{
  "_doc": "Phase 17 cross-lang recall-validation baseline for apache/airflow (Python). Re-capture by running scripts/validate_recall.sh --lang python airflow <clone_path> --capture.",
  "target": "airflow",
  "lang": "python",
  "clone_url": "https://github.com/apache/airflow",
  "exercises_recall_items": [],
  "captured_against": "real-scan @ 3d42610a26e4a8e49e2cf3d9eb6fc5ad712f180e",
  "captured_on": "2026-05-09",
  "pinned_commit": "3d42610a26e4a8e49e2cf3d9eb6fc5ad712f180e",
  "findings": [
    {
      "rule_id": "taint-header-injection",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/execution_api/app.py",
      "line": 125,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-header-injection",
      "path_suffix": "providers/fab/src/airflow/providers/fab/auth_manager/api/auth/backend/kerberos_auth.py",
      "line": 141,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "dev/backport/update_backport_status.py",
      "line": 123,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "providers/apache/druid/src/airflow/providers/apache/druid/hooks/druid.py",
      "line": 168,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "providers/apache/druid/src/airflow/providers/apache/druid/hooks/druid.py",
      "line": 174,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "dev/breeze/src/airflow_breeze/utils/selective_checks.py",
      "line": 1606,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "dev/breeze/src/airflow_breeze/utils/selective_checks.py",
      "line": 1621,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "registry/src/js/provider-detail.js",
      "line": 60,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/execution_api/routes/task_instances.py",
      "line": 433,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "registry/src/js/provider-detail.js",
      "line": 65,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "devel-common/src/tests_common/test_utils/get_all_tests.py",
      "line": 77,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "dev/validate_version_added_fields_in_config.py",
      "line": 94,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "shared/configuration/src/airflow_shared/configuration/parser.py",
      "line": 1052,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "dev/breeze/src/airflow_breeze/utils/workflow_status.py",
      "line": 133,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "devel-common/src/tests_common/pytest_plugin.py",
      "line": 197,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "devel-common/src/tests_common/pytest_plugin.py",
      "line": 201,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-ctl/src/airflowctl/api/client.py",
      "line": 208,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-ctl/src/airflowctl/api/client.py",
      "line": 216,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-ctl/src/airflowctl/api/client.py",
      "line": 254,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-ctl/src/airflowctl/api/client.py",
      "line": 255,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-ctl/src/airflowctl/api/client.py",
      "line": 266,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-ctl/src/airflowctl/api/client.py",
      "line": 267,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "devel-common/src/tests_common/pytest_plugin.py",
      "line": 468,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-ctl/src/airflowctl/api/client.py",
      "line": 496,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/configuration.py",
      "line": 638,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "devel-common/src/sphinx_exts/extra_provider_files_with_substitutions.py",
      "line": 60,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "providers/cncf/kubernetes/src/airflow/providers/cncf/kubernetes/operators/pod.py",
      "line": 881,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "dev/backport/update_backport_status.py",
      "line": 109,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-header-injection",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/auth/middlewares/refresh_token.py",
      "line": 66,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-header-injection",
      "path_suffix": "providers/keycloak/src/airflow/providers/keycloak/auth_manager/routes/login.py",
      "line": 112,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-header-injection",
      "path_suffix": "providers/keycloak/src/airflow/providers/keycloak/auth_manager/routes/login.py",
      "line": 113,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-header-injection",
      "path_suffix": "providers/keycloak/src/airflow/providers/keycloak/auth_manager/routes/login.py",
      "line": 115,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-header-injection",
      "path_suffix": "providers/keycloak/src/airflow/providers/keycloak/auth_manager/routes/login.py",
      "line": 119,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/execution_api/routes/task_instances.py",
      "line": 1199,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "task-sdk/src/airflow/sdk/definitions/dag.py",
      "line": 1294,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "devel-common/src/tests_common/test_utils/api_client_helpers.py",
      "line": 125,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "devel-common/src/tests_common/test_utils/api_client_helpers.py",
      "line": 147,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/cli/hot_reload.py",
      "line": 160,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/utils/db.py",
      "line": 1598,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/utils/db.py",
      "line": 1602,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/utils/db.py",
      "line": 1604,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/utils/db.py",
      "line": 1605,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/utils/db.py",
      "line": 1610,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/utils/db.py",
      "line": 1612,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/utils/db.py",
      "line": 1614,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "devel-common/src/tests_common/pytest_plugin.py",
      "line": 1809,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "devel-common/src/tests_common/pytest_plugin.py",
      "line": 1810,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/public/backfills.py",
      "line": 208,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/models/dagrun.py",
      "line": 1926,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/models/backfill.py",
      "line": 376,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/public/dag_run.py",
      "line": 223,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/jobs/scheduler_job_runner.py",
      "line": 2197,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/ui/dags.py",
      "line": 221,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/jobs/scheduler_job_runner.py",
      "line": 2444,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/models/trigger.py",
      "line": 251,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/ui/dags.py",
      "line": 243,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "dev/breeze/src/airflow_breeze/utils/github.py",
      "line": 288,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/models/renderedtifields.py",
      "line": 293,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/jobs/scheduler_job_runner.py",
      "line": 2840,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "providers/dbt/cloud/src/airflow/providers/dbt/cloud/hooks/dbt.py",
      "line": 324,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "dev/breeze/src/airflow_breeze/utils/github.py",
      "line": 325,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "dev/breeze/src/airflow_breeze/utils/github.py",
      "line": 335,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "providers/amazon/src/airflow/providers/amazon/aws/hooks/base_aws.py",
      "line": 363,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "dev/breeze/src/airflow_breeze/utils/github.py",
      "line": 360,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/models/variable.py",
      "line": 390,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "devel-common/src/tests_common/test_utils/otel_utils.py",
      "line": 45,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 515,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 520,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 521,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "providers/fab/src/airflow/providers/fab/auth_manager/security_manager/override.py",
      "line": 576,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/models/backfill.py",
      "line": 661,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "providers/fab/src/airflow/providers/fab/auth_manager/cli_commands/permissions_command.py",
      "line": 84,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "providers/fab/src/airflow/providers/fab/auth_manager/cli_commands/permissions_command.py",
      "line": 90,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "providers/fab/src/airflow/providers/fab/auth_manager/cli_commands/permissions_command.py",
      "line": 97,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "providers/fab/src/airflow/providers/fab/auth_manager/cli_commands/permissions_command.py",
      "line": 100,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/utils/db_cleanup.py",
      "line": 664,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "providers/standard/src/airflow/providers/standard/hooks/subprocess.py",
      "line": 82,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-use-after-close",
      "path_suffix": "providers/apache/hive/src/airflow/providers/apache/hive/transfers/vertica_to_hive.py",
      "line": 123,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-use-after-close",
      "path_suffix": "providers/microsoft/azure/src/airflow/providers/microsoft/azure/transfers/oracle_to_azure_data_lake.py",
      "line": 103,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-use-after-close",
      "path_suffix": "providers/oracle/src/airflow/providers/oracle/transfers/oracle_to_oracle.py",
      "line": 89,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-use-after-close",
      "path_suffix": "providers/teradata/src/airflow/providers/teradata/transfers/teradata_to_teradata.py",
      "line": 89,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-header-injection",
      "path_suffix": "providers/amazon/src/airflow/providers/amazon/aws/auth_manager/routes/login.py",
      "line": 113,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-header-injection",
      "path_suffix": "providers/amazon/src/airflow/providers/amazon/aws/auth_manager/routes/login.py",
      "line": 114,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-header-injection",
      "path_suffix": "providers/amazon/src/airflow/providers/amazon/aws/auth_manager/routes/login.py",
      "line": 116,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/api/common/delete_dag.py",
      "line": 85,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-ctl/src/airflowctl/ctl/commands/auth_command.py",
      "line": 154,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-ctl/src/airflowctl/ctl/commands/auth_command.py",
      "line": 169,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/jobs/scheduler_job_runner.py",
      "line": 2390,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/dag_processing/bundles/manager.py",
      "line": 295,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/ui/grid.py",
      "line": 329,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/jobs/scheduler_job_runner.py",
      "line": 780,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/utils/db_cleanup.py",
      "line": 639,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/src/airflow/utils/db_cleanup.py",
      "line": 648,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "dev/breeze/src/airflow_breeze/utils/constraints_version_check.py",
      "line": 459,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "dev/registry/extract_metadata.py",
      "line": 63,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "dev/registry/extract_metadata.py",
      "line": 79,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "dev/registry/extract_metadata.py",
      "line": 179,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/apache/pinot/src/airflow/providers/apache/pinot/hooks/pinot.py",
      "line": 259,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/apache/spark/src/airflow/providers/apache/spark/hooks/spark_submit.py",
      "line": 848,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "go.cmdi.exec_command",
      "path_suffix": "go-sdk/pkg/bundles/shared/discovery.go",
      "line": 209,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.code_exec.exec",
      "path_suffix": "airflow-core/src/airflow/policies.py",
      "line": 179,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.deser.pickle_loads",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0055_3_0_0_remove_pickled_data_from_dagrun_table.py",
      "line": 97,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.deser.pickle_loads",
