[
 {
  "id": "B01",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Session member could rewrite authedUids via the self-leave rule branch (evict host, inject members)",
  "category": "AUTHZ",
  "severity": "H",
  "detection": "REVIEW",
  "red": "RV",
  "green_over": "U",
  "author": "claude",
  "attr_tier": "A",
  "intro": "29796ba7",
  "fix": "a6a5d9a7",
  "source": "docs/audits/SECURITY_AUDIT.md V1; a6a5d9a7 msg (\"revert-checked\")",
  "path": "D"
 },
 {
  "id": "B02",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "DM photo Storage reads open to any signed-in user; the relaxing commit called the change safe",
  "category": "PRIV",
  "severity": "H",
  "detection": "REVIEW",
  "red": "N",
  "green_over": "Y",
  "author": "claude",
  "attr_tier": "A",
  "intro": "4bc44b79",
  "fix": "a6a5d9a7 fb6e549f",
  "source": "SECURITY_AUDIT.md V2; 4bc44b79 msg; a6a5d9a7 msg (\"code-reviewed\", harness Firestore-only)",
  "path": "D"
 },
 {
  "id": "B03",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Session doc readable by removed and banned members (lastActivity leak)",
  "category": "PRIV",
  "severity": "M",
  "detection": "REVIEW",
  "red": "T",
  "green_over": "U",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "a6a5d9a7",
  "source": "SECURITY_AUDIT.md V8; a6a5d9a7 msg",
  "path": "D"
 },
 {
  "id": "B04",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "usernames collection fully listable (directory enumeration)",
  "category": "PRIV",
  "severity": "M",
  "detection": "REVIEW",
  "red": "T",
  "green_over": "U",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "a6a5d9a7",
  "source": "SECURITY_AUDIT.md V6",
  "path": "D"
 },
 {
  "id": "B05",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Non-owner could rewrite an open receipt's currency/merchant before finalise",
  "category": "MONEY",
  "severity": "M",
  "detection": "REVIEW",
  "red": "T",
  "green_over": "U",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "a6a5d9a7",
  "source": "SECURITY_AUDIT.md V4",
  "path": "D"
 },
 {
  "id": "B06",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Turbo participant could forge host-only paidConfirmed on own claim",
  "category": "AUTHZ",
  "severity": "M",
  "detection": "REVIEW",
  "red": "T",
  "green_over": "U",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "a6a5d9a7",
  "source": "SECURITY_AUDIT.md V5",
  "path": "D"
 },
 {
  "id": "B07",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Public displayName written with no length/type validation",
  "category": "ABUSE",
  "severity": "M",
  "detection": "REVIEW",
  "red": "T",
  "green_over": "U",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "a6a5d9a7",
  "source": "SECURITY_AUDIT.md V7",
  "path": "D"
 },
 {
  "id": "B08",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Anonymous uids defeated per-uid AI quotas (denial-of-wallet)",
  "category": "ABUSE",
  "severity": "M",
  "detection": "REVIEW",
  "red": "U",
  "green_over": "U",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "fb6e549f",
  "source": "SECURITY_AUDIT.md V12; fb6e549f msg",
  "path": "D"
 },
 {
  "id": "B09",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "CSV export open to spreadsheet formula injection",
  "category": "ABUSE",
  "severity": "L",
  "detection": "REVIEW",
  "red": "U",
  "green_over": "U",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "fb6e549f",
  "source": "SECURITY_AUDIT.md V19",
  "path": "D"
 },
 {
  "id": "B10",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Predictable settlement-proof path let an attacker pre-plant and block a payer's proof",
  "category": "ABUSE",
  "severity": "M",
  "detection": "REVIEW",
  "red": "U",
  "green_over": "U",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "fb6e549f",
  "source": "SECURITY_AUDIT.md V10",
  "path": "D"
 },
 {
  "id": "B11",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Android allowBackup left at default true",
  "category": "PRIV",
  "severity": "L",
  "detection": "REVIEW",
  "red": "N",
  "green_over": "U",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "fb6e549f",
  "source": "SECURITY_AUDIT.md V30",
  "path": "D"
 },
 {
  "id": "B12",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Cross-session balances read the raw wallet hint and could show money for a left/archived hangout",
  "category": "MONEY",
  "severity": "H",
  "detection": "REVIEW",
  "red": "U",
  "green_over": "U",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "d8146f05",
  "source": "docs/audits/QUALITY_AUDIT.md B1; d8146f05 msg",
  "path": "D"
 },
 {
  "id": "B13",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Gifting spent the one irreversible free month on a single unconfirmed tap",
  "category": "LOGIC",
  "severity": "H",
  "detection": "REVIEW",
  "red": "U",
  "green_over": "U",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "d8146f05",
  "source": "QUALITY_AUDIT.md B2; d8146f05 msg",
  "path": "D"
 },
 {
  "id": "B14",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Bio never saved: field missing from the server's public-profile allowlist; suite green at 2,582",
  "category": "CONTRACT",
  "severity": "H",
  "detection": "OWNER",
  "red": "T",
  "green_over": "Y",
  "author": "claude",
  "attr_tier": "A",
  "intro": "fd9a04db",
  "fix": "cfbaf5f9",
  "source": "cfbaf5f9 msg (test asserted a method with zero production callers)",
  "path": "D"
 },
 {
  "id": "B15",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Transfer defaults never refreshed for payers (one-shot cached provider)",
  "category": "STALE",
  "severity": "M",
  "detection": "OWNER",
  "red": "T",
  "green_over": "Y",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "cfbaf5f9",
  "source": "cfbaf5f9 msg (how_to_pay_test overrode the provider under test)",
  "path": "D"
 },
 {
  "id": "B16",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Catch-all switch arms let a new frame compile and render nothing",
  "category": "UI",
  "severity": "L",
  "detection": "SELF",
  "red": "T",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "cfbaf5f9",
  "source": "cfbaf5f9 msg",
  "path": "D"
 },
 {
  "id": "B17",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Reset hints did nothing while the toast claimed success",
  "category": "ERR",
  "severity": "M",
  "detection": "SELF",
  "red": "U",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "cfbaf5f9",
  "source": "cfbaf5f9 msg",
  "path": "D"
 },
 {
  "id": "B18",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Widget carried a second money-left formula ignoring income and goals",
  "category": "MONEY",
  "severity": "M",
  "detection": "SELF",
  "red": "U",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "cfbaf5f9",
  "source": "cfbaf5f9 msg",
  "path": "D"
 },
 {
  "id": "B19",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Dev Pro toggle guards used kDebugMode where the system used !kReleaseMode",
  "category": "BUILD",
  "severity": "L",
  "detection": "SELF",
  "red": "U",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "cfbaf5f9",
  "source": "cfbaf5f9 msg",
  "path": "D"
 },
 {
  "id": "B20",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "NUL bytes hid two source files from grep and misled an auditor into calling live code dead",
  "category": "BUILD",
  "severity": "L",
  "detection": "SELF",
  "red": "N",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "cfbaf5f9",
  "source": "cfbaf5f9 msg",
  "path": "D"
 },
 {
  "id": "B21",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Bubble wake gate was dead code: any cosmetic id rode the per-vsync rebuild path forever",
  "category": "PERF",
  "severity": "M",
  "detection": "REVIEW",
  "red": "RV",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "396b704",
  "source": "perf-rework-2026-07/COMPLETION_REPORT.md 1.1; 396b704 msg (\"verified red on the old code\")",
  "path": "D"
 },
 {
  "id": "B22",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Cached bubble still never re-armed after a radius ease (latched dynamic path)",
  "category": "STALE",
  "severity": "M",
  "detection": "REVIEW",
  "red": "RV",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "396b704",
  "source": "COMPLETION_REPORT.md 1.1",
  "path": "D"
 },
 {
  "id": "B23",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Photo decode width keyed on the animated radius (~40 decodes per ease)",
