{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-e77fbf35ff514e80", "name": "Possibly dead Python function: lookup", "shortDescription": {"text": "Possibly dead Python function: lookup"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bba7b08754eb1d1d", "name": "Stray `console.log` in TS/JS \u2014 static/trip-detail/map.js:201", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 static/trip-detail/map.js:201"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c48659d2d0f04864", "name": "Stray `console.log` in TS/JS \u2014 static/trip-detail/timeline.js:906", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 static/trip-detail/timeline.js:906"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cdb35b14a9bbf866", "name": "Insecure pattern 'debug_true' in summer_seeker_app.py:133", "shortDescription": {"text": "Insecure pattern 'debug_true' in summer_seeker_app.py:133"}, "fullDescription": {"text": "Found a known-risky pattern (debug_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8249228b2ebad5c3", "name": "Insecure pattern 'debug_true' in ekko_trips_app.py:4186", "shortDescription": {"text": "Insecure pattern 'debug_true' in ekko_trips_app.py:4186"}, "fullDescription": {"text": "Found a known-risky pattern (debug_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86c38e5faf8ac1c7", "name": "Insecure pattern 'direct_innerhtml_assignment' in static/map-picker.js:247", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/map-picker.js:247"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d2c22d7aa210544d", "name": "Insecure pattern 'direct_innerhtml_assignment' in static/trip-detail/detect-stops.js:178", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/trip-detail/detect-stops.js:178"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dd554912b23ffde0", "name": "Insecure pattern 'direct_outerhtml_assignment' in static/trip-detail/detect-stops.js:293", "shortDescription": {"text": "Insecure pattern 'direct_outerhtml_assignment' in static/trip-detail/detect-stops.js:293"}, "fullDescription": {"text": "Found a known-risky pattern (direct_outerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0f7440715830b5e3", "name": "Insecure pattern 'direct_innerhtml_assignment' in static/trip-detail/timeline.js:26", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/trip-detail/timeline.js:26"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2e7bd7ba458f1662", "name": "Insecure pattern 'direct_innerhtml_assignment' in static/trip-detail/photos.js:84", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/trip-detail/photos.js:84"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e0f57dc4b5480076", "name": "Very large file: ekko_trips_app.py (4186 lines)", "shortDescription": {"text": "Very large file: ekko_trips_app.py (4186 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4604ed2fe4ee59d0", "name": "Very large file: static/trip-detail/map.js (1072 lines)", "shortDescription": {"text": "Very large file: static/trip-detail/map.js (1072 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "4 tests / 17 src (ratio 0.24)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 18 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 17 placeholder/mock markers across 7 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-122f91b7f2906dc4", "name": "Agent authority lacks a verifier contract: .claude/settings.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-293f4b384576722a", "name": "Network/subprocess call without timeout or try/except \u2014 get_elevation.py:14", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 get_elevation.py:14"}, "fullDescription": {"text": "`requests.get(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ec56a79b3a935988", "name": "Stub function `progress_callback` (body is just `pass`/`return`) \u2014 summer_seeker_app.py:88", "shortDescription": {"text": "Stub function `progress_callback` (body is just `pass`/`return`) \u2014 summer_seeker_app.py:88"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7944e9432ad92648", "name": "Commented-code block (8 lines) in trips.py:442", "shortDescription": {"text": "Commented-code block (8 lines) in trips.py:442"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c813abd7d50e1848", "name": "Legacy-named symbol `is_old` in ekko_trips_app.py:2417", "shortDescription": {"text": "Legacy-named symbol `is_old` in ekko_trips_app.py:2417"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c1bd8a0acd387654", "name": "Commented-code block (9 lines) in ekko_trips_app.py:295", "shortDescription": {"text": "Commented-code block (9 lines) in ekko_trips_app.py:295"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f21df64af324fab0", "name": "Commented-code block (13 lines) in static/sw.js:3", "shortDescription": {"text": "Commented-code block (13 lines) in static/sw.js:3"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-35d0bf15b797d3c2", "name": "`fetch()` without try/.catch or AbortSignal \u2014 static/map-picker.js:243", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 static/map-picker.js:243"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-74cd133559175960", "name": "Commented-code block (9 lines) in static/trip-detail/detect-stops.js:1", "shortDescription": {"text": "Commented-code block (9 lines) in static/trip-detail/detect-stops.