      "path_suffix": "dev/stats/get_important_pr_candidates.py",
      "line": 1004,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/src/airflow/api/common/mark_tasks.py",
      "line": 329,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/src/airflow/api/common/trigger_dag.py",
      "line": 109,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/src/airflow/api/common/trigger_dag.py",
      "line": 115,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/services/ui/structure.py",
      "line": 174,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/src/airflow/models/backfill.py",
      "line": 400,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/src/airflow/models/backfill.py",
      "line": 417,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/src/airflow/models/backfill.py",
      "line": 481,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/src/airflow/models/backfill.py",
      "line": 501,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/src/airflow/models/backfill.py",
      "line": 568,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/src/airflow/models/taskinstance.py",
      "line": 393,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/src/airflow/utils/db.py",
      "line": 1074,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/src/airflow/utils/db.py",
      "line": 1079,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "dev/breeze/src/airflow_breeze/utils/recording.py",
      "line": 51,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "devel-common/src/tests_common/pytest_plugin.py",
      "line": 1278,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "providers/databricks/src/airflow/providers/databricks/utils/openlineage.py",
      "line": 236,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "providers/fab/src/airflow/providers/fab/auth_manager/cli_commands/permissions_command.py",
      "line": 61,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "providers/fab/src/airflow/providers/fab/auth_manager/cli_commands/permissions_command.py",
      "line": 79,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "providers/keycloak/src/airflow/providers/keycloak/auth_manager/cli/commands.py",
      "line": 556,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "task-sdk/src/airflow/sdk/execution_time/task_runner.py",
      "line": 1266,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/src/airflow/api/common/trigger_dag.py",
      "line": 115,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/auth/managers/simple/routes/login.py",
      "line": 78,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/auth/managers/simple/routes/login.py",
      "line": 96,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/public/assets.py",
      "line": 439,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/public/auth.py",
      "line": 80,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/public/dag_run.py",
      "line": 604,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/public/task_instances.py",
      "line": 887,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/ui/config.py",
      "line": 67,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/ui/dags.py",
      "line": 260,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/services/ui/structure.py",
      "line": 174,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/logging/decorators.py",
      "line": 169,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/src/airflow/cli/commands/task_command.py",
      "line": 226,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/src/airflow/models/backfill.py",
      "line": 435,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/src/airflow/models/backfill.py",
      "line": 501,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/src/airflow/models/taskinstance.py",
      "line": 393,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/src/airflow/settings.py",
      "line": 623,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/src/airflow/utils/db.py",
      "line": 711,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/src/airflow/utils/db.py",
      "line": 736,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/src/airflow/utils/db.py",
      "line": 1079,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/src/airflow/utils/db_cleanup.py",
      "line": 278,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "dev/airflow_perf/scheduler_dag_execution_timing.py",
      "line": 303,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "dev/assign_cherry_picked_prs_with_milestone.py",
      "line": 360,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "dev/breeze/src/airflow_breeze/commands/ci_commands.py",
      "line": 1323,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "dev/breeze/src/airflow_breeze/commands/pr_commands.py",
      "line": 352,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "dev/breeze/src/airflow_breeze/commands/pr_commands.py",
      "line": 686,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "dev/breeze/src/airflow_breeze/commands/pr_commands.py",
      "line": 1064,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "dev/breeze/src/airflow_breeze/commands/release_management_commands.py",
      "line": 2697,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "dev/breeze/src/airflow_breeze/commands/release_management_commands.py",
      "line": 3290,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "dev/breeze/src/airflow_breeze/commands/release_management_commands.py",
      "line": 4491,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "dev/breeze/src/airflow_breeze/commands/sbom_commands.py",
      "line": 954,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "dev/breeze/src/airflow_breeze/commands/sbom_commands.py",
      "line": 1056,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "dev/breeze/src/airflow_breeze/prepare_providers/provider_documentation.py",
      "line": 1087,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "dev/breeze/src/airflow_breeze/utils/github.py",
      "line": 310,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "dev/prepare_bulk_issues.py",
      "line": 224,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "devel-common/src/tests_common/pytest_plugin.py",
      "line": 1366,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "devel-common/src/tests_common/test_utils/system_tests.py",
      "line": 81,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "providers/databricks/src/airflow/providers/databricks/utils/openlineage.py",
      "line": 236,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "providers/edge3/src/airflow/providers/edge3/plugins/edge_executor_plugin.py",
      "line": 45,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "providers/fab/src/airflow/providers/fab/auth_manager/api_fastapi/routes/login.py",
      "line": 79,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "providers/fab/src/airflow/providers/fab/auth_manager/api_fastapi/routes/login.py",
      "line": 91,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "providers/fab/src/airflow/providers/fab/auth_manager/api_fastapi/routes/login.py",
      "line": 115,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "providers/fab/src/airflow/providers/fab/auth_manager/api_fastapi/routes/roles.py",
      "line": 52,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "providers/fab/src/airflow/providers/fab/auth_manager/api_fastapi/routes/roles.py",
      "line": 92,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "providers/fab/src/airflow/providers/fab/auth_manager/api_fastapi/routes/users.py",
      "line": 51,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "providers/fab/src/airflow/providers/fab/auth_manager/api_fastapi/routes/users.py",
      "line": 113,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "providers/fab/src/airflow/providers/fab/auth_manager/api_fastapi/routes/users.py",
      "line": 131,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "providers/keycloak/src/airflow/providers/keycloak/auth_manager/routes/login.py",
      "line": 167,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "providers/openlineage/src/airflow/providers/openlineage/utils/spark.py",
      "line": 321,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "providers/openlineage/src/airflow/providers/openlineage/utils/spark.py",
      "line": 356,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "providers/sendgrid/src/airflow/providers/sendgrid/utils/emailer.py",
      "line": 121,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "providers/snowflake/src/airflow/providers/snowflake/utils/openlineage.py",
      "line": 325,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "task-sdk/src/airflow/sdk/bases/operator.py",
      "line": 171,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "task-sdk/src/airflow/sdk/definitions/param.py",
      "line": 382,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "task-sdk/src/airflow/sdk/execution_time/task_runner.py",
      "line": 1266,
      "severity": "High",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "scripts/ci/airflow_version_check.py",
      "line": 113,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "scripts/in_container/run_capture_airflowctl_help.py",
      "line": 160,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "scripts/in_container/update_quarantined_test_status.py",
      "line": 181,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "scripts/in_container/update_quarantined_test_status.py",
      "line": 245,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "scripts/in_container/bin/generate_mprocs_config.py",
      "line": 221,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "providers/google/tests/system/google/cloud/gcs/resources/transform_script.py",
      "line": 25,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "scripts/in_container/run_generate_constraints.py",
      "line": 249,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "devel-common/src/docs/build_docs.py",
      "line": 289,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "scripts/in_container/install_airflow_and_providers.py",
      "line": 291,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "scripts/ci/prek/upgrade_important_versions.py",
      "line": 318,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "scripts/in_container/check_junitxml_result.py",
      "line": 30,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "scripts/ci/prek/vendor_k8s_json_schema.py",
      "line": 58,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-template-injection",
      "path_suffix": "providers/google/tests/system/google/cloud/data_loss_prevention/example_dlp_inspect_template.py",
      "line": 85,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-template-injection",
      "path_suffix": "providers/google/tests/system/google/cloud/data_loss_prevention/example_dlp_deidentify_content.py",
      "line": 128,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-template-injection",
      "path_suffix": "providers/google/tests/system/google/cloud/data_loss_prevention/example_dlp_inspect_template.py",
      "line": 85,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-template-injection",
      "path_suffix": "providers/google/tests/system/google/cloud/data_loss_prevention/example_dlp_deidentify_content.py",
      "line": 128,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "scripts/ci/prek/compile_provider_assets.py",
      "line": 145,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "scripts/ci/docs/store_stable_versions.py",
      "line": 184,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-ctl/tests/airflow_ctl/api/test_client.py",
      "line": 141,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-ctl/tests/airflow_ctl/api/test_client.py",
      "line": 171,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-ctl/tests/airflow_ctl/api/test_client.py",
      "line": 192,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "scripts/ci/slack_notification_state.py",
      "line": 208,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-ctl/tests/airflow_ctl/api/test_client.py",
      "line": 246,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-ctl/tests/airflow_ctl/api/test_client.py",
      "line": 261,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-ctl/tests/airflow_ctl/api/test_client.py",
      "line": 276,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "providers/google/tests/system/google/cloud/dataprep/example_dataprep.py",
      "line": 279,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "task-sdk-integration-tests/tests/task_sdk_tests/conftest.py",
      "line": 356,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/dags/test_on_failure_callback.py",
      "line": 39,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "scripts/ci/notify_uv_lock_conflicts.py",
      "line": 455,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "scripts/ci/analyze_e2e_flaky_tests.py",
      "line": 521,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/integration/otel/test_otel.py",
      "line": 491,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "scripts/ci/analyze_e2e_flaky_tests.py",
