{
  "version": "1",
  "scanned_at": "2026-07-09T05:16:47Z",
  "repo": "launch-readiness-scan",
  "owner": "agent-team-foundation",
  "report_lang": "en",
  "tier": "Launch-ready",
  "tier_source": "inferred-default",
  "verdict": "Almost there",
  "verdict_reason": "1 minor finding in secrets hygiene",
  "verdict_quip": "Your renderer wears a helmet; your future dotenv is still barefoot in traffic.",
  "verdict_handle": "Dotenv Banana Peel",
  "verdict_emoji": "🧪",
  "roast_tldr": "This is mostly clean: the renderer escapes hostile report prose, the smoke tests actually run, and no backend is sitting there with its shoes untied. The only pratfall is basic secret hygiene: `.env` is not ignored, so one lazy `git add .` can turn tomorrow's credentials into archaeology.",
  "hero_prose": "The core report renderer is doing the grown-up work: deterministic keys, HTML escaping, bidi stripping, and a CI smoke suite. Adorable, then, that the repo still leaves `.env` outside `.gitignore` like it wants the simplest possible future incident report.",
  "arch_summary": "This is a Claude Code skill package, not a deployed app: `.claude/skills/production-scan/SKILL.md` orchestrates the scan, `references/` holds the vertical rules, `scripts/render-report.mjs` renders a self-contained HTML report, and `.github/workflows/render-smoke.yml` runs the Node smoke tests. It is delightfully narrow: one renderer, one template, one test file. The architecture is basically a fireproof safe with a banana peel taped to the front because `.env` is not ignored.",
  "arch_transition": "No blocker here. Fix the hygiene slip, keep the renderer tests green, and this is launchable for its stated role.",
  "calibration": {
    "scale": "no payments or at-scale usage detected",
    "data": "generated scan reports with bounded evidence",
    "stage": "production trial support repo",
    "type": "scanner skill package"
  },
  "scan_depth": "DEEP",
  "coverage": {
    "analyzed": 2,
    "total": 2
  },
  "score": 96,
  "dimensions": [
    {
      "key": "secrets-credentials",
      "name": "Secrets & Credentials",
      "status": "fail",
      "n_a_reason": null,
      "score": 88,
      "barb": "Clean now; one dotenv from embarrassing yourself",
      "findings": [
        {
          "id": "secrets-stage5-_gitignore_0",
          "severity": "minor",
          "confidence": "confirmed",
          "evidence": ".gitignore:0 — .env / .env* not ignored (searched: repo root)",
          "rule": "Ignore dotenv files before one carries a secret",
          "fix": "Append .env / .env.* / !.env.example to .gitignore"
        }
      ]
    },
    {
      "key": "auth-access",
      "name": "Authentication & Access",
      "status": "n/a",
      "n_a_reason": "N/A — No backend, database, or user accounts detected; auth & access control not applicable. · N/A — No abuse-prone endpoint detected (no auth/OTP/send, LLM/expensive-compute, or public unauthenticated write reachable from an entrypoint); rate limiting & abuse prevention not applicable.",
      "score": null,
      "barb": "N/A — no backend, accounts, or abuse-prone endpoint to defend",
      "findings": []
    },
    {
      "key": "input-data-safety",
      "name": "Input & Data Safety",
      "status": "n/a",
      "n_a_reason": "N/A — No untrusted input reaching a dangerous sink detected (no request/argv/file/DOM source feeding a DB-execute, HTML render, process-exec, filesystem, outbound-HTTP, or log sink); input & data safety not applicable. · N/A — No LLM / generative-AI model call detected (no provider SDK or model REST endpoint imported and used); AI integration security not applicable. · N/A — No mobile app surface detected (no React Native / Expo / native iOS / native Android entrypoint in shipped code); mobile app security not applicable.",
      "score": null,
      "barb": "N/A — no source-to-dangerous-sink path found",
      "findings": []
    },
    {
      "key": "error-handling",
      "name": "Error Handling",
      "status": "pass",
      "n_a_reason": null,
      "score": 100,
      "barb": "Renderer errors fail closed instead of tap-dancing",
      "findings": []
    },
    {
      "key": "tests-ci",
      "name": "Tests & CI",
      "status": "pass",
      "n_a_reason": null,
      "score": 100,
      "barb": "Seventeen smoke checks and CI wiring; annoyingly competent",
      "findings": []
    },
    {
      "key": "observability",
      "name": "Observability",
      "status": "n/a",
      "n_a_reason": "N/A — No server/backend deployable detected (static site); observability not applicable.",
      "score": null,
      "barb": "N/A — no running service to page you about",
      "findings": []
    },
    {
      "key": "deploy-config",
      "name": "Deploy Config",
      "status": "n/a",
      "n_a_reason": "N/A — No deploy or runtime surface detected (library / never-deployed script); deploy & config not applicable.",
      "score": null,
      "barb": "N/A — CI smoke runner, not a deployed app surface",
      "findings": []
    },
    {
      "key": "performance",
      "name": "Performance",
      "status": "n/a",
      "n_a_reason": "N/A — No database or data layer detected (no query-executing client, no schema/migration files) and no hot path; performance not applicable.",
      "score": null,
      "barb": "N/A — no data layer, no hot path, no spreadsheet cosplay",
      "findings": []
    }
  ],
  "summary": {
    "fatal": 0,
    "serious": 0,
    "minor": 1,
    "n_a": 5
  },
  "mustfix": [
    {
      "tag": "Medium",
      "title": "Your `.env` is not ignored, because apparently the easiest secret leak needed a standing invitation",
      "roast": "Nothing is leaked today. Great. The bar is underground and you cleared it. Add the ignore rule before tomorrow's API key becomes a git-history fossil.",
      "evidence": ".gitignore:0 — .env / .env* not ignored (searched: repo root)",
      "cause": "The repo does not ignore local dotenv files, so a future `.env` containing real credentials can be committed accidentally. The current scan found no tracked `.env` and no live secret exposure.",
      "fix": "Append these lines to `.gitignore`:\n\n.env\n.env.*\n!.env.example",
      "verify": "git check-ignore .env\n# expected output: .env"
    }
  ]
}