  "category": "PERF",
  "severity": "M",
  "detection": "REVIEW",
  "red": "RV",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "396b704",
  "source": "COMPLETION_REPORT.md 1.1",
  "path": "D"
 },
 {
  "id": "B24",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Seven provider families held route-scoped Firestore listeners for app lifetime",
  "category": "PERF",
  "severity": "M",
  "detection": "REVIEW",
  "red": "RV",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "51d7f0b",
  "source": "COMPLETION_REPORT.md 1.2; 51d7f0b msg",
  "path": "D"
 },
 {
  "id": "B25",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Chat last-seen state not keyed per account (account switch inherited read state)",
  "category": "STALE",
  "severity": "M",
  "detection": "REVIEW",
  "red": "RV",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "51d7f0b",
  "source": "51d7f0b msg",
  "path": "D"
 },
 {
  "id": "B26",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Receipt claim list showed a false all-unclaimed frame while claims loaded",
  "category": "ERR",
  "severity": "M",
  "detection": "REVIEW",
  "red": "RV",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "51d7f0b",
  "source": "COMPLETION_REPORT.md 1.5; 51d7f0b msg",
  "path": "D"
 },
 {
  "id": "B27",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Direct-settlement solver re-ran three times for every hangout on any non-money churn",
  "category": "PERF",
  "severity": "M",
  "detection": "REVIEW",
  "red": "RV",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "da91d91",
  "source": "COMPLETION_REPORT.md 1.3",
  "path": "D"
 },
 {
  "id": "B28",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "requestsProvider missing its auth re-scope",
  "category": "STALE",
  "severity": "M",
  "detection": "REVIEW",
  "red": "RV",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "da91d91",
  "source": "da91d91 msg",
  "path": "D"
 },
 {
  "id": "B29",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Widget payload stamped DateTime.now, re-rendering PNGs and burning OS reloads",
  "category": "PERF",
  "severity": "M",
  "detection": "REVIEW",
  "red": "RV",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "da91d91",
  "source": "COMPLETION_REPORT.md 1.3",
  "path": "D"
 },
 {
  "id": "B30",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Activity feed built every money event eagerly with no cap",
  "category": "PERF",
  "severity": "L",
  "detection": "REVIEW",
  "red": "RV",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "da91d91",
  "source": "COMPLETION_REPORT.md 1.3",
  "path": "D"
 },
 {
  "id": "B31",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "FCM token registration ran three times per boot",
  "category": "PERF",
  "severity": "L",
  "detection": "REVIEW",
  "red": "RV",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "524b9a3",
  "source": "COMPLETION_REPORT.md 1.4",
  "path": "D"
 },
 {
  "id": "B32",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Push taps and deep links stacked duplicate copies of the top screen",
  "category": "UI",
  "severity": "L",
  "detection": "REVIEW",
  "red": "RV",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "524b9a3",
  "source": "COMPLETION_REPORT.md 1.4",
  "path": "D"
 },
 {
  "id": "B33",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Money taps could fire twice; Confirm-all double-tap ran 2N writes",
  "category": "CONC",
  "severity": "M",
  "detection": "REVIEW",
  "red": "RV",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "a50fc0c",
  "source": "COMPLETION_REPORT.md 1.5; a50fc0c msg",
  "path": "D"
 },
 {
  "id": "B34",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "System back killed a quota-counted receipt scan mid-flight",
  "category": "ERR",
  "severity": "M",
  "detection": "REVIEW",
  "red": "RV",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "a50fc0c",
  "source": "COMPLETION_REPORT.md 1.5",
  "path": "D"
 },
 {
  "id": "B35",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Avatar warmup decoded 13 full-size photos into cache keys no render path matched",
  "category": "PERF",
  "severity": "M",
  "detection": "REVIEW",
  "red": "RV",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "913fb33",
  "source": "COMPLETION_REPORT.md 1.6",
  "path": "D"
 },
 {
  "id": "B36",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Cover photos cached by session id served a stale cover",
  "category": "STALE",
  "severity": "L",
  "detection": "REVIEW",
  "red": "RV",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "913fb33",
  "source": "COMPLETION_REPORT.md 1.6",
  "path": "D"
 },
 {
  "id": "B37",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Edge-swipe back re-inflated the page (lost State) and leaked a settle listener per abort",
  "category": "UI",
  "severity": "M",
  "detection": "REVIEW",
  "red": "RV",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "b7fbdc1e",
  "source": "b7fbdc1e msg; COMPLETION_REPORT.md 2",
  "path": "S"
 },
 {
  "id": "B38",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Shell pager answered a user drag with animateToPage, cancelling the gesture; tabs lost scroll",
  "category": "UI",
  "severity": "M",
  "detection": "REVIEW",
  "red": "RV",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "8b49a89",
  "source": "8b49a89 msg",
  "path": "D"
 },
 {
  "id": "B39",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Frame pacer sorted up to ~36k samples per frame in release",
  "category": "PERF",
  "severity": "L",
  "detection": "REVIEW",
  "red": "RV",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "f3b1928",
  "source": "f3b1928 msg",
  "path": "D"
 },
 {
  "id": "B40",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Friends flashed a zero count and first-run pitch while the stream was silent",
  "category": "ERR",
  "severity": "L",
  "detection": "REVIEW",
  "red": "RV",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "2e38f85",
  "source": "COMPLETION_REPORT.md 1.5; 2e38f85 msg",
  "path": "D"
 },
 {
  "id": "B41",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Settings showed the email on both name and email lines",
  "category": "UI",
  "severity": "L",
  "detection": "UNK",
  "red": "N",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "a6104acb",
  "source": "a6104acb msg",
  "path": "S"
 },
 {
  "id": "B42",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "currentUidProvider cached the first uid forever, so writes failed with permission-denied after any auth change",
  "category": "STALE",
  "severity": "H",
  "detection": "UNK",
  "red": "T",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "A",
  "intro": "05587592",
  "fix": "bd8f0843",
  "source": "bd8f0843 msg",
  "path": "S"
 },
 {
  "id": "B43",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Pip mascot eyes vanished in light mode",
  "category": "UI",
  "severity": "L",
  "detection": "OWNER",
  "red": "N",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "ce87e3d0",
  "source": "ce87e3d0 msg (device-bug batch)",
  "path": "S"
 },
 {
  "id": "B44",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Money amounts ellipsised instead of shrinking to fit",
  "category": "UI",
  "severity": "M",
  "detection": "OWNER",
  "red": "N",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "075b4b18",
  "source": "075b4b18 msg",
  "path": "S"
 },
 {
  "id": "B45",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "assetlinks.json shipped a placeholder fingerprint, so Android App Links never verified",
  "category": "BUILD",
  "severity": "M",
  "detection": "UNK",
  "red": "N",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "fd9223e8",
  "source": "fd9223e8 msg",
  "path": "S"
 },
 {
  "id": "B46",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Paywall showed the RM fallback price to users outside Malaysia",
  "category": "LOGIC",
  "severity": "M",
  "detection": "UNK",
  "red": "N",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "1c677a72",
  "source": "1c677a72 msg",
  "path": "S"
 },
 {
  "id": "B47",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Android profile build failed silently; device kept reinstalling a stale APK",
  "category": "BUILD",
  "severity": "M",