      "line": 562,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "scripts/tools/generate-integrations-json.py",
      "line": 71,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "scripts/ci/analyze_e2e_flaky_tests.py",
      "line": 569,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "scripts/ci/prek/compile_ui_assets_dev.py",
      "line": 84,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "scripts/ci/prek/compile_ui_assets_dev.py",
      "line": 101,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "scripts/in_container/run_capture_airflowctl_help.py",
      "line": 70,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-open-redirect",
      "path_suffix": "providers/keycloak/src/airflow/providers/keycloak/auth_manager/routes/login.py",
      "line": 147,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "scripts/in_container/run_provider_yaml_files_check.py",
      "line": 1040,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "providers/google/tests/system/google/gcp_api_client_helpers.py",
      "line": 104,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 1210,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 1246,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "providers/google/tests/system/google/gcp_api_client_helpers.py",
      "line": 126,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/models/test_dag.py",
      "line": 1289,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 1321,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 1350,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 1386,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 1574,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 1632,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 1682,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 1738,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "providers/apache/cassandra/tests/integration/apache/cassandra/hooks/test_cassandra.py",
      "line": 180,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 1769,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 1797,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 1804,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 1856,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 1883,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 1909,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "providers/apache/cassandra/tests/integration/apache/cassandra/hooks/test_cassandra.py",
      "line": 197,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 1972,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 2077,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 2090,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 2101,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 2113,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 2125,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "providers/apache/cassandra/tests/integration/apache/cassandra/hooks/test_cassandra.py",
      "line": 213,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 2156,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 2183,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 2220,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 2249,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "providers/apache/cassandra/tests/integration/apache/cassandra/hooks/test_cassandra.py",
      "line": 229,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 2278,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 2311,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 2348,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 2372,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 2388,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "providers/apache/cassandra/tests/integration/apache/cassandra/hooks/test_cassandra.py",
      "line": 246,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 2443,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "providers/fab/tests/unit/fab/auth_manager/cli_commands/test_permissions_command.py",
      "line": 283,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 2947,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 2980,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "providers/fab/tests/unit/fab/auth_manager/cli_commands/test_permissions_command.py",
      "line": 322,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/models/test_dag.py",
      "line": 3255,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/models/test_renderedtifields.py",
      "line": 343,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/models/test_renderedtifields.py",
      "line": 362,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/utils/test_db_cleanup.py",
      "line": 408,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 4022,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 4067,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 4134,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 4135,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 4193,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/api_fastapi/common/test_exceptions.py",
      "line": 431,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 4477,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 4517,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 4633,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 4668,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/cli/commands/test_pool_command.py",
      "line": 51,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "providers/apache/cassandra/tests/integration/apache/cassandra/hooks/test_cassandra.py",
      "line": 70,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/utils/test_sqlalchemy.py",
      "line": 88,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "kubernetes-tests/tests/kubernetes_tests/test_base.py",
      "line": 100,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/models/test_dag.py",
      "line": 1012,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "taint-template-injection",
      "path_suffix": "scripts/in_container/update_quarantined_test_status.py",
      "line": 246,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "scripts/ci/prek/upgrade_important_versions.py",
      "line": 256,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "registry/src/js/copy-button.js",
      "line": 27,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "registry/src/js/copy-button.js",
      "line": 39,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-open-redirect",
      "path_suffix": "providers/fab/src/airflow/providers/fab/www/auth.py",
      "line": 151,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-open-redirect",
      "path_suffix": "providers/fab/src/airflow/providers/fab/www/auth.py",
      "line": 93,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-unsanitised-flow",
      "path_suffix": "airflow-core/tests/unit/models/test_backfill.py",
      "line": 382,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "state-double-close",
      "path_suffix": "dev/breeze/src/airflow_breeze/utils/kubernetes_utils.py",
      "line": 366,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-double-close",
      "path_suffix": "providers/apache/hive/src/airflow/providers/apache/hive/transfers/vertica_to_hive.py",
      "line": 132,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-double-close",
      "path_suffix": "providers/microsoft/azure/src/airflow/providers/microsoft/azure/transfers/oracle_to_azure_data_lake.py",
      "line": 111,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-double-close",
      "path_suffix": "providers/teradata/src/airflow/providers/teradata/transfers/teradata_to_teradata.py",
      "line": 102,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/app.py",
      "line": 71,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/auth/tokens.py",
      "line": 167,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/common/cursors.py",
      "line": 158,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/public/dag_run.py",
      "line": 511,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/public/task_instances.py",
      "line": 592,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/src/airflow/cli/commands/info_command.py",
      "line": 200,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/src/airflow/cli/commands/standalone_command.py",
      "line": 297,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/src/airflow/configuration.py",
      "line": 134,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/src/airflow/dag_processing/bundles/base.py",
      "line": 169,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/src/airflow/dag_processing/bundles/base.py",
      "line": 444,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/src/airflow/dag_processing/importers/base.py",
      "line": 175,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/src/airflow/dag_processing/importers/python_importer.py",
      "line": 287,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/src/airflow/example_dags/tutorial_objectstorage.py",
      "line": 120,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/src/airflow/jobs/triggerer_job_runner.py",
      "line": 360,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/src/airflow/utils/db.py",
      "line": 1327,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/src/airflow/utils/db_manager.py",
      "line": 145,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/src/airflow/utils/db_manager.py",
      "line": 265,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/src/airflow/utils/log/file_task_handler.py",
      "line": 894,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/src/airflow/utils/log/log_stream_accumulator.py",
      "line": 76,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/src/airflow/utils/thread_safe_dict.py",
      "line": 27,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-ctl/src/airflowctl/api/client.py",
      "line": 266,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "dev/breeze/src/airflow_breeze/utils/add_back_references.py",
      "line": 39,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "dev/breeze/src/airflow_breeze/utils/airflow_release_validator.py",
      "line": 187,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "dev/breeze/src/airflow_breeze/utils/docker_compose_utils.py",
      "line": 97,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "dev/breeze/src/airflow_breeze/utils/github.py",
      "line": 297,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "dev/breeze/src/airflow_breeze/utils/kubernetes_utils.py",
      "line": 182,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "dev/breeze/src/airflow_breeze/utils/release_validator.py",
      "line": 373,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "go-sdk/pkg/worker/runner.go",
      "line": 240,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "go-sdk/pkg/worker/runner.go",
      "line": 459,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/amazon/src/airflow/providers/amazon/aws/hooks/s3.py",
      "line": 1211,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/amazon/src/airflow/providers/amazon/aws/hooks/s3.py",
      "line": 1619,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/amazon/src/airflow/providers/amazon/aws/hooks/sagemaker.py",
      "line": 179,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/amazon/src/airflow/providers/amazon/aws/transfers/dynamodb_to_s3.py",
      "line": 219,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/amazon/src/airflow/providers/amazon/aws/transfers/dynamodb_to_s3.py",
      "line": 248,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/amazon/src/airflow/providers/amazon/aws/transfers/ftp_to_s3.py",
      "line": 1,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/amazon/src/airflow/providers/amazon/aws/transfers/ftp_to_s3.py",
      "line": 99,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/apache/beam/src/airflow/providers/apache/beam/hooks/beam.py",
      "line": 1,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/apache/cassandra/src/airflow/providers/apache/cassandra/hooks/cassandra.py",
      "line": 129,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/apache/hive/src/airflow/providers/apache/hive/hooks/hive.py",
      "line": 329,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/apache/hive/src/airflow/providers/apache/hive/hooks/hive.py",
      "line": 588,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/apache/hive/src/airflow/providers/apache/hive/hooks/hive.py",
      "line": 1006,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/apache/hive/src/airflow/providers/apache/hive/transfers/s3_to_hive.py",
      "line": 207,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/apache/hive/src/airflow/providers/apache/hive/transfers/s3_to_hive.py",
      "line": 272,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/apache/pig/src/airflow/providers/apache/pig/hooks/pig.py",
      "line": 28,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/apache/pinot/src/airflow/providers/apache/pinot/hooks/pinot.py",
      "line": 259,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/apache/pinot/src/airflow/providers/apache/pinot/hooks/pinot.py",
      "line": 300,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/apache/spark/src/airflow/providers/apache/spark/hooks/spark_pipelines.py",
