Synthetic sample. Harbor Ledger is a fictional app. This is not a customer report and not a live review.

{
  "engagementId": "demo-engagement",
  "generatedAt": "2026-09-12T15:00:00.000Z",
  "rubricVersion": "release-rescue-rubric/v1",
  "scope": {
    "repositoryRef": "harbor-labs/harbor-ledger",
    "commitSha": "4f1c2a9e7b83d05e61af2c48d7be9013a5c6f27b",
    "defaultBranch": "main",
    "usesAiFeatures": true,
    "handlesCustomerData": true,
    "triggersExternalActions": true,
    "exclusionCount": 1,
    "aiAssistedReviewAccepted": true
  },
  "verdict": "release_blocked",
  "verdictHeadline": "Blocked",
  "verdictExplanation": "At least one confirmed finding on a release-gating check. We recommend resolving these before you ship.",
  "severityCounts": {
    "critical": 0,
    "high": 4,
    "medium": 1,
    "low": 0,
    "informational": 0
  },
  "blockingFindingCount": 3,
  "coverage": {
    "assessedChecks": 32,
    "totalChecks": 32,
    "notAssessedChecks": 0
  },
  "dimensions": [
    {
      "dimension": "secrets_and_credentials",
      "title": "Secrets and credentials",
      "totalChecks": 3,
      "assessedChecks": 3,
      "passedChecks": 3,
      "concernChecks": 0,
      "failedChecks": 0,
      "notApplicableChecks": 0,
      "notAssessedChecks": 0,
      "findingCount": 0
    },
    {
      "dimension": "authentication_and_session",
      "title": "Authentication and session",
      "totalChecks": 3,
      "assessedChecks": 3,
      "passedChecks": 3,
      "concernChecks": 0,
      "failedChecks": 0,
      "notApplicableChecks": 0,
      "notAssessedChecks": 0,
      "findingCount": 0
    },
    {
      "dimension": "authorization_and_tenancy",
      "title": "Authorization and tenancy",
      "totalChecks": 3,
      "assessedChecks": 3,
      "passedChecks": 2,
      "concernChecks": 0,
      "failedChecks": 1,
      "notApplicableChecks": 0,
      "notAssessedChecks": 0,
      "findingCount": 1
    },
    {
      "dimension": "ai_boundary",
      "title": "AI boundary",
      "totalChecks": 4,
      "assessedChecks": 4,
      "passedChecks": 3,
      "concernChecks": 0,
      "failedChecks": 1,
      "notApplicableChecks": 0,
      "notAssessedChecks": 0,
      "findingCount": 1
    },
    {
      "dimension": "data_handling_and_retention",
      "title": "Data handling and retention",
      "totalChecks": 3,
      "assessedChecks": 3,
      "passedChecks": 3,
      "concernChecks": 0,
      "failedChecks": 0,
      "notApplicableChecks": 0,
      "notAssessedChecks": 0,
      "findingCount": 0
    },
    {
      "dimension": "input_validation_and_abuse",
      "title": "Input validation and abuse",
      "totalChecks": 2,
      "assessedChecks": 2,
      "passedChecks": 2,
      "concernChecks": 0,
      "failedChecks": 0,
      "notApplicableChecks": 0,
      "notAssessedChecks": 0,
      "findingCount": 0
    },
    {
      "dimension": "dependency_and_supply_chain",
      "title": "Dependencies and supply chain",
      "totalChecks": 1,
      "assessedChecks": 1,
      "passedChecks": 0,
      "concernChecks": 0,
      "failedChecks": 1,
      "notApplicableChecks": 0,
      "notAssessedChecks": 0,
      "findingCount": 1
    },
    {
      "dimension": "release_operations",
      "title": "Release operations",
      "totalChecks": 3,
      "assessedChecks": 3,
      "passedChecks": 2,
      "concernChecks": 0,
      "failedChecks": 1,
      "notApplicableChecks": 0,
      "notAssessedChecks": 0,
      "findingCount": 1
    },
    {
      "dimension": "observability_and_incident_response",
      "title": "Observability and incident response",
      "totalChecks": 2,
      "assessedChecks": 2,
      "passedChecks": 1,
      "concernChecks": 0,
      "failedChecks": 1,
      "notApplicableChecks": 0,
      "notAssessedChecks": 0,
      "findingCount": 1
    },
    {
      "dimension": "accessibility",
      "title": "Accessibility",
      "totalChecks": 3,
      "assessedChecks": 3,
      "passedChecks": 3,
      "concernChecks": 0,
      "failedChecks": 0,
      "notApplicableChecks": 0,
      "notAssessedChecks": 0,
      "findingCount": 0
    },
    {
      "dimension": "code_quality_and_tests",
      "title": "Code quality and tests",
