id": "CWE-798",
      "owasp_id": "A07:2021",
      "cvss_score": null,
      "fix_suggestion": "Load `API_KEY` from an environment variable: 
`os.environ.get('API_KEY')`",
      "fix_diff": null,
      "effort_minutes": null,
      "references": [],
      "tags": [],
      "metadata": {
        "ownership_resolution_method": "Fallback",
        "reachability": {
          "status": "unknown",
          "confidence": "LOW",
          "entrypoint_ids": [],
          "attack_path_ids": [],
          "unresolved_call_count": 0,
          "analysis_version": "reachability.v2"
        }
      },
      "ai_status": null,
      "ai_confidence": null,
      "ai_reasoning": null,
      "is_root_cause": false,
      "related_findings": [],
      "owner": "Unknown",
      "fingerprint": "04d3d8fd548068d6",
      "timestamp": "2026-06-27T12:52:13.679978+00:00"
    },
    {
      "schema_version": "finding.v1",
      "id": "ARCH-CHOKE-file:packages/worker/app.py",
      "title": "High-Risk Chokepoint: file:packages/worker/app.py",
      "description": "This FILE is depended upon by 1 components but contains a 
vulnerability: Hardcoded Credential \u2014 variable `API_KEY`.",
      "severity": "critical",
      "category": "architecture",
      "confidence": "high",
      "location": {
        "file": "file:packages/worker/app.py",
        "start_line": 1,
        "end_line": 1,
        "start_col": null,
        "end_col": null,
        "snippet": ""
      },
      "rule_id": "ARCH-CHOKEPOINT",
      "scanner": "tech-debt",
      "cwe_id": "",
      "owasp_id": "",
      "cvss_score": null,
      "fix_suggestion": null,
      "fix_diff": null,
      "effort_minutes": null,
      "references": [],
      "tags": [],
      "metadata": {
        "ownership_resolution_method": "Fallback"
      },
      "ai_status": null,
      "ai_confidence": null,
      "ai_reasoning": null,
      "is_root_cause": false,
      "related_findings": [],
      "owner": "Unknown",
      "fingerprint": "45fa01d524d25412",
      "timestamp": "2026-06-27T12:52:13.844397+00:00"
    },
    {
      "schema_version": "finding.v1",
      "id": "ARCH-CHOKE-file:packages/shared/app.py",
      "title": "High-Risk Chokepoint: file:packages/shared/app.py",
      "description": "This FILE is depended upon by 1 components but contains a 
vulnerability: Hardcoded Credential \u2014 variable `API_KEY`.",
      "severity": "critical",
      "category": "architecture",
      "confidence": "high",
      "location": {
        "file": "file:packages/shared/app.py",
        "start_line": 1,
        "end_line": 1,
        "start_col": null,
        "end_col": null,
        "snippet": ""
      },
      "rule_id": "ARCH-CHOKEPOINT",
      "scanner": "tech-debt",
      "cwe_id": "",
      "owasp_id": "",
      "cvss_score": null,
      "fix_suggestion": null,
      "fix_diff": null,
      "effort_minutes": null,
      "references": [],
      "tags": [],
      "metadata": {
        "ownership_resolution_method": "Fallback"
      },
      "ai_status": null,
      "ai_confidence": null,
      "ai_reasoning": null,
      "is_root_cause": false,
      "related_findings": [],
      "owner": "Unknown",
      "fingerprint": "a1284fdf921c4071",
      "timestamp": "2026-06-27T12:52:13.844428+00:00"
    },
    {
      "schema_version": "finding.v1",
      "id": "ARCH-CHOKE-file:packages/api/app.py",
      "title": "High-Risk Chokepoint: file:packages/api/app.py",
      "description": "This FILE is depended upon by 1 components but contains a 
vulnerability: Hardcoded Credential \u2014 variable `API_KEY`.",
      "severity": "critical",
      "category": "architecture",
      "confidence": "high",
      "location": {
        "file": "file:packages/api/app.py",
        "start_line": 1,
        "end_line": 1,