      "line": 93,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/apache/spark/src/airflow/providers/apache/spark/hooks/spark_sql.py",
      "line": 202,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/apache/spark/src/airflow/providers/apache/spark/hooks/spark_submit.py",
      "line": 356,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/apache/spark/src/airflow/providers/apache/spark/hooks/spark_submit.py",
      "line": 604,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/apache/spark/src/airflow/providers/apache/spark/hooks/spark_submit.py",
      "line": 777,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/cncf/kubernetes/src/airflow/providers/cncf/kubernetes/hooks/kubernetes.py",
      "line": 968,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/cncf/kubernetes/src/airflow/providers/cncf/kubernetes/operators/pod.py",
      "line": 881,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/cncf/kubernetes/src/airflow/providers/cncf/kubernetes/pod_generator.py",
      "line": 554,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/common/io/src/airflow/providers/common/io/xcom/backend.py",
      "line": 173,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/databricks/src/airflow/providers/databricks/hooks/databricks_sql.py",
      "line": 175,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/databricks/src/airflow/providers/databricks/operators/databricks_sql.py",
      "line": 1,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/docker/src/airflow/providers/docker/operators/docker.py",
      "line": 482,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/edge3/src/airflow/providers/edge3/cli/worker.py",
      "line": 310,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/edge3/src/airflow/providers/edge3/example_dags/win_test.py",
      "line": 226,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/elasticsearch/src/airflow/providers/elasticsearch/log/es_task_handler.py",
      "line": 536,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/fab/src/airflow/providers/fab/auth_manager/fab_auth_manager.py",
      "line": 182,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/fab/src/airflow/providers/fab/www/extensions/init_appbuilder.py",
      "line": 62,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/ftp/src/airflow/providers/ftp/hooks/ftp.py",
      "line": 32,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/ftp/src/airflow/providers/ftp/hooks/ftp.py",
      "line": 78,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/git/src/airflow/providers/git/hooks/git.py",
      "line": 172,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/github/src/airflow/providers/github/hooks/github.py",
      "line": 65,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/hooks/cloud_sql.py",
      "line": 487,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/hooks/cloud_sql.py",
      "line": 650,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/hooks/cloud_sql.py",
      "line": 1260,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/hooks/gcs.py",
      "line": 582,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/log/gcs_task_handler.py",
      "line": 188,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/operators/gen_ai.py",
      "line": 973,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/transfers/calendar_to_gcs.py",
      "line": 194,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/transfers/cassandra_to_gcs.py",
      "line": 196,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/transfers/cassandra_to_gcs.py",
      "line": 229,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/transfers/facebook_ads_to_gcs.py",
      "line": 225,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/transfers/gcs_to_sftp.py",
      "line": 201,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/transfers/sftp_to_gcs.py",
      "line": 191,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/transfers/sheets_to_gcs.py",
      "line": 1,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/utils/credentials_provider.py",
      "line": 1,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/suite/transfers/gcs_to_gdrive.py",
      "line": 1,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/suite/transfers/gcs_to_gdrive.py",
      "line": 165,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/grpc/src/airflow/providers/grpc/hooks/grpc.py",
      "line": 96,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/keycloak/src/airflow/providers/keycloak/auth_manager/cache.py",
      "line": 30,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/microsoft/azure/src/airflow/providers/microsoft/azure/transfers/oracle_to_azure_data_lake.py",
      "line": 85,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/microsoft/azure/src/airflow/providers/microsoft/azure/transfers/s3_to_wasb.py",
      "line": 235,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/microsoft/azure/src/airflow/providers/microsoft/azure/transfers/sftp_to_wasb.py",
      "line": 181,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/mysql/src/airflow/providers/mysql/hooks/mysql.py",
      "line": 238,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/mysql/src/airflow/providers/mysql/hooks/mysql.py",
      "line": 247,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/mysql/src/airflow/providers/mysql/hooks/mysql.py",
      "line": 272,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/mysql/src/airflow/providers/mysql/hooks/mysql.py",
      "line": 311,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/mysql/src/airflow/providers/mysql/transfers/vertica_to_mysql.py",
      "line": 135,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/openlineage/src/airflow/providers/openlineage/plugins/adapter.py",
      "line": 128,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/opensearch/src/airflow/providers/opensearch/log/os_task_handler.py",
      "line": 455,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/oracle/src/airflow/providers/oracle/hooks/oracle.py",
      "line": 285,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/oracle/src/airflow/providers/oracle/transfers/oracle_to_oracle.py",
      "line": 31,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/postgres/src/airflow/providers/postgres/hooks/postgres.py",
      "line": 270,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/postgres/src/airflow/providers/postgres/hooks/postgres.py",
      "line": 273,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/postgres/src/airflow/providers/postgres/hooks/postgres.py",
      "line": 286,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/postgres/src/airflow/providers/postgres/hooks/postgres.py",
      "line": 393,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/presto/src/airflow/providers/presto/hooks/presto.py",
      "line": 90,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/samba/src/airflow/providers/samba/transfers/gcs_to_samba.py",
      "line": 201,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/sftp/src/airflow/providers/sftp/hooks/sftp.py",
      "line": 789,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/smtp/src/airflow/providers/smtp/hooks/smtp.py",
      "line": 573,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/ssh/src/airflow/providers/ssh/hooks/ssh.py",
      "line": 351,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/ssh/src/airflow/providers/ssh/hooks/ssh.py",
      "line": 635,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/ssh/src/airflow/providers/ssh/tunnel.py",
      "line": 141,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/standard/src/airflow/providers/standard/sensors/bash.py",
      "line": 1,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/teradata/src/airflow/providers/teradata/hooks/teradata.py",
      "line": 172,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "providers/trino/src/airflow/providers/trino/hooks/trino.py",
      "line": 92,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "shared/configuration/src/airflow_shared/configuration/parser.py",
      "line": 120,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "task-sdk/src/airflow/sdk/execution_time/supervisor.py",
      "line": 235,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "task-sdk/src/airflow/sdk/execution_time/supervisor.py",
      "line": 255,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "task-sdk/src/airflow/sdk/execution_time/supervisor.py",
      "line": 489,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "task-sdk/src/airflow/sdk/execution_time/supervisor.py",
      "line": 490,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "task-sdk/src/airflow/sdk/execution_time/supervisor.py",
      "line": 491,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "task-sdk/src/airflow/sdk/execution_time/supervisor.py",
      "line": 1721,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "task-sdk/src/airflow/sdk/execution_time/supervisor.py",
      "line": 1800,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "task-sdk/src/airflow/sdk/execution_time/task_runner.py",
      "line": 1936,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "task-sdk/src/airflow/sdk/io/path.py",
      "line": 352,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "task-sdk/src/airflow/sdk/io/path.py",
      "line": 411,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 4217,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 4269,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-ctl-tests/tests/airflowctl_tests/conftest.py",
      "line": 76,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "scripts/ci/prek/compile_ui_assets.py",
      "line": 89,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "taint-data-exfiltration",
      "path_suffix": "providers/google/tests/system/google/cloud/dataprep/example_dataprep.py",
      "line": 167,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "cfg-error-fallthrough",
      "path_suffix": "airflow-core/src/airflow/utils/process_utils.py",
      "line": 95,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-error-fallthrough",
      "path_suffix": "airflow-core/src/airflow/utils/process_utils.py",
      "line": 110,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "airflow-core/src/airflow/cli/commands/standalone_command.py",
      "line": 246,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "airflow-core/src/airflow/cli/hot_reload.py",
      "line": 160,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "airflow-core/src/airflow/dag_processing/manager.py",
      "line": 1177,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "airflow-core/src/airflow/jobs/triggerer_job_runner.py",
      "line": 363,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "airflow-core/src/airflow/utils/file.py",
      "line": 73,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "airflow-core/src/airflow/utils/file.py",
      "line": 74,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "dev/breeze/src/airflow_breeze/utils/confirm.py",
      "line": 382,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "dev/breeze/src/airflow_breeze/utils/confirm.py",
      "line": 390,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "dev/breeze/src/airflow_breeze/utils/console.py",
      "line": 87,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "dev/ide_setup/setup_idea.py",
      "line": 523,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "dev/ide_setup/setup_idea.py",
      "line": 535,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "dev/ide_setup/setup_idea.py",
      "line": 545,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "devel-common/src/sphinx_exts/airflow_intersphinx.py",
      "line": 93,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "devel-common/src/sphinx_exts/exampleinclude.py",
      "line": 271,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "devel-common/src/sphinx_exts/extra_files_with_substitutions.py",
      "line": 57,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "devel-common/src/sphinx_exts/extra_provider_files_with_substitutions.py",
      "line": 87,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "devel-common/src/sphinx_exts/generate_erd.py",
      "line": 173,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "devel-common/src/sphinx_exts/metrics_tables_from_registry.py",
      "line": 28,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "devel-common/src/sphinx_exts/pagefind_search/__init__.py",
      "line": 94,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "devel-common/src/sphinx_exts/pagefind_search/__init__.py",
      "line": 95,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "devel-common/src/sphinx_exts/pagefind_search/__init__.py",
      "line": 96,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "devel-common/src/sphinx_exts/pagefind_search/__init__.py",
      "line": 97,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "devel-common/src/sphinx_exts/providers_packages_ref.py",
      "line": 39,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "devel-common/src/sphinx_exts/redirects.py",
      "line": 93,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "devel-common/src/sphinx_exts/sphinx_script_update.py",