  "detection": "OWNER",
  "red": "N",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "c8dcd188",
  "source": "c8dcd188 msg",
  "path": "S"
 },
 {
  "id": "B48",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Turbo split rules readable by any signed-in user exposed payee bank details",
  "category": "PRIV",
  "severity": "H",
  "detection": "UNK",
  "red": "N",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "a9c21fc8",
  "source": "a9c21fc8 msg",
  "path": "S"
 },
 {
  "id": "B49",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Blurred cover paint escaped its bounds as a coloured bar",
  "category": "UI",
  "severity": "L",
  "detection": "OWNER",
  "red": "T",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "1fc40683",
  "source": "1fc40683 msg (\"reported twice\")",
  "path": "S"
 },
 {
  "id": "B50",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Receipt total ignored the bill-level discount",
  "category": "MONEY",
  "severity": "H",
  "detection": "SELF",
  "red": "T",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "53c365a3",
  "source": "53c365a3 msg",
  "path": "S"
 },
 {
  "id": "B51",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Chooser row carried a hard-coded decorative tick never driven by state",
  "category": "UI",
  "severity": "L",
  "detection": "OWNER",
  "red": "N",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "20b83e40",
  "source": "20b83e40 msg",
  "path": "S"
 },
 {
  "id": "B52",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "A payment on a simplified-plan line vanished: money left the payer but no balance moved",
  "category": "MONEY",
  "severity": "H",
  "detection": "UNK",
  "red": "U",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "09d09516",
  "source": "09d09516 msg",
  "path": "S"
 },
 {
  "id": "B53",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Pay sheet labelled the instant-transfer scheme as Malaysian for every region",
  "category": "LOGIC",
  "severity": "M",
  "detection": "UNK",
  "red": "T",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "4e1a2499",
  "source": "4e1a2499 msg",
  "path": "S"
 },
 {
  "id": "B54",
  "product": "Bupples",
  "repo": "Bupples",
  "title": "Compact welcome pages not visible in the Android release build",
  "category": "UI",
  "severity": "M",
  "detection": "UNK",
  "red": "N",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "7c002c01",
  "source": "7c002c01 msg",
  "path": "S"
 },
 {
  "id": "C01",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "Erasure left stored objects (uploads, exports, feed snapshot) behind",
  "category": "PRIV",
  "severity": "H",
  "detection": "REVIEW",
  "red": "RF",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "8dee1a6",
  "fix": "4afd29c",
  "source": "4afd29c msg (\"each fix has a test that failed before it\"); docs/PROGRESS.md session 3",
  "path": "D"
 },
 {
  "id": "C02",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "API keys (non-humans) could move a claim to verified or user_attested",
  "category": "AUTHZ",
  "severity": "H",
  "detection": "REVIEW",
  "red": "RF",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "5f69c37",
  "fix": "4afd29c",
  "source": "4afd29c msg; PROGRESS.md finding 2",
  "path": "D"
 },
 {
  "id": "C03",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "Verifying an email signed in whoever registered the address first (pre-registration takeover)",
  "category": "AUTHZ",
  "severity": "H",
  "detection": "REVIEW",
  "red": "RF",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "f1dbae5",
  "fix": "4afd29c",
  "source": "4afd29c msg; PROGRESS.md finding 3",
  "path": "D"
 },
 {
  "id": "C04",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "GitHub webhook redelivery attempted only once",
  "category": "ERR",
  "severity": "M",
  "detection": "REVIEW",
  "red": "RF",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "0ecce08",
  "fix": "4afd29c",
  "source": "4afd29c msg; PROGRESS.md finding 6",
  "path": "D"
 },
 {
  "id": "C05",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "Organisation installs could not complete after their webhook arrived (state consumed early)",
  "category": "LOGIC",
  "severity": "M",
  "detection": "REVIEW",
  "red": "RF",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "0ecce08",
  "fix": "4afd29c",
  "source": "4afd29c msg; PROGRESS.md finding 7",
  "path": "D"
 },
 {
  "id": "C06",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "Portable data export omitted owner tables",
  "category": "PRIV",
  "severity": "M",
  "detection": "REVIEW",
  "red": "RF",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "0fc412a",
  "fix": "4afd29c",
  "source": "4afd29c msg; PROGRESS.md finding 8",
  "path": "D"
 },
 {
  "id": "C07",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "Consent withdrawal and deletion did not retract website publications; failed uninstall blocked purge",
  "category": "PRIV",
  "severity": "M",
  "detection": "REVIEW",
  "red": "RF",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "0fc412a",
  "fix": "4afd29c",
  "source": "4afd29c msg",
  "path": "D"
 },
 {
  "id": "C08",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "Rejected-webhook logging unbudgeted; auth flows not limited per email",
  "category": "ABUSE",
  "severity": "M",
  "detection": "REVIEW",
  "red": "RF",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "",
  "fix": "4afd29c",
  "source": "4afd29c msg",
  "path": "D"
 },
 {
  "id": "C09",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "Profile edits unpinned every resume entry; deleting an achievement left open suggestions",
  "category": "LOGIC",
  "severity": "L",
  "detection": "REVIEW",
  "red": "RF",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "5f69c37",
  "fix": "4afd29c",
  "source": "4afd29c msg; PROGRESS.md finding 15",
  "path": "D"
 },
 {
  "id": "C10",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "A storage-config test passed over a bug",
  "category": "TEST",
  "severity": "L",
  "detection": "REVIEW",
  "red": "RF",
  "green_over": "Y",
  "author": "codex",
  "attr_tier": "B",
  "intro": "8dee1a6",
  "fix": "4afd29c",
  "source": "4afd29c msg",
  "path": "D"
 },
 {
  "id": "C11",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "Queue: slow job stranded claimed siblings, lost lease did not abort, crash-looping jobs never died",
  "category": "CONC",
  "severity": "H",
  "detection": "REVIEW",
  "red": "RF",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "a63a28a",
  "fix": "a2994f9",
  "source": "a2994f9 msg (\"each proven red first\"); PROGRESS.md session 2 (\"authored alongside implementation, rather than observed red first\")",
  "path": "D"
 },
 {
  "id": "C12",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "Numeric gate tokenised ISO dates as YYYY-MM so the date rule never matched",
  "category": "UNITS",
  "severity": "M",
  "detection": "REVIEW",
  "red": "U",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "8e4ebf1",
  "fix": "7bcaf65",
  "source": "7bcaf65 msg; PROGRESS.md session 3",
  "path": "D"
 },
 {
  "id": "C13",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "Deleting a live record left orphaned public items",
  "category": "PRIV",
  "severity": "M",
  "detection": "UNK",
  "red": "RF",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "A",
  "intro": "87fb3d8",
  "fix": "9b68d01",
  "source": "9b68d01 msg (\"each fix has a test that fails without it\")",
  "path": "C"
 },
 {
  "id": "C14",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "Withdrawing notification permission did not stop queued webhook messages",
  "category": "PRIV",
  "severity": "M",
  "detection": "UNK",
  "red": "RF",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "A",
  "intro": "87fb3d8",
  "fix": "9b68d01",
  "source": "9b68d01 msg",
  "path": "C"
 },
 {
  "id": "C15",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "Two concurrent drafting runs created two achievements",
  "category": "CONC",
  "severity": "M",
  "detection": "UNK",
  "red": "RF",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "A",
  "intro": "7bcaf65",
  "fix": "9b68d01",
  "source": "9b68d01 msg; PROGRESS.md session 5 (duplicate demo achievement)",
  "path": "C"
 },
 {
  "id": "C16",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "Per-email limiter counted correct sign-ins, letting anyone lock an owner out",