      "totalChecks": 3,
      "assessedChecks": 3,
      "passedChecks": 3,
      "concernChecks": 0,
      "failedChecks": 0,
      "notApplicableChecks": 0,
      "notAssessedChecks": 0,
      "findingCount": 0
    },
    {
      "dimension": "documentation_and_handover",
      "title": "Documentation and handover",
      "totalChecks": 2,
      "assessedChecks": 2,
      "passedChecks": 2,
      "concernChecks": 0,
      "failedChecks": 0,
      "notApplicableChecks": 0,
      "notAssessedChecks": 0,
      "findingCount": 0
    }
  ],
  "findings": [
    {
      "id": "RR-001",
      "dimension": "authorization_and_tenancy",
      "dimensionTitle": "Authorization and tenancy",
      "checkTitle": "Object-level authorization is enforced on every access path",
      "severity": "high",
      "blocking": true,
      "confidence": "confirmed",
      "title": "A record is loaded by identifier without checking who is asking",
      "whatWeObserved": "The path below selects a record using an identifier taken from the request, without restricting the query to the authenticated caller.",
      "whyItMatters": "Any signed-in customer who changes the identifier reads another customer's record. This is the most common way customer data leaves a young application.",
      "recommendation": "Scope the lookup by the authenticated caller, so an identifier from the request cannot select a record the caller does not own.",
      "locations": [
        {
          "path": "src/app/expenses/[id]/page.tsx",
          "lineRange": "lines 18–27"
        },
        {
          "path": "src/lib/claims.ts",
          "lineRange": "lines 44–51"
        }
      ],
      "evidence": [
        {
          "kind": "code_reference",
          "path": "src/lib/claims.ts",
          "lineRange": "lines 44–51"
        }
      ],
      "effort": "small",
      "inRemediationSprintScope": true,
      "residualUncertainty": null
    },
    {
      "id": "RR-002",
      "dimension": "ai_boundary",
      "dimensionTitle": "AI boundary",
      "checkTitle": "Tool and action authority is bounded and explicit",
      "severity": "high",
      "blocking": true,
      "confidence": "confirmed",
      "title": "A tool the model can call has no declared limit",
      "whatWeObserved": "A tool reachable by the model has no explicit statement of what it may and may not do, enforced outside the model.",
      "whyItMatters": "An undeclared limit is not a limit. The model decides, and the model can be steered by whatever it reads.",
      "recommendation": "Declare, per tool, what it may do and what it may never do, and enforce that list outside the model.",
      "locations": [
        {
          "path": "src/lib/assistant/tools.ts",
          "lineRange": "lines 61–88"
        }
      ],
      "evidence": [
        {
          "kind": "code_reference",
          "path": "src/lib/assistant/tools.ts",
          "lineRange": "lines 61–88"
        }
      ],
      "effort": "medium",
      "inRemediationSprintScope": true,
      "residualUncertainty": null
    },
    {
      "id": "RR-003",
      "dimension": "release_operations",
      "dimensionTitle": "Release operations",
      "checkTitle": "Production is separated from development and preview",
      "severity": "high",
      "blocking": true,
      "confidence": "confirmed",
      "title": "Preview or development shares production credentials",
      "whatWeObserved": "The reviewed snapshot uses the same credentials or data store for production and for a non-production environment.",
      "whyItMatters": "A preview deployment is the least guarded thing you run. Sharing production credentials with it makes it the way in.",
      "recommendation": "Give preview and development environments their own credentials and their own data, so a preview cannot reach production.",
      "locations": [
        {
          "path": "vercel.json",
          "lineRange": "lines 4–9"
        }
      ],
      "evidence": [
        {
          "kind": "configuration_reference",
          "path": "vercel.json",
          "lineRange": "lines 4–9"
        }
      ],
      "effort": "medium",
      "inRemediationSprintScope": true,
      "residualUncertainty": null
    },
    {