      "line": 122,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "devel-common/src/sphinx_exts/sphinx_script_update.py",
      "line": 123,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/alibaba/src/airflow/providers/alibaba/cloud/log/oss_task_handler.py",
      "line": 208,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/amazon/src/airflow/providers/amazon/aws/hooks/athena_sql.py",
      "line": 212,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/amazon/src/airflow/providers/amazon/aws/hooks/redshift_sql.py",
      "line": 241,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/amazon/src/airflow/providers/amazon/aws/hooks/s3.py",
      "line": 1617,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/amazon/src/airflow/providers/amazon/aws/log/s3_task_handler.py",
      "line": 218,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/apache/beam/src/airflow/providers/apache/beam/hooks/beam.py",
      "line": 171,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/apache/druid/src/airflow/providers/apache/druid/hooks/druid.py",
      "line": 221,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/apache/hdfs/src/airflow/providers/apache/hdfs/log/hdfs_task_handler.py",
      "line": 130,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/apache/hive/src/airflow/providers/apache/hive/hooks/hive.py",
      "line": 897,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/apache/impala/src/airflow/providers/apache/impala/hooks/impala.py",
      "line": 42,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/common/sql/src/airflow/providers/common/sql/hooks/sql.py",
      "line": 285,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/common/sql/src/airflow/providers/common/sql/hooks/sql.py",
      "line": 903,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/elasticsearch/src/airflow/providers/elasticsearch/hooks/elasticsearch.py",
      "line": 143,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/elasticsearch/src/airflow/providers/elasticsearch/hooks/elasticsearch.py",
      "line": 194,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/exasol/src/airflow/providers/exasol/hooks/exasol.py",
      "line": 83,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/ftp/src/airflow/providers/ftp/hooks/ftp.py",
      "line": 192,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/hooks/bigquery.py",
      "line": 1541,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/hooks/cloud_sql.py",
      "line": 944,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/hooks/compute_ssh.py",
      "line": 60,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/hooks/compute_ssh.py",
      "line": 316,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/transfers/cassandra_to_gcs.py",
      "line": 213,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/transfers/mssql_to_gcs.py",
      "line": 94,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/transfers/mysql_to_gcs.py",
      "line": 92,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/transfers/oracle_to_gcs.py",
      "line": 77,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/transfers/postgres_to_gcs.py",
      "line": 166,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/transfers/postgres_to_gcs.py",
      "line": 170,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/transfers/presto_to_gcs.py",
      "line": 188,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/transfers/sql_to_gcs.py",
      "line": 357,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/transfers/sql_to_gcs.py",
      "line": 468,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/transfers/trino_to_gcs.py",
      "line": 195,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/jdbc/src/airflow/providers/jdbc/hooks/jdbc.py",
      "line": 193,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/microsoft/azure/src/airflow/providers/microsoft/azure/hooks/data_lake.py",
      "line": 134,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/microsoft/mssql/src/airflow/providers/microsoft/mssql/hooks/mssql.py",
      "line": 97,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/microsoft/mssql/src/airflow/providers/microsoft/mssql/hooks/mssql.py",
      "line": 103,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/mysql/src/airflow/providers/mysql/hooks/mysql.py",
      "line": 225,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/odbc/src/airflow/providers/odbc/hooks/odbc.py",
      "line": 199,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/odbc/src/airflow/providers/odbc/hooks/odbc.py",
      "line": 213,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/postgres/src/airflow/providers/postgres/hooks/postgres.py",
      "line": 370,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/postgres/src/airflow/providers/postgres/hooks/postgres.py",
      "line": 389,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/presto/src/airflow/providers/presto/hooks/presto.py",
      "line": 233,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/presto/src/airflow/providers/presto/hooks/presto.py",
      "line": 255,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/samba/src/airflow/providers/samba/hooks/samba.py",
      "line": 98,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/snowflake/src/airflow/providers/snowflake/hooks/snowflake.py",
      "line": 651,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/snowflake/src/airflow/providers/snowflake/hooks/snowflake.py",
      "line": 908,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/sqlite/src/airflow/providers/sqlite/hooks/sqlite.py",
      "line": 44,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/teradata/src/airflow/providers/teradata/hooks/teradata.py",
      "line": 162,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/trino/src/airflow/providers/trino/hooks/trino.py",
      "line": 209,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/trino/src/airflow/providers/trino/hooks/trino.py",
      "line": 266,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/trino/src/airflow/providers/trino/hooks/trino.py",
      "line": 332,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/vertica/src/airflow/providers/vertica/hooks/vertica.py",
      "line": 137,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/ydb/src/airflow/providers/ydb/hooks/ydb.py",
      "line": 112,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "task-sdk/src/airflow/sdk/execution_time/callback_supervisor.py",
      "line": 309,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "task-sdk/src/airflow/sdk/execution_time/comms.py",
      "line": 176,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "task-sdk/src/airflow/sdk/execution_time/supervisor.py",
      "line": 265,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "task-sdk/src/airflow/sdk/execution_time/supervisor.py",
      "line": 2122,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "task-sdk/src/airflow/sdk/execution_time/supervisor.py",
      "line": 2125,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "task-sdk/src/airflow/sdk/io/path.py",
      "line": 223,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api/common/delete_dag.py",
      "line": 77,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api/common/mark_tasks.py",
      "line": 207,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/auth/managers/base_auth_manager.py",
      "line": 514,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/auth/managers/base_auth_manager.py",
      "line": 583,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/auth/managers/base_auth_manager.py",
      "line": 643,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/auth/managers/base_auth_manager.py",
      "line": 745,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/public/assets.py",
      "line": 509,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/public/assets.py",
      "line": 643,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/public/assets.py",
      "line": 677,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/public/assets.py",
      "line": 712,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/public/dag_tags.py",
      "line": 73,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/public/dags.py",
      "line": 385,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/public/dags.py",
      "line": 411,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/public/dags.py",
      "line": 428,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/public/dags.py",
      "line": 438,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/public/pools.py",
      "line": 73,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/public/variables.py",
      "line": 68,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/public/xcom.py",
      "line": 285,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/public/xcom.py",
      "line": 414,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/ui/dags.py",
      "line": 309,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/ui/dashboard.py",
      "line": 146,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/ui/dashboard.py",
      "line": 173,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/ui/gantt.py",
      "line": 99,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/ui/partitioned_dag_runs.py",
      "line": 77,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/ui/partitioned_dag_runs.py",
      "line": 145,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/ui/partitioned_dag_runs.py",
      "line": 181,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/ui/partitioned_dag_runs.py",
      "line": 215,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/services/public/connections.py",
      "line": 93,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/services/public/pools.py",
      "line": 125,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/services/public/variables.py",
      "line": 105,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/services/ui/calendar.py",
      "line": 118,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/execution_api/routes/hitl.py",
      "line": 119,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/execution_api/routes/hitl.py",
      "line": 147,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/execution_api/routes/task_instances.py",
      "line": 362,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/execution_api/routes/task_instances.py",
      "line": 652,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/execution_api/routes/task_instances.py",
      "line": 690,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/execution_api/routes/task_instances.py",
      "line": 719,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/execution_api/routes/task_instances.py",
      "line": 742,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/execution_api/routes/task_instances.py",
      "line": 804,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/execution_api/routes/task_instances.py",
      "line": 870,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/execution_api/routes/task_instances.py",
      "line": 1087,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/execution_api/routes/xcoms.py",
      "line": 218,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/execution_api/routes/xcoms.py",
      "line": 444,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/assets/manager.py",
      "line": 89,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/assets/manager.py",
      "line": 563,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/cli/commands/dag_command.py",
      "line": 225,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/cli/commands/info_command.py",
      "line": 200,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/cli/commands/standalone_command.py",
      "line": 297,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/configuration.py",
      "line": 134,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/dag_processing/collection.py",
      "line": 353,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/dag_processing/collection.py",
      "line": 361,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/dag_processing/collection.py",
      "line": 746,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/dag_processing/collection.py",
      "line": 877,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/dag_processing/collection.py",
      "line": 941,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/dag_processing/collection.py",
      "line": 952,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/dag_processing/collection.py",
      "line": 954,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/dag_processing/manager.py",
      "line": 414,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/dag_processing/manager.py",
      "line": 432,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/dag_processing/manager.py",
      "line": 669,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/example_dags/tutorial_objectstorage.py",
      "line": 123,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/jobs/scheduler_job_runner.py",
      "line": 209,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/jobs/scheduler_job_runner.py",