  "category": "ABUSE",
  "severity": "H",
  "detection": "REVIEW",
  "red": "RF",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "10e0b55",
  "source": "10e0b55 msg (\"all three fail against the original limiter\")",
  "path": "C"
 },
 {
  "id": "C17",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "Passing NextRequest to the Request constructor made every dev-server sign-in a 500",
  "category": "CONTRACT",
  "severity": "M",
  "detection": "SELF",
  "red": "N",
  "green_over": "Y",
  "author": "claude",
  "attr_tier": "A",
  "intro": "d4ce792",
  "fix": "adad203",
  "source": "adad203 msg (test \"does not reproduce the Next-runtime error\")",
  "path": "C"
 },
 {
  "id": "C18",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "Public API limiter trusted the client-written forwarded hop (unbounded buckets)",
  "category": "ABUSE",
  "severity": "M",
  "detection": "REVIEW",
  "red": "RF",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "3f1c178",
  "source": "3f1c178 msg",
  "path": "C"
 },
 {
  "id": "C19",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "Publication gates leaked private repository names and links, and minted numbers from titles (gate catch 14/22)",
  "category": "LOGIC",
  "severity": "H",
  "detection": "REVIEW",
  "red": "RF",
  "green_over": "Y",
  "author": "codex",
  "attr_tier": "B",
  "intro": "8e4ebf1",
  "fix": "70b84e6",
  "source": "70b84e6 msg (12 of 14 tests fail on old gates; old catch rate 0.64); PROGRESS.md session 5 (gate catch 14/14 before)",
  "path": "C"
 },
 {
  "id": "C20",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "Regex dotAll flag broke the web typecheck (pre-ES2018 target)",
  "category": "BUILD",
  "severity": "L",
  "detection": "GATE",
  "red": "N",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "A",
  "intro": "70b84e6",
  "fix": "44d4884",
  "source": "44d4884 msg",
  "path": "C"
 },
 {
  "id": "C21",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "A stolen session cookie could mint API keys; password reset left keys working",
  "category": "AUTHZ",
  "severity": "H",
  "detection": "REVIEW",
  "red": "RF",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "bea3642",
  "source": "bea3642 msg (\"3 fail\")",
  "path": "C"
 },
 {
  "id": "C22",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "Catch-all logging wrote error messages carrying bound query parameters (PII)",
  "category": "PRIV",
  "severity": "M",
  "detection": "REVIEW",
  "red": "RF",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "ccf3212",
  "source": "ccf3212 msg (\"fails against the old http.ts\")",
  "path": "C"
 },
 {
  "id": "C23",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "On organisation installs every merged PR became a verified claim about the person",
  "category": "LOGIC",
  "severity": "H",
  "detection": "REVIEW",
  "red": "RF",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "A",
  "intro": "c749070",
  "fix": "d9e1be3",
  "source": "d9e1be3 msg",
  "path": "C"
 },
 {
  "id": "C24",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "Request bodies read whole before the size check; proxy silently truncated uploads",
  "category": "ABUSE",
  "severity": "M",
  "detection": "REVIEW",
  "red": "RF",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "6e0ab94",
  "source": "6e0ab94 msg (\"both failed before\")",
  "path": "C"
 },
 {
  "id": "C25",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "safe-fetch treated IPv4-compatible IPv6 as public (SSRF)",
  "category": "ABUSE",
  "severity": "M",
  "detection": "REVIEW",
  "red": "T",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "8dee1a6",
  "fix": "f74504a",
  "source": "f74504a msg; PROGRESS.md session 2 (pinned safe-fetch)",
  "path": "C"
 },
 {
  "id": "C26",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "Only five common passwords were rejected",
  "category": "ABUSE",
  "severity": "L",
  "detection": "REVIEW",
  "red": "U",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "f1dbae5",
  "fix": "84d6bcf",
  "source": "84d6bcf msg",
  "path": "C"
 },
 {
  "id": "C27",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "Co-author email addresses stored verbatim in evidence text and exports",
  "category": "PRIV",
  "severity": "M",
  "detection": "SELF",
  "red": "RV",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "A",
  "intro": "c749070",
  "fix": "83f8442",
  "source": "83f8442 msg (\"4 mutations each turned them red\"); PROGRESS.md session 8",
  "path": "D"
 },
 {
  "id": "C28",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "Left-out channel faded to 55% opacity failed contrast",
  "category": "UI",
  "severity": "L",
  "detection": "GATE",
  "red": "RF",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "05cb627",
  "source": "PROGRESS.md session 6 (\"seen failing first\")",
  "path": "D"
 },
 {
  "id": "C29",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "Light slate token at 4.31:1 on the page colour",
  "category": "UI",
  "severity": "L",
  "detection": "GATE",
  "red": "RF",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "05cb627",
  "source": "PROGRESS.md session 6; 05cb627 msg (\"token test red on old slate\")",
  "path": "D"
 },
 {
  "id": "C30",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "Acceptance suite: delivery sweeper untested, M6 untested, 9 of 15 criteria partly covered",
  "category": "TEST",
  "severity": "M",
  "detection": "SELF",
  "red": "RV",
  "green_over": "Y",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "29c677a",
  "source": "PROGRESS.md session 7 table; 29c677a msg",
  "path": "D"
 },
 {
  "id": "C31",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "db:verify passed while required schema objects were absent",
  "category": "TEST",
  "severity": "M",
  "detection": "REVIEW",
  "red": "U",
  "green_over": "Y",
  "author": "codex",
  "attr_tier": "B",
  "intro": "",
  "fix": "(completion pass)",
  "source": "PROGRESS.md \"Completion-pass verification and review\" #1",
  "path": "D"
 },
 {
  "id": "C32",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "Stalled storage call could hold the profile lock indefinitely",
  "category": "CONC",
  "severity": "M",
  "detection": "REVIEW",
  "red": "RF",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "",
  "fix": "",
  "source": "PROGRESS.md completion pass #2 (\"first failed, then ... passed\")",
  "path": "D"
 },
 {
  "id": "C33",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "Signup responses disclosed whether an account existed",
  "category": "PRIV",
  "severity": "M",
  "detection": "REVIEW",
  "red": "U",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "(completion pass)",
  "source": "docs/DECISIONS.md ADR-025",
  "path": "D"
 },
 {
  "id": "C34",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "Public cache could serve a removed item for a day (stale-while-revalidate 86400)",
  "category": "STALE",
  "severity": "M",
  "detection": "REVIEW",
  "red": "U",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "(completion pass)",
  "source": "DECISIONS.md ADR-025",
  "path": "D"
 },
 {
  "id": "C35",
  "product": "CareerOS",
  "repo": "careerapp",
  "title": "Profile rename left a static snapshot behind, including under a late concurrent writer",
  "category": "CONC",
  "severity": "M",
  "detection": "REVIEW",
  "red": "RF",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "(completion pass)",
  "source": "DECISIONS.md ADR-025; PROGRESS.md (\"deletion/snapshot ordering first failed\")",
  "path": "D"
 },
 {
  "id": "W01",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "Approval route not re-selected after a revision cycle (high-risk edit kept the low-risk route)",
  "category": "LOGIC",
  "severity": "H",
  "detection": "REVIEW",
  "red": "RV",
  "green_over": "Y",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "60a9e03",
  "source": "60a9e03 msg (\"verified to fail when the fix is reverted\"; old assertion encoded the defect)",
  "path": "D"
 },
 {
  "id": "W02",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "riskLevel was not an input to approval routing",
  "category": "LOGIC",
  "severity": "H",
  "detection": "REVIEW",
  "red": "T",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "60a9e03",
