| { |
| "schema": "membra.systemlake.risk_register.v1", |
| "generated_at": "2026-06-21T18:27:21.352197", |
| "risks": [ |
| { |
| "system": "Downloads", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "Downloads", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "agent-workforce", |
| "risk_type": "secret_leak", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "real", |
| "description": "Exposed secrets or credentials detected", |
| "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager." |
| }, |
| { |
| "system": "agent-workforce", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "agent-workforce", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "agent-workforce", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "agent-workforce", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "api", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "api", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "api", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "api", |
| "risk_type": "prototype_sprawl", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "false_positive", |
| "description": "Prototype sprawl \u2014 too few or too many files", |
| "remediation": "Consolidate or document the system scope." |
| }, |
| { |
| "system": "api", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "api_integration_system", |
| "risk_type": "secret_leak", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "real", |
| "description": "Exposed secrets or credentials detected", |
| "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager." |
| }, |
| { |
| "system": "api_integration_system", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "api_integration_system", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "api_integration_system", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "api_integration_system", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "autonomous-cleanstat-agent", |
| "risk_type": "secret_leak", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "real", |
| "description": "Exposed secrets or credentials detected", |
| "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager." |
| }, |
| { |
| "system": "autonomous-cleanstat-agent", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "autonomous-cleanstat-agent", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "autonomous-cleanstat-agent", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "backend", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "backend", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "bitcoin-bearer-notes", |
| "risk_type": "secret_leak", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "real", |
| "description": "Exposed secrets or credentials detected", |
| "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager." |
| }, |
| { |
| "system": "bitcoin-bearer-notes", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "bitcoin-bearer-notes", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "bitcoin-bearer-notes", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "bitcoin-bearer-notes", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "chat-provenance-api", |
| "risk_type": "secret_leak", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "real", |
| "description": "Exposed secrets or credentials detected", |
| "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager." |
| }, |
| { |
| "system": "chat-provenance-api", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "chat-provenance-api", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "chat-provenance-api", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "chat-provenance-api", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "cleanstat-autonomous-agent", |
| "risk_type": "secret_leak", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "real", |
| "description": "Exposed secrets or credentials detected", |
| "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager." |
| }, |
| { |
| "system": "cleanstat-autonomous-agent", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "cleanstat-autonomous-agent", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "cleanstat-autonomous-agent", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "cleanstat-autonomous-agent", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "cleanstat-infrastructure", |
| "risk_type": "secret_leak", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "real", |
| "description": "Exposed secrets or credentials detected", |
| "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager." |
| }, |
| { |
| "system": "cleanstat-infrastructure", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "cleanstat-infrastructure", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "cleanstat-infrastructure", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "cleanstat-infrastructure", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "config_data_files", |
| "risk_type": "secret_leak", |
| "severity": "low", |
| "haircut": 9.0, |
| "classification": "real", |
| "description": "Exposed secrets or credentials detected", |
| "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager." |
| }, |
| { |
| "system": "config_data_files", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "config_data_files", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "config_data_files", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "decloud", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "decloud", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "decloud", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "docs", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "docs", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "docs", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "docs", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "field-triage-app", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "field-triage-app", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "field-triage-app", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "field-triage-app", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "files", |
| "risk_type": "secret_leak", |
| "severity": "low", |
| "haircut": 3.0, |
| "classification": "real", |
| "description": "Exposed secrets or credentials detected", |
| "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager." |
| }, |
| { |
| "system": "files", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "files", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "files", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "files_cpp", |
| "risk_type": "secret_leak", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "real", |
| "description": "Exposed secrets or credentials detected", |
| "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager." |
| }, |
| { |
| "system": "files_cpp", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "files_cpp", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "frontend", |
| "risk_type": "secret_leak", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "real", |
| "description": "Exposed secrets or credentials detected", |
| "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager." |
| }, |
| { |
| "system": "frontend", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "frontend", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "ios", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "ios", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "ios", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "ios", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "kamino-flash-executor", |
| "risk_type": "secret_leak", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "real", |
| "description": "Exposed secrets or credentials detected", |
| "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager." |
| }, |
| { |
| "system": "kamino-flash-executor", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "kamino-flash-executor", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "kamino-flash-executor", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "kamino-flash-executor", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "live-kamino-jupiter-flash-arb", |
| "risk_type": "secret_leak", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "real", |
| "description": "Exposed secrets or credentials detected", |
| "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager." |
| }, |
| { |
| "system": "live-kamino-jupiter-flash-arb", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "live-kamino-jupiter-flash-arb", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "live-kamino-jupiter-flash-arb", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "live-kamino-jupiter-flash-arb", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "mac_compute_node", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "mac_compute_node", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "mac_compute_node", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "mac_compute_node", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "membra-ads", |
| "risk_type": "secret_leak", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "real", |
| "description": "Exposed secrets or credentials detected", |
| "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager." |
| }, |
| { |
| "system": "membra-ads", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "membra-ads", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "membra-ads", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "membra-ads", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "membra-bridge-ecosystem", |