      "id": "RR-004",
      "dimension": "dependency_and_supply_chain",
      "dimensionTitle": "Dependencies and supply chain",
      "checkTitle": "No known-vulnerable dependency on a reachable path",
      "severity": "high",
      "blocking": false,
      "confidence": "likely",
      "title": "A dependency with a known advisory is on a reachable path",
      "whatWeObserved": "A dependency in the reviewed manifest has a published advisory and is reachable from the critical workflow.",
      "whyItMatters": "A published advisory is a public instruction for exploiting it. Reachability is what turns it from noise into exposure.",
      "recommendation": "Upgrade the dependency to a version without the known advisory, or replace it if no fixed version exists.",
      "locations": [
        {
          "path": "package.json",
          "lineRange": "line 31"
        }
      ],
      "evidence": [
        {
          "kind": "dependency_manifest_reference",
          "path": "package.json",
          "lineRange": "line 31"
        }
      ],
      "effort": "small",
      "inRemediationSprintScope": true,
      "residualUncertainty": "The path appears reachable only under conditions this review did not exercise."
    },
    {
      "id": "RR-005",
      "dimension": "observability_and_incident_response",
      "dimensionTitle": "Observability and incident response",
      "checkTitle": "Errors and logs do not leak secrets or customer data",
      "severity": "medium",
      "blocking": false,
      "confidence": "confirmed",
      "title": "Logs or errors carry secrets or customer data",
      "whatWeObserved": "Log or error output in the reviewed snapshot includes credential material or customer data.",
      "whyItMatters": "Logs travel further than the systems that wrote them, into third-party tools and support tickets, and they are rarely deleted.",
      "recommendation": "Remove credentials and customer data from log and error output before it leaves the process.",
      "locations": [
        {
          "path": "src/app/expenses/error.tsx",
          "lineRange": "lines 8–14"
        }
      ],
      "evidence": [
        {
          "kind": "code_reference",
          "path": "src/app/expenses/error.tsx",
          "lineRange": "lines 8–14"
        }
      ],
      "effort": "small",
      "inRemediationSprintScope": true,
      "residualUncertainty": null
    }
  ],
  "remediationSprint": {
    "eligibleFindingIds": [
      "RR-001",
      "RR-002",
      "RR-003",
      "RR-004",
      "RR-005"
    ],
    "eligibleCount": 5
  },
  "limitations": [
    "This review examined one repository at one commit. Changes made after that commit were not reviewed.",
    "The review read source, configuration, and dependency manifests. It did not attack, load-test, or otherwise exercise a running system.",
    "Findings describe what this review identified. The absence of a finding is not evidence that a problem does not exist.",
    "Severity reflects the impact, exploitability, and confidence recorded for each finding, judged against the one critical workflow in scope.",
    "Part of this review is performed by an AI system reading your source. Text inside a repository can attempt to influence such a system. Our controls prevent that text from changing this report's findings, severity, counts, or verdict, which are computed by deterministic code from recorded observations. They cannot rule out that it caused a real problem to go unreported. This residual risk is not solved, and a human reviewer signing this report is the mitigation, not a guarantee.",
    "The customer excluded part of the repository from this review at intake. Anything inside an exclusion was not examined.",
    "The workflow depends on a third-party service whose behaviour could not be observed from the repository."
  ],
  "disclaimers": [
    "This review is not a penetration test.",
    "This review is not a compliance certification.",
    "This review does not guarantee the absence of security vulnerabilities.",
    "Findings describe one repository at one commit. Changes made after that commit were not reviewed."
  ],
  "preparedByKind": "agent",
  "reviewedByName": "Sam Okafor, operations manager"
}