      "line": 360,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/jobs/scheduler_job_runner.py",
      "line": 2251,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/jobs/scheduler_job_runner.py",
      "line": 2630,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/jobs/scheduler_job_runner.py",
      "line": 2883,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/jobs/scheduler_job_runner.py",
      "line": 3041,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/jobs/scheduler_job_runner.py",
      "line": 3087,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/jobs/scheduler_job_runner.py",
      "line": 3104,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/jobs/scheduler_job_runner.py",
      "line": 3171,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/jobs/triggerer_job_runner.py",
      "line": 191,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0041_3_0_0_rename_dataset_as_asset.py",
      "line": 108,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0041_3_0_0_rename_dataset_as_asset.py",
      "line": 114,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0101_3_2_0_ui_improvements_for_deadlines.py",
      "line": 191,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0101_3_2_0_ui_improvements_for_deadlines.py",
      "line": 208,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0101_3_2_0_ui_improvements_for_deadlines.py",
      "line": 231,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0101_3_2_0_ui_improvements_for_deadlines.py",
      "line": 244,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0101_3_2_0_ui_improvements_for_deadlines.py",
      "line": 256,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0101_3_2_0_ui_improvements_for_deadlines.py",
      "line": 293,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0101_3_2_0_ui_improvements_for_deadlines.py",
      "line": 303,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0101_3_2_0_ui_improvements_for_deadlines.py",
      "line": 308,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0101_3_2_0_ui_improvements_for_deadlines.py",
      "line": 370,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/asset.py",
      "line": 119,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/backfill.py",
      "line": 365,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/backfill.py",
      "line": 567,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/connection.py",
      "line": 641,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/dag.py",
      "line": 265,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/dag.py",
      "line": 838,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/dagrun.py",
      "line": 614,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/dagrun.py",
      "line": 887,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/dagwarning.py",
      "line": 92,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/deadline.py",
      "line": 446,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/pool.py",
      "line": 382,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/renderedtifields.py",
      "line": 322,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/revoked_token.py",
      "line": 77,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/serialized_dag.py",
      "line": 159,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/serialized_dag.py",
      "line": 169,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/serialized_dag.py",
      "line": 179,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/serialized_dag.py",
      "line": 559,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/serialized_dag.py",
      "line": 927,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/taskinstance.py",
      "line": 202,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/taskinstance.py",
      "line": 814,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/taskinstance.py",
      "line": 816,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/taskinstance.py",
      "line": 847,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/taskinstance.py",
      "line": 953,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/taskinstance.py",
      "line": 1169,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/taskinstance.py",
      "line": 1604,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/taskinstance.py",
      "line": 2091,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/taskinstance.py",
      "line": 2100,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/trigger.py",
      "line": 232,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/trigger.py",
      "line": 255,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/trigger.py",
      "line": 387,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/variable.py",
      "line": 319,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/variable.py",
      "line": 442,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/variable.py",
      "line": 537,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/models/xcom.py",
      "line": 153,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/policies.py",
      "line": 179,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/serialization/definitions/dag.py",
      "line": 732,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/serialization/definitions/dag.py",
      "line": 884,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/serialization/definitions/deadline.py",
      "line": 230,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/serialization/definitions/deadline.py",
      "line": 358,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/serialization/definitions/operatorlink.py",
      "line": 58,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/ui/src/components/Graph/TaskLink.tsx",
      "line": 36,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/utils/db.py",
      "line": 1030,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/utils/db.py",
      "line": 1062,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/utils/db.py",
      "line": 1433,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/utils/db.py",
      "line": 1530,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/utils/process_utils.py",
      "line": 96,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "airflow-core/src/airflow/utils/process_utils.py",
      "line": 111,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "dev/airflow_perf/scheduler_dag_execution_timing.py",
      "line": 139,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "dev/airflow_perf/scheduler_dag_execution_timing.py",
      "line": 140,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "dev/airflow_perf/scheduler_dag_execution_timing.py",
      "line": 141,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "dev/airflow_perf/scheduler_dag_execution_timing.py",
      "line": 150,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "dev/assign_cherry_picked_prs_with_milestone.py",
      "line": 225,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "dev/breeze/src/airflow_breeze/commands/main_command.py",
      "line": 135,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "dev/breeze/src/airflow_breeze/commands/main_command.py",
      "line": 175,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "dev/breeze/src/airflow_breeze/commands/release_management_commands.py",
      "line": 2878,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "dev/breeze/src/airflow_breeze/utils/provider_dependencies.py",
      "line": 86,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "dev/prepare_bulk_issues.py",
      "line": 239,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/pytest_plugin.py",
      "line": 1392,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/pytest_plugin.py",
      "line": 1397,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/pytest_plugin.py",
      "line": 1398,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/pytest_plugin.py",
      "line": 1399,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/pytest_plugin.py",
      "line": 1403,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/pytest_plugin.py",
      "line": 1406,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/pytest_plugin.py",
      "line": 1407,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/pytest_plugin.py",
      "line": 1408,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/pytest_plugin.py",
      "line": 1409,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/pytest_plugin.py",
      "line": 1410,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/pytest_plugin.py",
      "line": 1411,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/api_fastapi.py",
      "line": 51,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 221,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 222,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 223,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 224,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 228,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 238,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 239,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 245,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 246,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 247,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 248,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 249,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 253,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 256,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 257,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 265,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 266,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 267,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 271,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 280,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 281,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 288,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 289,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 290,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 291,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 294,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 303,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 312,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 327,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 333,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 351,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 359,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 365,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 374,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 377,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 390,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 396,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 402,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 408,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 418,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 428,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 434,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 440,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 446,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 454,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 462,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 470,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/db.py",
      "line": 478,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/logs.py",
      "line": 58,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "devel-common/src/tests_common/test_utils/logs.py",
      "line": 83,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "go-sdk/pkg/bundles/shared/discovery.go",
      "line": 207,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/apache/beam/src/airflow/providers/apache/beam/hooks/beam.py",
      "line": 307,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/apache/spark/src/airflow/providers/apache/spark/hooks/spark_pipelines.py",
      "line": 93,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/apache/spark/src/airflow/providers/apache/spark/hooks/spark_sql.py",
      "line": 202,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/apache/spark/src/airflow/providers/apache/spark/hooks/spark_submit.py",
      "line": 825,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/edge3/src/airflow/providers/edge3/example_dags/win_test.py",
      "line": 226,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/elasticsearch/src/airflow/providers/elasticsearch/hooks/elasticsearch.py",
      "line": 154,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/exasol/src/airflow/providers/exasol/hooks/exasol.py",
      "line": 191,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/exasol/src/airflow/providers/exasol/hooks/exasol.py",
      "line": 208,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/fab/src/airflow/providers/fab/auth_manager/fab_auth_manager.py",
      "line": 554,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/fab/src/airflow/providers/fab/auth_manager/fab_auth_manager.py",
      "line": 567,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/fab/src/airflow/providers/fab/auth_manager/fab_auth_manager.py",