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7eff4179ec11ec9c", "name": "`fetch()` without try/.catch or AbortSignal \u2014 static/trip-detail/detect-stops.js:196", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 static/trip-detail/detect-stops.js:196"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-fe24ad24708b6cd0", "name": "Commented-code block (6 lines) in static/trip-detail/overrides.js:1", "shortDescription": {"text": "Commented-code block (6 lines) in static/trip-detail/overrides.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-159d84a515c8d95b", "name": "`fetch()` without try/.catch or AbortSignal \u2014 static/trip-detail/overrides.js:325", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 static/trip-detail/overrides.js:325"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-746a816efad9ee64", "name": "Commented-code block (5 lines) in static/trip-detail/map.js:102", "shortDescription": {"text": "Commented-code block (5 lines) in static/trip-detail/map.js:102"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a814e6fec1cf69b1", "name": "Commented-code block (7 lines) in static/trip-detail/timeline.js:225", "shortDescription": {"text": "Commented-code block (7 lines) in static/trip-detail/timeline.js:225"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bb655e70eadaac7e", "name": "`fetch()` without try/.catch or AbortSignal \u2014 static/trip-detail/timeline.js:6", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 static/trip-detail/timeline.js:6"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1c81ed48f9b52384", "name": "Commented-code block (7 lines) in static/trip-detail/lightbox.js:1", "shortDescription": {"text": "Commented-code block (7 lines) in static/trip-detail/lightbox.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-76de0d006f97548d", "name": "Commented-code block (6 lines) in static/trip-detail/boot.js:1", "shortDescription": {"text": "Commented-code block (6 lines) in static/trip-detail/boot.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e777f329ff82c63c", "name": "Commented-code block (10 lines) in static/trip-detail/photos.js:1", "shortDescription": {"text": "Commented-code block (10 lines) in static/trip-detail/photos.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ca49f140e1d68c61", "name": "`fetch()` without try/.catch or AbortSignal \u2014 static/trip-detail/photos.js:55", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 static/trip-detail/photos.js:55"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nekko_trips_app.py:trips_map, ekko_trips_app.py:trips_calendar\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5ab5c9bdfaa13e7d", "name": "Flask mutation route `search` without `@login_required` \u2014 summer_seeker_app.py:46", "shortDescription": {"text": "Flask mutation route `search` without `@login_required` \u2014 summer_seeker_app.py:46"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6373ce291c3b615c", "name": "Flask mutation route `login` without `@login_required` \u2014 ekko_trips_app.py:665", "shortDescription": {"text": "Flask mutation route `login` without `@login_required` \u2014 ekko_trips_app.py:665"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-de96369d9bfad277", "name": "Flask mutation route `upload_photo` without `@login_required` \u2014 ekko_trips_app.py:1186", "shortDescription": {"text": "Flask mutation route `upload_photo` without `@login_required` \u2014 ekko_trips_app.py:1186"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-badef4dd36e9f7bc", "name": "Flask mutation route `save_caption` without `@login_required` \u2014 ekko_trips_app.py:1224", "shortDescription": {"text": "Flask mutation route `save_caption` without `@login_required` \u2014 ekko_trips_app.py:1224"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3d58afb1ef1eae8b", "name": "Flask mutation route `delete_photo` without `@login_required` \u2014 ekko_trips_app.py:1244", "shortDescription": {"text": "Flask mutation route `delete_photo` without `@login_required` \u2014 ekko_trips_app.py:1244"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-70da1f65b6c47b85", "name": "Flask mutation route `restore_photo` without `@login_required` \u2014 ekko_trips_app.py:1262", "shortDescription": {"text": "Flask mutation route `restore_photo` without `@login_required` \u2014 ekko_trips_app.py:1262"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-deb87e6d45c1cb8f", "name": "Flask mutation route `delete_all_stay_photos` without `@login_required` \u2014 ekko_trips_app.py:1272", "shortDescription": {"text": "Flask mutation route `delete_all_stay_photos` without `@login_required` \u2014 ekko_trips_app.py:1272"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-010c390aaadd0b12", "name": "Flask mutation route `reorder_stay_photos` without `@login_required` \u2014 ekko_trips_app.py:1297", "shortDescription": {"text": "Flask