  "source": "60a9e03 msg",
  "path": "D"
 },
 {
  "id": "W03",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "Budget threshold failed open when unconfigured (NaN)",
  "category": "LOGIC",
  "severity": "H",
  "detection": "REVIEW",
  "red": "T",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "60a9e03",
  "source": "60a9e03 msg",
  "path": "D"
 },
 {
  "id": "W04",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "Web questionnaire and server derivation used disjoint risk keys",
  "category": "CONTRACT",
  "severity": "H",
  "detection": "REVIEW",
  "red": "T",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "60a9e03",
  "source": "60a9e03 msg",
  "path": "D"
 },
 {
  "id": "W05",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "Submit and cancel sent no body; the core action was a guaranteed 400 from the UI",
  "category": "CONTRACT",
  "severity": "H",
  "detection": "REVIEW",
  "red": "T",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "60a9e03",
  "source": "60a9e03 msg",
  "path": "D"
 },
 {
  "id": "W06",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "Off-campus submission required a confirmation the form never collected",
  "category": "CONTRACT",
  "severity": "M",
  "detection": "REVIEW",
  "red": "T",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "60a9e03",
  "source": "60a9e03 msg",
  "path": "D"
 },
 {
  "id": "W07",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "JWT secret not fail-fast; token subject not bound to tenant per request",
  "category": "AUTHZ",
  "severity": "H",
  "detection": "REVIEW",
  "red": "RF",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "85475d7",
  "source": "docs/SECURITY.md adversarial review; 85475d7 msg (exploits re-run)",
  "path": "D"
 },
 {
  "id": "W08",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "Audit hash chain forked under concurrency (seq allocated before the lock)",
  "category": "CONC",
  "severity": "H",
  "detection": "REVIEW",
  "red": "RF",
  "green_over": "Y",
  "author": "claude",
  "attr_tier": "A",
  "intro": "1b3b8d9",
  "fix": "85475d7",
  "source": "docs/adr/0009 (\"Reproduced before the fix\"); docs/TESTING.md (test passed for the wrong reason)",
  "path": "D"
 },
 {
  "id": "W09",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "app.write_audit accepted a forged cross-tenant audit row",
  "category": "AUTHZ",
  "severity": "H",
  "detection": "REVIEW",
  "red": "RF",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "A",
  "intro": "1b3b8d9",
  "fix": "85475d7",
  "source": "SECURITY.md; 85475d7 msg",
  "path": "D"
 },
 {
  "id": "W10",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "transition_event allowed approval with undecided stages and ignored the instance",
  "category": "LOGIC",
  "severity": "H",
  "detection": "REVIEW",
  "red": "RF",
  "green_over": "Y",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "85475d7",
  "source": "85475d7 msg (\"two shipped tests asserted these defects\")",
  "path": "D"
 },
 {
  "id": "W11",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "Waitlist promotion authorised on tenancy alone",
  "category": "AUTHZ",
  "severity": "H",
  "detection": "REVIEW",
  "red": "RF",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "A",
  "intro": "1b3b8d9",
  "fix": "85475d7",
  "source": "SECURITY.md line on promote_waitlist_head",
  "path": "D"
 },
 {
  "id": "W12",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "Session revocation blind for a second (JWT iat is whole seconds); test hid it with a 1.1 s sleep",
  "category": "UNITS",
  "severity": "H",
  "detection": "SELF",
  "red": "RV",
  "green_over": "Y",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "85475d7",
  "source": "SECURITY.md; TESTING.md; 85475d7 msg",
  "path": "D"
 },
 {
  "id": "W13",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "Email verification not gating as specified",
  "category": "AUTHZ",
  "severity": "M",
  "detection": "REVIEW",
  "red": "U",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "85475d7",
  "source": "SECURITY.md list",
  "path": "D"
 },
 {
  "id": "W14",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "guest_policy not enforced across registration paths",
  "category": "LOGIC",
  "severity": "M",
  "detection": "REVIEW",
  "red": "U",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "85475d7",
  "source": "85475d7 msg",
  "path": "D"
 },
 {
  "id": "W15",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "Audit advisory lock held to commit serialised every audited write in a tenant (4.8 s vs 43 ms)",
  "category": "CONC",
  "severity": "M",
  "detection": "REVIEW",
  "red": "RF",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "A",
  "intro": "1b3b8d9",
  "fix": "85475d7",
  "source": "docs/adr/0009 (measured before the fix)",
  "path": "D"
 },
 {
  "id": "W16",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "Waitlist positions incorrect",
  "category": "LOGIC",
  "severity": "M",
  "detection": "REVIEW",
  "red": "U",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "85475d7",
  "source": "SECURITY.md list",
  "path": "D"
 },
 {
  "id": "W17",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "Duplicate dialog ids in the web app",
  "category": "UI",
  "severity": "L",
  "detection": "REVIEW",
  "red": "U",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "85475d7",
  "source": "SECURITY.md list",
  "path": "D"
 },
 {
  "id": "W18",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "Autosave dropped edits made during draft creation",
  "category": "CONC",
  "severity": "M",
  "detection": "REVIEW",
  "red": "U",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "85475d7",
  "source": "85475d7 msg",
  "path": "D"
 },
 {
  "id": "W19",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "Dishonest empty states hid errors",
  "category": "ERR",
  "severity": "L",
  "detection": "REVIEW",
  "red": "U",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "85475d7",
  "source": "85475d7 msg",
  "path": "D"
 },
 {
  "id": "W20",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "Incoming custodian refused the second attestation; two-party rule reachable only by accident",
  "category": "LOGIC",
  "severity": "M",
  "detection": "REVIEW",
  "red": "T",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "199ef1d",
  "source": "199ef1d msg (\"reported by a teammate agent\"); SECURITY.md (no negative control)",
  "path": "D"
 },
 {
  "id": "W21",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "Shipped chain verifier walked seq, passing only because the suite ran serially",
  "category": "TEST",
  "severity": "M",
  "detection": "SELF",
  "red": "RF",
  "green_over": "Y",
  "author": "claude",
  "attr_tier": "A",
  "intro": "1b3b8d9",
  "fix": "85475d7",
  "source": "SECURITY.md audit section",
  "path": "D"
 },
 {
  "id": "W22",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "Tenant-scoped coverage set keyed on institution_id silently excluded tables added since migration 017",
  "category": "TEST",
  "severity": "H",
  "detection": "SELF",
  "red": "U",
  "green_over": "Y",
  "author": "claude",
  "attr_tier": "C",
  "intro": "5096bcd",
  "fix": "",
  "source": "docs/TESTING.md",
  "path": "D"
 },
 {
  "id": "W23",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "Append-only guard compared NULL institution_id with =, blocking chaining for standalone rows",
  "category": "LOGIC",
  "severity": "M",
  "detection": "SELF",
  "red": "U",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "5096bcd",
  "fix": "85475d7..5096bcd",
  "source": "docs/adr/0009-per-account-audit-chain.md",
  "path": "D"
 },
 {
  "id": "W24",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "Club colour scope never reached buttons (token alias resolved against the root brand)",
  "category": "UI",
  "severity": "M",
  "detection": "SELF",
  "red": "RV",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "5082ea4",
  "source": "5082ea4 msg (\"mutation-checked\")",
  "path": "C"
 },
 {
  "id": "W25",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "Seed anchored to Date.now produced events straddling midnight at odd minutes",
  "category": "UNITS",
  "severity": "L",
  "detection": "SELF",
  "red": "N",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "5082ea4",
  "source": "5082ea4 msg",