      "line": 614,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/fab/src/airflow/providers/fab/auth_manager/fab_auth_manager.py",
      "line": 634,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/fab/src/airflow/providers/fab/auth_manager/models/__init__.py",
      "line": 342,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/fab/src/airflow/providers/fab/auth_manager/security_manager/override.py",
      "line": 946,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/fab/src/airflow/providers/fab/auth_manager/security_manager/override.py",
      "line": 1335,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/fab/src/airflow/providers/fab/auth_manager/security_manager/override.py",
      "line": 2575,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/hooks/cloud_sql.py",
      "line": 650,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/hooks/cloud_sql.py",
      "line": 705,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/operators/gcs.py",
      "line": 624,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/transfers/mssql_to_gcs.py",
      "line": 95,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/transfers/postgres_to_gcs.py",
      "line": 168,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/transfers/postgres_to_gcs.py",
      "line": 171,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/transfers/postgres_to_gcs.py",
      "line": 174,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/transfers/presto_to_gcs.py",
      "line": 190,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/transfers/trino_to_gcs.py",
      "line": 197,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/microsoft/azure/src/airflow/providers/microsoft/azure/hooks/adx.py",
      "line": 226,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/microsoft/azure/src/airflow/providers/microsoft/azure/transfers/oracle_to_azure_data_lake.py",
      "line": 103,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/mysql/src/airflow/providers/mysql/hooks/mysql.py",
      "line": 349,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/mysql/src/airflow/providers/mysql/transfers/vertica_to_mysql.py",
      "line": 112,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/presto/src/airflow/providers/presto/hooks/presto.py",
      "line": 235,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/presto/src/airflow/providers/presto/hooks/presto.py",
      "line": 257,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/standard/src/airflow/providers/standard/operators/python.py",
      "line": 118,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/standard/src/airflow/providers/standard/operators/python.py",
      "line": 1284,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/standard/src/airflow/providers/standard/operators/python.py",
      "line": 1324,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/standard/src/airflow/providers/standard/operators/trigger_dagrun.py",
      "line": 434,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/standard/src/airflow/providers/standard/sensors/bash.py",
      "line": 83,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/standard/src/airflow/providers/standard/triggers/external_task.py",
      "line": 288,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/trino/src/airflow/providers/trino/hooks/trino.py",
      "line": 268,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "providers/trino/src/airflow/providers/trino/hooks/trino.py",
      "line": 334,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "shared/configuration/src/airflow_shared/configuration/parser.py",
      "line": 120,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unguarded-sink",
      "path_suffix": "task-sdk/dev/datamodel_code_formatter.py",
      "line": 138,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.code_exec.compile",
      "path_suffix": "airflow-core/src/airflow/policies.py",
      "line": 177,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.code_exec.exec",
      "path_suffix": "task-sdk/tests/task_sdk/bases/test_decorator.py",
      "line": 246,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.deser.pickle_loads",
      "path_suffix": "airflow-core/tests/unit/models/test_dag.py",
      "line": 1255,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.deser.pickle_loads",
      "path_suffix": "airflow-core/tests/unit/serialization/test_dag_serialization.py",
      "line": 2982,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.deser.pickle_loads",
      "path_suffix": "airflow-core/tests/unit/serialization/test_dag_serialization.py",
      "line": 3072,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.deser.pickle_loads",
      "path_suffix": "airflow-core/tests/unit/utils/test_sqlalchemy.py",
      "line": 245,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.deser.pickle_loads",
      "path_suffix": "airflow-core/tests/unit/utils/test_sqlalchemy.py",
      "line": 246,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.deser.pickle_loads",
      "path_suffix": "airflow-core/tests/unit/utils/test_sqlalchemy.py",
      "line": 279,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.deser.pickle_loads",
      "path_suffix": "providers/cncf/kubernetes/tests/unit/cncf/kubernetes/decorators/test_kubernetes.py",
      "line": 74,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.deser.pickle_loads",
      "path_suffix": "providers/cncf/kubernetes/tests/unit/cncf/kubernetes/decorators/test_kubernetes.py",
      "line": 125,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.deser.pickle_loads",
      "path_suffix": "providers/openlineage/tests/unit/openlineage/plugins/test_facets.py",
      "line": 120,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.deser.pickle_loads",
      "path_suffix": "providers/standard/tests/unit/standard/operators/test_python.py",
      "line": 393,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.deser.pickle_loads",
      "path_suffix": "task-sdk/tests/task_sdk/api/test_client.py",
      "line": 168,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.deser.yaml_load",
      "path_suffix": "scripts/in_container/run_template_fields_check.py",
      "line": 106,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.xss.jinja_from_string",
      "path_suffix": "dev/prepare_bulk_issues.py",
      "line": 102,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.xss.jinja_from_string",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/hooks/bigquery.py",
      "line": 969,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.xss.jinja_from_string",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/log/gcs_task_handler.py",
      "line": 128,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.xss.jinja_from_string",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/log/gcs_task_handler.py",
      "line": 135,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.xss.jinja_from_string",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/log/gcs_task_handler.py",
      "line": 187,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.xss.jinja_from_string",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/operators/bigquery.py",
      "line": 1975,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.xss.jinja_from_string",
      "path_suffix": "providers/google/src/airflow/providers/google/cloud/transfers/gcs_to_bigquery.py",
      "line": 581,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.xss.jinja_from_string",
      "path_suffix": "task-sdk/src/airflow/sdk/definitions/_internal/templater.py",
      "line": 259,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.xss.jinja_from_string",
      "path_suffix": "task-sdk/src/airflow/sdk/definitions/_internal/templater.py",
      "line": 288,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.xss.jinja_from_string",
      "path_suffix": "task-sdk/src/airflow/sdk/execution_time/task_runner.py",
      "line": 1714,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_dag_run.py",
      "line": 145,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_dag_run.py",
      "line": 167,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_dag_run.py",
      "line": 192,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_dag_run.py",
      "line": 206,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_dag_run.py",
      "line": 247,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_dag_run.py",
      "line": 248,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 8927,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 8999,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 9048,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 9107,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 9128,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/tests/unit/jobs/test_triggerer_job.py",
      "line": 679,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/tests/unit/models/test_dag.py",
      "line": 2881,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/tests/unit/models/test_dagrun.py",
      "line": 1909,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/tests/unit/models/test_dagrun.py",
      "line": 3172,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/tests/unit/models/test_dagrun.py",
      "line": 3175,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/tests/unit/models/test_dagrun.py",
      "line": 3193,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/tests/unit/models/test_mappedoperator.py",
      "line": 115,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/tests/unit/models/test_mappedoperator.py",
      "line": 179,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/tests/unit/models/test_mappedoperator.py",
      "line": 281,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "airflow-core/tests/unit/utils/test_state.py",
      "line": 46,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "providers/amazon/tests/system/amazon/aws/tests/test_aws_auth_manager.py",
      "line": 90,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "providers/databricks/tests/unit/databricks/operators/test_databricks_workflow.py",
      "line": 89,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "providers/databricks/tests/unit/databricks/operators/test_databricks_workflow.py",
      "line": 153,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "providers/edge3/tests/unit/edge3/executors/test_edge_executor.py",
      "line": 80,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "providers/fab/tests/unit/fab/utils.py",
      "line": 107,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "providers/google/tests/system/google/cloud/composer/example_cloud_composer.py",
      "line": 158,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "providers/google/tests/unit/google/cloud/hooks/test_dataprep.py",
      "line": 538,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "providers/google/tests/unit/google/cloud/hooks/test_dataprep.py",
      "line": 552,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "providers/google/tests/unit/google/cloud/hooks/test_dataprep.py",
      "line": 561,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "providers/google/tests/unit/google/cloud/hooks/test_dataprep.py",
      "line": 576,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "providers/google/tests/unit/google/cloud/hooks/test_dataprep.py",
      "line": 586,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "providers/google/tests/unit/google/cloud/hooks/test_dataprep.py",
      "line": 732,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "providers/google/tests/unit/google/cloud/hooks/test_dataprep.py",
      "line": 748,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "providers/google/tests/unit/google/cloud/hooks/test_dataprep.py",
      "line": 757,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "providers/google/tests/unit/google/cloud/hooks/test_dataprep.py",
      "line": 772,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "providers/google/tests/unit/google/cloud/hooks/test_dataprep.py",
      "line": 782,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "providers/google/tests/unit/google/cloud/hooks/test_secret_manager.py",
      "line": 124,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "providers/google/tests/unit/google/cloud/hooks/test_secret_manager.py",
      "line": 154,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "providers/google/tests/unit/google/cloud/hooks/test_secret_manager.py",
      "line": 280,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "providers/openlineage/tests/unit/openlineage/plugins/test_listener.py",
      "line": 123,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.missing_ownership_check",
      "path_suffix": "providers/openlineage/tests/unit/openlineage/plugins/test_listener.py",
      "line": 966,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/tests/unit/api_fastapi/auth/managers/simple/services/test_login.py",
      "line": 69,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_dag_run.py",
      "line": 244,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/tests/unit/dag_processing/bundles/test_dag_bundle_manager.py",