        "start_col": null,
        "end_col": null,
        "snippet": ""
      },
      "rule_id": "ARCH-CHOKEPOINT",
      "scanner": "tech-debt",
      "cwe_id": "",
      "owasp_id": "",
      "cvss_score": null,
      "fix_suggestion": null,
      "fix_diff": null,
      "effort_minutes": null,
      "references": [],
      "tags": [],
      "metadata": {
        "ownership_resolution_method": "Fallback"
      },
      "ai_status": null,
      "ai_confidence": null,
      "ai_reasoning": null,
      "is_root_cause": false,
      "related_findings": [],
      "owner": "Unknown",
      "fingerprint": "82c78f8eb4992548",
      "timestamp": "2026-06-27T12:52:13.844442+00:00"
    }
  ],
  "metadata": {
    "risk_attribution": {
      "Unknown": {
        "critical": 3,
        "high": 3,
        "medium": 0,
        "low": 0,
        "info": 0,
        "total_findings": 6,
        "risk_score": 69.0,
        "blast_radius_services": 0
      }
    },
    "reachability": {
      "schema_version": "reachability.v1",
      "entrypoints_detected": 0,
      "findings_analyzed": 1,
      "findings_reachable": 0,
      "findings_unreachable": 0,
      "findings_unknown": 1,
      "attack_paths_total": 0,
      "attack_paths_max_length": 0,
      "attack_paths_min_length": 0,
      "entrypoints_used": 0,
      "unresolved_calls": 0
    },
    "ownership": {
      "schema_version": "ownership.v1",
      "unique_owners": 0,
      "findings_with_owner": 0,
      "findings_without_owner": 6
    },
    "risk_attribution_v2": {
      "schema_version": "risk_attribution_v2.v1",
      "findings_scope": "scanner_findings_only",
      "owners": {
        "Unknown": {
          "reachable_findings": 0,
          "unreachable_findings": 0,
          "unknown_findings": 3,
          "not_analyzed_findings": 0,
          "attack_path_count": 0,
          "total_findings": 3,
          "risk_score": 24.0
        }
      }
    },
    "attack_paths": {
      "schema_version": "attack_paths.v1",
      "entrypoints": [],
      "attack_paths": [],
      "finding_meta": {
        "CC-CRY-001": {
          "finding_id": "CC-CRY-001",
          "status": "unknown",
          "confidence": "LOW",
          "entrypoint_ids": [],
          "attack_path_ids": [],
          "unresolved_call_count": 0,
          "analysis_version": "reachability.v2"
        }
      },
      "stats": {
        "entrypoints": 0,
        "attack_paths": 0,
        "unresolved_calls": 0,
        "findings_analyzed": 1,
        "findings_reachable": 0,
        "findings_unreachable": 0,
        "findings_unknown": 1
      },
      "node_locations": {},
      "limits_hit": {},
      "finding_diagnostics": {
        "CC-CRY-001": {
          "finding_id": "CC-CRY-001",
          "entrypoints_checked": 0,
          "nodes_visited": 0,
          "hard_gaps_in_scope": 0,
          "soft_gaps_in_scope": 0,
          "depth_limit_hit": false,
          "ghost_entrypoints_skipped": 0,
          "target_callables_found": 0,
          "ambiguous_aliases_in_resolution": 0
        }
      },
      "analysis_complete": true
    },
    "pipeline": {
      "schema_version": "pipeline.v1",
      "stages": {
        "discovery": {
          "duration_ms": 23.02,
          "status": "success"
        },
        "scanning": {
          "duration_ms": 56.24,
          "status": "success"
        },
        "correlation": {
          "duration_ms": 1.76,
          "status": "success"
        },
        "graph": {
          "duration_ms": 11.33,
          "status": "success"
        },
        "enrichment": {
          "duration_ms": 74.64,
          "status": "success"
        },
        "risk": {
          "duration_ms": 19.51,
          "status": "success"
        }
      },
      "total_duration_ms": 186.7
    }
  }
}