  "path": "C"
 },
 {
  "id": "W26",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "Test pinned an incidental null poster instead of the response contract",
  "category": "TEST",
  "severity": "L",
  "detection": "SELF",
  "red": "N",
  "green_over": "Y",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "5082ea4",
  "source": "5082ea4 msg",
  "path": "C"
 },
 {
  "id": "W27",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "Poster colour computed and stored, then dropped by four hand-written subselects",
  "category": "CONTRACT",
  "severity": "M",
  "detection": "SELF",
  "red": "U",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "0e0fdeb",
  "source": "0e0fdeb msg",
  "path": "C"
 },
 {
  "id": "W28",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "Committee task tables had RLS on and zero policies: no request could reach a row",
  "category": "AUTHZ",
  "severity": "M",
  "detection": "SELF",
  "red": "U",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "0e0fdeb",
  "source": "0e0fdeb msg",
  "path": "C"
 },
 {
  "id": "W29",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "ROADMAP listed shipped features as not started",
  "category": "DOCS",
  "severity": "L",
  "detection": "SELF",
  "red": "N",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "0e0fdeb",
  "source": "0e0fdeb msg",
  "path": "C"
 },
 {
  "id": "W30",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "Static breadcrumbs sent Back to the structural parent, not the origin",
  "category": "UI",
  "severity": "L",
  "detection": "SELF",
  "red": "U",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "0e0fdeb",
  "source": "0e0fdeb msg",
  "path": "C"
 },
 {
  "id": "W31",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "ClubMark nested a div inside a paragraph (production hydration mismatch)",
  "category": "UI",
  "severity": "M",
  "detection": "SELF",
  "red": "U",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "05e18a3",
  "source": "05e18a3 msg",
  "path": "C"
 },
 {
  "id": "W32",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "Accent normalisation not idempotent: each save bleached the stored colour about 8%",
  "category": "UNITS",
  "severity": "M",
  "detection": "SELF",
  "red": "U",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "05e18a3",
  "source": "05e18a3 msg",
  "path": "C"
 },
 {
  "id": "W33",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "Auth pages rendered unstyled after the landing rewrite dropped their rules",
  "category": "UI",
  "severity": "M",
  "detection": "UNK",
  "red": "N",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "a16442d",
  "fix": "257c1e4",
  "source": "257c1e4 msg",
  "path": "C"
 },
 {
  "id": "W34",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "Concurrent test-database resets caused phantom failures in green suites",
  "category": "TEST",
  "severity": "M",
  "detection": "SELF",
  "red": "N",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "199ef1d",
  "source": "199ef1d msg",
  "path": "C"
 },
 {
  "id": "W35",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "Sign-up could pre-hijack an address; invite claims lacked the invitee's session",
  "category": "AUTHZ",
  "severity": "H",
  "detection": "REVIEW",
  "red": "U",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "3836ada",
  "source": "3836ada msg",
  "path": "C"
 },
 {
  "id": "W36",
  "product": "WayClub",
  "repo": "WayClub",
  "title": "WORKFLOWS, SECURITY and TESTING docs overstated the code",
  "category": "DOCS",
  "severity": "M",
  "detection": "REVIEW",
  "red": "N",
  "green_over": "Y",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "85475d7",
  "source": "85475d7 msg",
  "path": "D"
 },
 {
  "id": "P01",
  "product": "Photoshoot",
  "repo": "photoshoot",
  "title": "Windows black viewfinder: the desynchronized WebGL hint presented a black buffer on D3D11 while reporting \"Camera live\"",
  "category": "PLAT",
  "severity": "H",
  "detection": "OWNER",
  "red": "RV",
  "green_over": "Y",
  "author": "claude",
  "attr_tier": "A",
  "intro": "bb93690",
  "fix": "c2a7333",
  "source": "c2a7333 msg (0/256 lit pixels; removing only the line lights 256/256); test/browser/viewfinder.spec.ts",
  "path": "D"
 },
 {
  "id": "P02",
  "product": "Photoshoot",
  "repo": "photoshoot",
  "title": "Render loop scheduled only by requestVideoFrameCallback, which can never fire for a hidden video",
  "category": "PLAT",
  "severity": "H",
  "detection": "OWNER",
  "red": "RM",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "A",
  "intro": "bb93690",
  "fix": "3ce3da4",
  "source": "3ce3da4 msg (synthetic camera before/after)",
  "path": "C"
 },
 {
  "id": "P03",
  "product": "Photoshoot",
  "repo": "photoshoot",
  "title": "Stale saved deviceId made exact-constraint getUserMedia report \"No camera found\"",
  "category": "STALE",
  "severity": "M",
  "detection": "OWNER",
  "red": "RM",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "A",
  "intro": "bb93690",
  "fix": "d219ad6",
  "source": "d219ad6 msg",
  "path": "C"
 },
 {
  "id": "P04",
  "product": "Photoshoot",
  "repo": "photoshoot",
  "title": "Theme shadow validator vulnerable to exponential backtracking (ReDoS)",
  "category": "ABUSE",
  "severity": "M",
  "detection": "SELF",
  "red": "T",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "fb81c0b",
  "source": "fb81c0b msg",
  "path": "C"
 },
 {
  "id": "P05",
  "product": "Photoshoot",
  "repo": "photoshoot",
  "title": "README claimed a published release and an rVFC render loop that no longer existed",
  "category": "DOCS",
  "severity": "L",
  "detection": "SELF",
  "red": "N",
  "green_over": "N",
  "author": "agent",
  "attr_tier": "C",
  "intro": "",
  "fix": "6a1a298",
  "source": "6a1a298 msg",
  "path": "C"
 },
 {
  "id": "P06",
  "product": "Photoshoot",
  "repo": "photoshoot",
  "title": "Effects grid inherited panel visibility; camera went black after reviewing a photo",
  "category": "UI",
  "severity": "H",
  "detection": "OWNER",
  "red": "RV",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "9f34b37",
  "source": "docs/HANDOFF.md 1.4.0 (\"proved red without the fix\"); 9f34b37 msg",
  "path": "D"
 },
 {
  "id": "P07",
  "product": "Photoshoot",
  "repo": "photoshoot",
  "title": "Video review used an img element and showed black",
  "category": "UI",
  "severity": "M",
  "detection": "SELF",
  "red": "T",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "9f34b37",
  "source": "HANDOFF.md 1.4.0",
  "path": "D"
 },
 {
  "id": "P08",
  "product": "Photoshoot",
  "repo": "photoshoot",
  "title": "Face landmarks uploaded y-down and x mirrored twice; every face effect landed below or beside the face",
  "category": "UNITS",
  "severity": "M",
  "detection": "UNK",
  "red": "T",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "A",
  "intro": "70bb1b2",
  "fix": "fcdb7bf",
  "source": "HANDOFF.md 1.5.1; fcdb7bf msg; face.spec.ts",
  "path": "D"
 },
 {
  "id": "P09",
  "product": "Photoshoot",
  "repo": "photoshoot",
  "title": "Effects-browser renderer started its own loop after a GPU reset",
  "category": "PLAT",
  "severity": "M",
  "detection": "SELF",
  "red": "U",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "9f34b37",
  "source": "HANDOFF.md 1.4.0",
  "path": "D"
 },
 {
  "id": "P10",
  "product": "Photoshoot",
  "repo": "photoshoot",
  "title": "Fixed segmentation worker name plus year-long caching could pair a new renderer with a stale worker",
  "category": "STALE",
  "severity": "M",
  "detection": "REVIEW",
  "red": "T",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "18bef78",
  "fix": "e935537",
  "source": "e935537 msg; HANDOFF.md (independent review)",
  "path": "C"
 },
 {
  "id": "P11",
  "product": "Photoshoot",
  "repo": "photoshoot",
  "title": "Background blur haloed dark hair into the blur",
  "category": "UI",
  "severity": "L",
  "detection": "OWNER",
  "red": "N",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "18bef78",
  "fix": "a01c99c",
  "source": "a01c99c msg; HANDOFF.md rework",
  "path": "C"
 },
 {
  "id": "P12",
  "product": "Photoshoot",
  "repo": "photoshoot",
  "title": "Quit waited on a virtual camera that was not running",
  "category": "ERR",
  "severity": "M",
  "detection": "SELF",
  "red": "U",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "18bef78",