| "risk_type": "secret_leak", |
| "severity": "medium", |
| "haircut": 11, |
| "classification": "real", |
| "description": "Exposed secrets or credentials detected", |
| "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager." |
| }, |
| { |
| "system": "membra-bridge-ecosystem", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "membra-bridge-ecosystem", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "membra-bridge-ecosystem", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "membra-bridge-ecosystem", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "membra-economics", |
| "risk_type": "secret_leak", |
| "severity": "high", |
| "haircut": 30, |
| "classification": "real", |
| "description": "Exposed secrets or credentials detected", |
| "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager." |
| }, |
| { |
| "system": "membra-economics", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "membra-economics", |
| "risk_type": "pii_sensitive_data", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "real", |
| "description": "PII or sensitive data files present", |
| "remediation": "Remove or encrypt PII files. Add to .gitignore." |
| }, |
| { |
| "system": "membra-economics", |
| "risk_type": "prototype_sprawl", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "false_positive", |
| "description": "Prototype sprawl \u2014 too few or too many files", |
| "remediation": "Consolidate or document the system scope." |
| }, |
| { |
| "system": "membra-ecosystem", |
| "risk_type": "secret_leak", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "real", |
| "description": "Exposed secrets or credentials detected", |
| "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager." |
| }, |
| { |
| "system": "membra-ecosystem", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "membra-ecosystem", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "membra-ecosystem", |
| "risk_type": "pii_sensitive_data", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "real", |
| "description": "PII or sensitive data files present", |
| "remediation": "Remove or encrypt PII files. Add to .gitignore." |
| }, |
| { |
| "system": "membra-ecosystem", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "membra-kpi-mobile", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "membra-kpi-mobile", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "membra-kpi-mobile", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "membra-kpi-mobile", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "membra-l3", |
| "risk_type": "secret_leak", |
| "severity": "low", |
| "haircut": 3.0, |
| "classification": "real", |
| "description": "Exposed secrets or credentials detected", |
| "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager." |
| }, |
| { |
| "system": "membra-l3", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "membra-l3", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "membra-l3", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "membra-l3", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "membra-operator", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "membra-operator", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "membra-operator", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "membra-qr-gateway", |
| "risk_type": "secret_leak", |
| "severity": "low", |
| "haircut": 6.0, |
| "classification": "real", |
| "description": "Exposed secrets or credentials detected", |
| "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager." |
| }, |
| { |
| "system": "membra-qr-gateway", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "membra-qr-gateway", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "membra-semantic-consensus", |
| "risk_type": "secret_leak", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "real", |
| "description": "Exposed secrets or credentials detected", |
| "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager." |
| }, |
| { |
| "system": "membra-semantic-consensus", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "membra-semantic-consensus", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "membra_mobile", |
| "risk_type": "secret_leak", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "real", |
| "description": "Exposed secrets or credentials detected", |
| "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager." |
| }, |
| { |
| "system": "membra_mobile", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "membra_mobile", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "membra_mobile", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "membramoney", |
| "risk_type": "secret_leak", |
| "severity": "high", |
| "haircut": 30, |
| "classification": "real", |
| "description": "Exposed secrets or credentials detected", |
| "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager." |
| }, |
| { |
| "system": "membramoney", |
| "risk_type": "pii_sensitive_data", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "real", |
| "description": "PII or sensitive data files present", |
| "remediation": "Remove or encrypt PII files. Add to .gitignore." |
| }, |
| { |
| "system": "membramoney", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "overmanifold", |
| "risk_type": "secret_leak", |
| "severity": "medium", |
| "haircut": 18, |
| "classification": "real", |
| "description": "Exposed secrets or credentials detected", |
| "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager." |
| }, |
| { |
| "system": "overmanifold", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "overmanifold", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "overmanifold", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "protocol", |
| "risk_type": "secret_leak", |
| "severity": "low", |
| "haircut": 3.0, |
| "classification": "real", |
| "description": "Exposed secrets or credentials detected", |
| "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager." |
| }, |
| { |
| "system": "protocol", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "protocol", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "protocol", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "protocol", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "setup_installation_systems", |
| "risk_type": "secret_leak", |
| "severity": "low", |
| "haircut": 6.0, |
| "classification": "real", |
| "description": "Exposed secrets or credentials detected", |
| "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager." |
| }, |
| { |
| "system": "setup_installation_systems", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "setup_installation_systems", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "setup_installation_systems", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "sniffies-rentals", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "sniffies-rentals", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "sniffies-rentals", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "sniffies-rentals", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "solana-staking-tracker", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "solana-staking-tracker", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "solana-staking-tracker", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "solana-staking-tracker", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "terminal_agent", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "terminal_agent", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "terminal_agent", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "terminal_agent", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "veis", |
| "risk_type": "secret_leak", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "real", |
| "description": "Exposed secrets or credentials detected", |
| "remediation": "Remove .env files and secrets from repo. Use environment variables or secret manager." |
| }, |
| { |
| "system": "veis", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "veis", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "veis", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "veis", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| }, |
| { |
| "system": "winserv_chatgpt_automation", |
| "risk_type": "missing_license", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No license file found \u2014 IP clarity unclear", |
| "remediation": "Add LICENSE file (MIT, Apache-2.0, or proprietary)." |
| }, |
| { |
| "system": "winserv_chatgpt_automation", |
| "risk_type": "no_tests", |
| "severity": "medium", |
| "haircut": 10, |
| "classification": "missing_evidence", |
| "description": "No test coverage \u2014 functionality unverified", |
| "remediation": "Add test files (test_*.py or *.test.js). Run pytest or jest." |
| }, |
| { |
| "system": "winserv_chatgpt_automation", |
| "risk_type": "no_receipts", |
| "severity": "low", |
| "haircut": 8, |
| "classification": "missing_evidence", |
| "description": "No execution receipts \u2014 claims unverifiable", |
| "remediation": "Generate execution receipts for build/test/deploy commands." |
| }, |
| { |
| "system": "winserv_chatgpt_automation", |
| "risk_type": "dependency_vulnerability", |
| "severity": "low", |
| "haircut": 5, |
| "classification": "missing_evidence", |
| "description": "No lockfile \u2014 dependency versions not pinned", |
| "remediation": "Add lockfile (requirements.txt with --hash-args, package-lock.json, or Pipfile.lock)." |
| } |
| ], |
| "total_risks": 164, |
| "high_severity": 2, |
| "medium_severity": 36, |
| "low_severity": 126 |
| } |