      "line": 171,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 8639,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/tests/unit/jobs/test_scheduler_job.py",
      "line": 8927,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/tests/unit/jobs/test_triggerer_job.py",
      "line": 679,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/tests/unit/models/test_dag.py",
      "line": 2961,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/tests/unit/models/test_dagrun.py",
      "line": 1669,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/tests/unit/models/test_dagrun.py",
      "line": 1758,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/tests/unit/models/test_dagrun.py",
      "line": 2636,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/tests/unit/models/test_mappedoperator.py",
      "line": 147,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/tests/unit/models/test_mappedoperator.py",
      "line": 199,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/tests/unit/models/test_mappedoperator.py",
      "line": 312,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/tests/unit/models/test_taskinstance.py",
      "line": 3504,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/tests/unit/models/test_xcom.py",
      "line": 101,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/tests/unit/utils/test_db_cleanup.py",
      "line": 477,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "airflow-core/tests/unit/utils/test_log_handlers.py",
      "line": 328,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "dev/breeze/tests/test_release_validator.py",
      "line": 200,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "providers/apache/hive/tests/unit/apache/hive/operators/test_hive_stats.py",
      "line": 152,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "providers/apache/hive/tests/unit/apache/hive/operators/test_hive_stats.py",
      "line": 246,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "providers/common/sql/tests/unit/common/sql/datafusion/test_object_storage_provider.py",
      "line": 66,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "providers/edge3/tests/unit/edge3/executors/test_edge_executor.py",
      "line": 80,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "providers/edge3/tests/unit/edge3/executors/test_edge_executor.py",
      "line": 195,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "providers/fab/tests/unit/fab/auth_manager/test_security.py",
      "line": 372,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "providers/google/tests/system/google/cloud/composer/example_cloud_composer.py",
      "line": 158,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "providers/pinecone/tests/unit/pinecone/hooks/test_pinecone.py",
      "line": 68,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "providers/pinecone/tests/unit/pinecone/hooks/test_pinecone.py",
      "line": 75,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "task-sdk-integration-tests/tests/task_sdk_tests/conftest.py",
      "line": 635,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.auth.token_override_without_validation",
      "path_suffix": "task-sdk/tests/conftest.py",
      "line": 155,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.cmdi.subprocess_shell",
      "path_suffix": "providers/amazon/tests/system/amazon/aws/example_emr_eks.py",
      "line": 118,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.cmdi.subprocess_shell",
      "path_suffix": "providers/amazon/tests/system/amazon/aws/example_emr_eks.py",
      "line": 169,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.cmdi.subprocess_shell",
      "path_suffix": "providers/amazon/tests/system/amazon/aws/example_sagemaker.py",
      "line": 129,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.cmdi.subprocess_shell",
      "path_suffix": "providers/amazon/tests/system/amazon/aws/example_sagemaker.py",
      "line": 143,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.cmdi.subprocess_shell",
      "path_suffix": "providers/amazon/tests/system/amazon/aws/example_sagemaker.py",
      "line": 211,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.cmdi.subprocess_shell",
      "path_suffix": "providers/amazon/tests/system/amazon/aws/example_sagemaker.py",
      "line": 521,
      "severity": "Medium",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "py.cmdi.subprocess_shell",
      "path_suffix": "scripts/ci/prek/ruff_format.py",
      "line": 33,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.cmdi.subprocess_shell",
      "path_suffix": "scripts/in_container/run_capture_airflowctl_help.py",
      "line": 70,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.sqli.execute_format",
      "path_suffix": "airflow-core/src/airflow/example_dags/tutorial_objectstorage.py",
      "line": 123,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.sqli.execute_format",
      "path_suffix": "airflow-core/src/airflow/migrations/utils.py",
      "line": 35,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.sqli.execute_format",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0027_2_10_3_fix_dag_schedule_dataset_alias_reference_naming.py",
      "line": 48,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.sqli.execute_format",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0027_2_10_3_fix_dag_schedule_dataset_alias_reference_naming.py",
      "line": 76,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.sqli.execute_format",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0032_3_0_0_rename_execution_date_to_logical_date_and_nullable.py",
      "line": 89,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.sqli.execute_format",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0032_3_0_0_rename_execution_date_to_logical_date_and_nullable.py",
      "line": 90,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.sqli.execute_format",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0032_3_0_0_rename_execution_date_to_logical_date_and_nullable.py",
      "line": 92,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.sqli.execute_format",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0032_3_0_0_rename_execution_date_to_logical_date_and_nullable.py",
      "line": 98,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.sqli.execute_format",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0032_3_0_0_rename_execution_date_to_logical_date_and_nullable.py",
      "line": 99,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.sqli.execute_format",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0041_3_0_0_rename_dataset_as_asset.py",
      "line": 87,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.sqli.execute_format",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0041_3_0_0_rename_dataset_as_asset.py",
      "line": 88,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.sqli.execute_format",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0041_3_0_0_rename_dataset_as_asset.py",
      "line": 90,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.sqli.execute_format",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0041_3_0_0_rename_dataset_as_asset.py",
      "line": 118,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.sqli.execute_format",
      "path_suffix": "providers/apache/hive/src/airflow/providers/apache/hive/hooks/hive.py",
      "line": 929,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.sqli.text_format",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0003_2_7_0_add_include_deferred_column_to_pool.py",
      "line": 46,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.sqli.text_format",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0017_2_9_2_fix_inconsistency_between_ORM_and_migration_files.py",
      "line": 251,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.sqli.text_format",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0049_3_0_0_remove_pickled_data_from_xcom_table.py",
      "line": 102,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.sqli.text_format",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0049_3_0_0_remove_pickled_data_from_xcom_table.py",
      "line": 113,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.sqli.text_format",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0101_3_2_0_ui_improvements_for_deadlines.py",
      "line": 546,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.sqli.text_format",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0101_3_2_0_ui_improvements_for_deadlines.py",
      "line": 564,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.sqli.text_format",
      "path_suffix": "airflow-core/src/airflow/migrations/versions/0104_3_2_0_fix_uuid_column_types.py",
      "line": 98,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.sqli.text_format",
      "path_suffix": "airflow-core/src/airflow/utils/db_cleanup.py",
      "line": 206,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.sqli.text_format",
      "path_suffix": "airflow-core/src/airflow/utils/db_cleanup.py",
      "line": 253,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.sqli.text_format",
      "path_suffix": "airflow-core/src/airflow/utils/db_cleanup.py",
      "line": 346,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.sqli.text_format",
      "path_suffix": "airflow-core/src/airflow/utils/db_cleanup.py",
      "line": 648,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.sqli.text_format",
      "path_suffix": "airflow-core/src/airflow/utils/db_cleanup.py",
      "line": 664,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "py.sqli.text_format",
      "path_suffix": "providers/fab/src/airflow/providers/fab/migrations/versions/0001_3_5_0_fix_fab_db_inconsistencies.py",
      "line": 154,
      "severity": "Medium",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/tests/integration/otel/test_otel.py",
      "line": 167,
      "severity": "Low",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/tests/unit/always/test_project_structure.py",
      "line": 48,
      "severity": "Low",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/tests/unit/api_fastapi/common/test_cursors.py",
      "line": 56,
      "severity": "Low",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/tests/unit/api_fastapi/core_api/routes/public/test_dag_sources.py",
      "line": 77,
      "severity": "Low",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/tests/unit/cli/commands/test_api_server_command.py",
      "line": 236,
      "severity": "Low",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/tests/unit/cli/commands/test_kerberos_command.py",
      "line": 79,
      "severity": "Low",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/tests/unit/listeners/file_write_listener.py",
      "line": 33,
      "severity": "Low",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/tests/unit/listeners/xcom_listener.py",
      "line": 29,
      "severity": "Low",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/tests/unit/utils/test_db_cleanup.py",
      "line": 678,
      "severity": "Low",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "state-resource-leak",
      "path_suffix": "airflow-core/tests/unit/utils/test_process_utils.py",
      "line": 128,
      "severity": "Low",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "cfg-unreachable-source",
      "path_suffix": "airflow-core/src/airflow/api_fastapi/core_api/routes/public/connections.py",
      "line": 259,
      "severity": "Low",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unreachable-source",
      "path_suffix": "airflow-core/src/airflow/cli/commands/api_server_command.py",
      "line": 203,
      "severity": "Low",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unreachable-source",
      "path_suffix": "airflow-core/src/airflow/dag_processing/collection.py",
      "line": 249,
      "severity": "Low",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unreachable-source",
      "path_suffix": "airflow-core/src/airflow/utils/db_cleanup.py",
      "line": 487,
      "severity": "Low",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-unreachable-source",
      "path_suffix": "providers/snowflake/src/airflow/providers/snowflake/operators/snowpark.py",
      "line": 134,
      "severity": "Low",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "airflow-core/docs/conf.py",
      "line": 383,
      "severity": "Low",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "airflow-core/tests/unit/cli/commands/test_standalone_command.py",
      "line": 227,
      "severity": "Low",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "airflow-ctl/docs/conf.py",
      "line": 303,
      "severity": "Low",
      "verdict": "needs_review",
      "note": "captured by validate_recall.sh --capture"
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/amazon/tests/system/amazon/aws/example_bedrock_retrieve_and_generate.py",
      "line": 314,
      "severity": "Low",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    },
    {
      "rule_id": "cfg-resource-leak",
      "path_suffix": "providers/amazon/tests/system/amazon/aws/example_sagemaker.py",
      "line": 143,
      "severity": "Low",
      "verdict": "FP",
      "note": "Test fixture / helper. The flagged shape is in the test path, not request-reachable production code."
    }
  ]
}