  "fix": "e96ac0d",
  "source": "e96ac0d msg",
  "path": "C"
 },
 {
  "id": "P13",
  "product": "Photoshoot",
  "repo": "photoshoot",
  "title": "iOS Safari 100vh put the toolbar under the browser bar",
  "category": "PLAT",
  "severity": "M",
  "detection": "UNK",
  "red": "U",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "3f5104b",
  "source": "3f5104b msg",
  "path": "C"
 },
 {
  "id": "P14",
  "product": "Photoshoot",
  "repo": "photoshoot",
  "title": "Landing shader-failure and delayed-initialisation edge cases",
  "category": "ERR",
  "severity": "M",
  "detection": "REVIEW",
  "red": "T",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "(1.2.0 landing)",
  "source": "HANDOFF.md showcase continuation",
  "path": "D"
 },
 {
  "id": "P15",
  "product": "Photoshoot",
  "repo": "photoshoot",
  "title": "Page changes requested mid-slide were dropped",
  "category": "UI",
  "severity": "L",
  "detection": "UNK",
  "red": "U",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "67c929d",
  "fix": "756f337",
  "source": "756f337 msg",
  "path": "C"
 },
 {
  "id": "P16",
  "product": "Photoshoot",
  "repo": "photoshoot",
  "title": "Graphics reset mid-countdown did not cancel flash and shutter sound",
  "category": "CONC",
  "severity": "L",
  "detection": "REVIEW",
  "red": "U",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "702d5e9",
  "source": "702d5e9 msg (deferred review items)",
  "path": "C"
 },
 {
  "id": "P17",
  "product": "Photoshoot",
  "repo": "photoshoot",
  "title": "Default Windows IR or busy camera ended the start-up attempt",
  "category": "PLAT",
  "severity": "M",
  "detection": "OWNER",
  "red": "U",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "435e81b",
  "source": "435e81b msg",
  "path": "C"
 },
 {
  "id": "G01",
  "product": "CodeAtlas",
  "repo": "GitSpark",
  "title": "Local runner evidence not bound to the execution that produced it",
  "category": "LOGIC",
  "severity": "M",
  "detection": "SELF",
  "red": "RO",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "",
  "fix": "759c749",
  "source": "test 95ef7c4 precedes fix 759c749",
  "path": "C"
 },
 {
  "id": "G02",
  "product": "CodeAtlas",
  "repo": "GitSpark",
  "title": "Runner provenance boundaries not enforced",
  "category": "LOGIC",
  "severity": "M",
  "detection": "SELF",
  "red": "RO",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "",
  "fix": "042493a",
  "source": "test 4decf52 precedes fix 042493a",
  "path": "C"
 },
 {
  "id": "G03",
  "product": "CodeAtlas",
  "repo": "GitSpark",
  "title": "Runtime assertion imports not required (shadowed assertions accepted)",
  "category": "LOGIC",
  "severity": "M",
  "detection": "SELF",
  "red": "RO",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "",
  "fix": "b842f12",
  "source": "test 45870de precedes fix b842f12",
  "path": "C"
 },
 {
  "id": "G04",
  "product": "CodeAtlas",
  "repo": "GitSpark",
  "title": "Generated evidence not bound to the canonical execution",
  "category": "LOGIC",
  "severity": "M",
  "detection": "SELF",
  "red": "RO",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "",
  "fix": "ecdb57d",
  "source": "test 9530fe9 precedes fix ecdb57d",
  "path": "C"
 },
 {
  "id": "G05",
  "product": "CodeAtlas",
  "repo": "GitSpark",
  "title": "Differential evidence not bound to executions",
  "category": "LOGIC",
  "severity": "M",
  "detection": "SELF",
  "red": "RO",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "",
  "fix": "1dcffc8",
  "source": "test 8919aab precedes fix 1dcffc8",
  "path": "C"
 },
 {
  "id": "G06",
  "product": "CodeAtlas",
  "repo": "GitSpark",
  "title": "Serialised digest spoofing accepted in execution results",
  "category": "LOGIC",
  "severity": "M",
  "detection": "SELF",
  "red": "RO",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "",
  "fix": "bd4bb79",
  "source": "test 1b697f8 precedes fix bd4bb79",
  "path": "C"
 },
 {
  "id": "G07",
  "product": "CodeAtlas",
  "repo": "GitSpark",
  "title": "Change Passport publication review findings",
  "category": "LOGIC",
  "severity": "M",
  "detection": "REVIEW",
  "red": "RO",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "1cfa09c",
  "fix": "8d59914",
  "source": "test 60ab075 (\"cover Change Passport review findings\") precedes fix",
  "path": "C"
 },
 {
  "id": "G08",
  "product": "CodeAtlas",
  "repo": "GitSpark",
  "title": "Strict runs not validated; temp-file ownership unprotected",
  "category": "LOGIC",
  "severity": "M",
  "detection": "SELF",
  "red": "RO",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "",
  "fix": "a4be2bb",
  "source": "test e1f63ed precedes fix a4be2bb",
  "path": "C"
 },
 {
  "id": "G09",
  "product": "CodeAtlas",
  "repo": "GitSpark",
  "title": "Artefact cleanup could delete a substituted file after inode reuse (CI 242/243)",
  "category": "CONC",
  "severity": "M",
  "detection": "GATE",
  "red": "RF",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "",
  "fix": "204caba",
  "source": "CI run 37443139235 vs 37453388832; content/projects/codeatlas.json evidence",
  "path": "D"
 },
 {
  "id": "G10",
  "product": "CodeAtlas",
  "repo": "GitSpark",
  "title": "AI-inferred test paths admitted into evidence",
  "category": "LOGIC",
  "severity": "M",
  "detection": "UNK",
  "red": "U",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "7ffa763",
  "fix": "46635d1",
  "source": "46635d1 subject",
  "path": "C"
 },
 {
  "id": "G11",
  "product": "CodeAtlas",
  "repo": "GitSpark",
  "title": "Local test evidence failed open",
  "category": "LOGIC",
  "severity": "M",
  "detection": "UNK",
  "red": "U",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "7aa0d6b",
  "fix": "9e5075a",
  "source": "9e5075a subject",
  "path": "C"
 },
 {
  "id": "G12",
  "product": "CodeAtlas",
  "repo": "GitSpark",
  "title": "Wrapped exports and composed tests not normalised",
  "category": "LOGIC",
  "severity": "L",
  "detection": "UNK",
  "red": "U",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "5698a92",
  "fix": "cec0ec3",
  "source": "cec0ec3 subject",
  "path": "C"
 },
 {
  "id": "G13",
  "product": "CodeAtlas",
  "repo": "GitSpark",
  "title": "Static analysis sites incomplete or duplicated",
  "category": "LOGIC",
  "severity": "M",
  "detection": "UNK",
  "red": "U",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "5698a92",
  "fix": "ba8fa24",
  "source": "ba8fa24 subject",
  "path": "C"
 },
 {
  "id": "G14",
  "product": "CodeAtlas",
  "repo": "GitSpark",
  "title": "Confirmation not bound to cited evidence",
  "category": "LOGIC",
  "severity": "M",
  "detection": "UNK",
  "red": "U",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "303242a",
  "fix": "7b72462",
  "source": "7b72462 subject",
  "path": "C"
 },
 {
  "id": "G15",
  "product": "CodeAtlas",
  "repo": "GitSpark",
  "title": "Evidence provenance invariants not enforced",
  "category": "LOGIC",
  "severity": "M",
  "detection": "UNK",
  "red": "U",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "303242a",
  "fix": "7a727b6",
  "source": "7a727b6 subject",
  "path": "C"
 },
 {
  "id": "G16",
  "product": "CodeAtlas",
  "repo": "GitSpark",
  "title": "Replay did not verify signatures or use the current analysis",
  "category": "LOGIC",
  "severity": "M",
  "detection": "UNK",
  "red": "U",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "",
  "fix": "29ad4d3",
  "source": "29ad4d3 subject",
  "path": "C"
 },
 {
  "id": "A01",
  "product": "Adelante",
  "repo": "Adelante",
  "title": "Widget drifted from the app's current quote (independent rotation and anchor drift)",
  "category": "STALE",
  "severity": "M",
  "detection": "UNK",
  "red": "T",
  "green_over": "N",
  "author": "unknown",
  "attr_tier": "D",
  "intro": "72eb8e8",
  "fix": "82c8e51",
  "source": "82c8e51 subject",
  "path": "C"
 },
 {
  "id": "A02",
  "product": "Adelante",
  "repo": "Adelante",
  "title": "Home favourite pill did not light (stale dailyQuote)",
  "category": "STALE",
  "severity": "L",
  "detection": "UNK",
  "red": "U",
  "green_over": "N",
  "author": "unknown",
  "attr_tier": "D",
  "intro": "",
  "fix": "f4535e9",
  "source": "f4535e9 subject",
  "path": "C"
 },
 {
  "id": "A03",
  "product": "Adelante",
  "repo": "Adelante",
  "title": "Native UIVisualEffect rendered flat inside Flutter",
  "category": "PLAT",
  "severity": "L",
  "detection": "UNK",
  "red": "N",
  "green_over": "N",
  "author": "unknown",
  "attr_tier": "D",
  "intro": "f4535e9",
  "fix": "1c3343b",
  "source": "1c3343b subject",
  "path": "C"
 },
 {
  "id": "A04",
  "product": "Adelante",
  "repo": "Adelante",
  "title": "Soft panels lacked a Material, so tile ink was invisible",
  "category": "UI",
  "severity": "L",
  "detection": "GATE",
  "red": "N",
  "green_over": "N",
  "author": "unknown",
  "attr_tier": "D",
  "intro": "1f6bf6c",
  "fix": "d448de8",
  "source": "d448de8 msg (debug assertion)",
  "path": "C"
 },
 {
  "id": "A05",
  "product": "Adelante",
  "repo": "Adelante",
  "title": "Overlong quotes overflowed widgets; preview and native disagreed on length; fields never bridged",
  "category": "CONTRACT",
  "severity": "M",
  "detection": "SELF",
  "red": "T",
  "green_over": "N",
  "author": "unknown",
  "attr_tier": "D",
  "intro": "72eb8e8",
  "fix": "fd47846",
  "source": "fd47846 msg",
  "path": "C"
 },
 {
  "id": "A06",
  "product": "Adelante",
  "repo": "Adelante",
  "title": "Faith users saw the same 7-12 quotes repeat",
  "category": "LOGIC",
  "severity": "M",
  "detection": "UNK",
  "red": "T",
  "green_over": "N",
  "author": "unknown",
  "attr_tier": "D",
  "intro": "",
  "fix": "3e0d06d",
  "source": "3e0d06d msg",
  "path": "C"
 },
 {
  "id": "A07",
  "product": "Adelante",
  "repo": "Adelante",
  "title": "Widget editor: sideways drag did nothing on full-width text",
  "category": "UI",
  "severity": "M",
  "detection": "OWNER",
  "red": "U",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "f7d479e",
  "source": "docs/design/2026-10-01-completion-pass.md",
  "path": "D"
 },
 {
  "id": "A08",
  "product": "Adelante",
  "repo": "Adelante",
  "title": "Widget editor: vertical drag scrolled the page instead of moving the text",
  "category": "UI",
  "severity": "M",
  "detection": "OWNER",
  "red": "U",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "f7d479e",
  "source": "completion-pass.md",
  "path": "D"
 },
 {
  "id": "K01",
  "product": "Planket",
  "repo": "planket",
  "title": "SceneDelegate used the plain bridge controller, so earlier \"native fixes\" never ran",
  "category": "PLAT",
  "severity": "M",
  "detection": "OWNER",
  "red": "N",
  "green_over": "Y",
  "author": "claude",
  "attr_tier": "A",
  "intro": "31ac493",
  "fix": "6d1ddd1",
  "source": "6d1ddd1 msg",
  "path": "C"
 },
 {
  "id": "K02",
  "product": "Planket",
  "repo": "planket",
  "title": "iOS swallowed first clicks on buttons",
  "category": "PLAT",
  "severity": "M",
  "detection": "OWNER",
  "red": "N",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "6d1ddd1",
  "source": "6d1ddd1 msg",
  "path": "C"
 },
 {
  "id": "K03",
  "product": "Planket",
  "repo": "planket",
  "title": "Google Calendar re-linking was refused silently",
  "category": "ERR",
  "severity": "M",
  "detection": "OWNER",
  "red": "N",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "5cd11ca",
  "source": "5cd11ca msg",
  "path": "C"
 },
 {
  "id": "K04",
  "product": "Planket",
  "repo": "planket",
  "title": "Note-cleanup cron scheduled every minute (avoidable database load and cost)",
  "category": "BUILD",
  "severity": "L",
  "detection": "SELF",
  "red": "N",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "3f670ba",
  "fix": "af926de",
  "source": "af926de msg; 3f670ba msg (\"Codex completion pass\")",
  "path": "C"
 },
 {
  "id": "K05",
  "product": "Planket",
  "repo": "planket",
  "title": "Android sign-in race on first run",
  "category": "CONC",
  "severity": "M",
  "detection": "OWNER",
  "red": "N",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "636da46",
  "source": "636da46 subject",
  "path": "C"
 },
 {
  "id": "K06",
  "product": "Planket",
  "repo": "planket",
  "title": "Onboarding did not save through the live account",
  "category": "LOGIC",
  "severity": "M",
  "detection": "OWNER",
  "red": "N",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "636da46",
  "source": "636da46 subject",
  "path": "C"
 },
 {
  "id": "K07",
  "product": "Planket",
  "repo": "planket",
  "title": "Internal notification helper publicly callable",
  "category": "AUTHZ",
  "severity": "M",
  "detection": "UNK",
  "red": "U",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "3f670ba",
  "source": "docs/HANDOFF.md (migration 0012)",
  "path": "D"
 },
 {
  "id": "K08",
  "product": "Planket",
  "repo": "planket",
  "title": "Failed saves lost input and allowed duplicate retries after partial saves",
  "category": "ERR",
  "severity": "M",
  "detection": "UNK",
  "red": "U",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "3f670ba",
  "source": "HANDOFF.md current pass",
  "path": "D"
 },
 {
  "id": "H01",
  "product": "HACKFAM",
  "repo": "hackathontinder",
  "title": "PUBLIC execute default on private helpers made another person's profile strength readable",
  "category": "AUTHZ",
  "severity": "H",
  "detection": "GATE",
  "red": "RV",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "258d67d",
  "fix": "202610180001 (in c2c128a)",
  "source": "docs/verification/db.md Fix 1 (73/74 red, revert red, permanent proof)",
  "path": "D"
 },
 {
  "id": "H02",
  "product": "HACKFAM",
  "repo": "hackathontinder",
  "title": "Discover deck took 139 s in a realistic pool (timezone catalogue re-read per call)",
  "category": "PERF",
  "severity": "H",
  "detection": "SELF",
  "red": "RM",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "258d67d",
  "fix": "202610180009 (in c2c128a)",
  "source": "db.md Fix 2",
  "path": "D"
 },
 {
  "id": "H03",
  "product": "HACKFAM",
  "repo": "hackathontinder",
  "title": "card_json returned whole rows, leaking recruit codes and GitHub data",
  "category": "PRIV",
  "severity": "H",
  "detection": "REVIEW",
  "red": "U",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "258d67d",
  "fix": "(contract v1.1 DTOs)",
  "source": "docs/reviews/2026-10-18-spec-review-contract-architecture.md; spec-rework.md P0-05",
  "path": "D"
 },
 {
  "id": "H04",
  "product": "HACKFAM",
  "repo": "hackathontinder",
  "title": "Read-receipt preference stored but never enforced",
  "category": "PRIV",
  "severity": "M",
  "detection": "REVIEW",
  "red": "U",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "258d67d",
  "fix": "(contract v1.1)",
  "source": "spec-rework.md D2",
  "path": "D"
 },
 {
  "id": "H05",
  "product": "HACKFAM",
  "repo": "hackathontinder",
  "title": "Raw Postgres constraint errors leaked to clients",
  "category": "ERR",
  "severity": "L",
  "detection": "REVIEW",
  "red": "U",
  "green_over": "N",
  "author": "codex",
  "attr_tier": "B",
  "intro": "258d67d",
  "fix": "(api reconcile A raise_input)",
  "source": "spec-review-contract-architecture.md; db-v1.1.md DB-2a",
  "path": "D"
 },
 {
  "id": "H06",
  "product": "HACKFAM",
  "repo": "hackathontinder",
  "title": "Crew-chat blocked-sender badge test only exercised a closed match, so it could not fail",
  "category": "TEST",
  "severity": "M",
  "detection": "SELF",
  "red": "RV",
  "green_over": "Y",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "",
  "source": "docs/verification/db-v1.1.md",
  "path": "D"
 },
 {
  "id": "H07",
  "product": "HACKFAM",
  "repo": "hackathontinder",
  "title": "Pool-alert proof masked by the dedupe key",
  "category": "TEST",
  "severity": "L",
  "detection": "SELF",
  "red": "RV",
  "green_over": "Y",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "",
  "source": "db-v1.1.md",
  "path": "D"
 },
 {
  "id": "H08",
  "product": "HACKFAM",
  "repo": "hackathontinder",
  "title": "Four mutations survived (32 of 36 red), exposing weak function tests",
  "category": "TEST",
  "severity": "M",
  "detection": "SELF",
  "red": "RV",
  "green_over": "Y",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "",
  "source": "docs/verification/functions-v1.1.md v11e",
  "path": "D"
 },
 {
  "id": "H09",
  "product": "HACKFAM",
  "repo": "hackathontinder",
  "title": "Team admission accepts only forming teams, contradicting the venue-formation decision (open)",
  "category": "LOGIC",
  "severity": "M",
  "detection": "SELF",
  "red": "X",
  "green_over": "N",
  "author": "claude",
  "attr_tier": "C",
  "intro": "",
  "fix": "",
  "source": "db-v1.1.md open issue",
  "path": "D"
 }
]