mutation route `reorder_stay_photos` without `@login_required` \u2014 ekko_trips_app.py:1297"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2c0d6970968752f4", "name": "Flask mutation route `upload_event_photo` without `@login_required` \u2014 ekko_trips_app.py:1313", "shortDescription": {"text": "Flask mutation route `upload_event_photo` without `@login_required` \u2014 ekko_trips_app.py:1313"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7ce8b2b3b56eda5f", "name": "Flask mutation route `save_event_caption` without `@login_required` \u2014 ekko_trips_app.py:1352", "shortDescription": {"text": "Flask mutation route `save_event_caption` without `@login_required` \u2014 ekko_trips_app.py:1352"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-fdd3e521b40f9fc0", "name": "Flask mutation route `delete_event_photo` without `@login_required` \u2014 ekko_trips_app.py:1372", "shortDescription": {"text": "Flask mutation route `delete_event_photo` without `@login_required` \u2014 ekko_trips_app.py:1372"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e0a4e5d02e42c2f2", "name": "Flask mutation route `restore_event_photo` without `@login_required` \u2014 ekko_trips_app.py:1389", "shortDescription": {"text": "Flask mutation route `restore_event_photo` without `@login_required` \u2014 ekko_trips_app.py:1389"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bdc88c0b76c1ca7b", "name": "Flask mutation route `delete_all_event_photos` without `@login_required` \u2014 ekko_trips_app.py:1399", "shortDescription": {"text": "Flask mutation route `delete_all_event_photos` without `@login_required` \u2014 ekko_trips_app.py:1399"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-69bcc1fb0d6201b4", "name": "Flask mutation route `reorder_event_photos` without `@login_required` \u2014 ekko_trips_app.py:1424", "shortDescription": {"text": "Flask mutation route `reorder_event_photos` without `@login_required` \u2014 ekko_trips_app.py:1424"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2d238b13ffce375b", "name": "Flask mutation route `api_create_trip` without `@login_required` \u2014 ekko_trips_app.py:1440", "shortDescription": {"text": "Flask mutation route `api_create_trip` without `@login_required` \u2014 ekko_trips_app.py:1440"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b656ab9469c67636", "name": "Flask mutation route `api_update_trip` without `@login_required` \u2014 ekko_trips_app.py:1450", "shortDescription": {"text": "Flask mutation route `api_update_trip` without `@login_required` \u2014 ekko_trips_app.py:1450"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e964f4b9479f4bf2", "name": "Flask mutation route `api_delete_trip` without `@login_required` \u2014 ekko_trips_app.py:1462", "shortDescription": {"text": "Flask mutation route `api_delete_trip` without `@login_required` \u2014 ekko_trips_app.py:1462"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-25710b47768de32f", "name": "Flask mutation route `api_add_stay` without `@login_required` \u2014 ekko_trips_app.py:1475", "shortDescription": {"text": "Flask mutation route `api_add_stay` without `@login_required` \u2014 ekko_trips_app.py:1475"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-923897730fc00983", "name": "Flask mutation route `api_update_stay` without `@login_required` \u2014 ekko_trips_app.py:1487", "shortDescription": {"text": "Flask mutation route `api_update_stay` without `@login_required` \u2014 ekko_trips_app.py:1487"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-891f27964a8f0813", "name": "Flask mutation route `api_delete_stay` without `@login_required` \u2014 ekko_trips_app.py:1499", "shortDescription": {"text": "Flask mutation route `api_delete_stay` without `@login_required` \u2014 ekko_trips_app.py:1499"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f6ca83f447cdb924", "name": "Flask mutation route `api_add_event` without `@login_required` \u2014 ekko_trips_app.py:1514", "shortDescription": {"text": "Flask mutation route `api_add_event` without `@login_required` \u2014 ekko_trips_app.py:1514"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-33d0b19eb2586845", "name": "Flask mutation route `api_update_event` without `@login_required` \u2014 ekko_trips_app.py:1526", "shortDescription": {"text": "Flask mutation route `api_update_event` without `@login_required` \u2014 ekko_trips_app.py:1526"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-68e68be61fd3330a", "name": "Flask mutation route `api_delete_event` without `@login_required` \u2014 ekko_trips_app.py:1538", "shortDescription": {"text": "Flask mutation route `api_delete_event` without `@login_required` \u2014 ekko_trips_app.py:1538"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dcfe952072369005", "name": "Flask mutation route `move_photo` without `@login_required` \u2014 ekko_trips_app.py:1606", "shortDescription": {"text": "Flask mutation route `move_photo` without `@login_required` \u2014 ekko_trips_app.py:1606"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c056958abec28352", "name": "Flask mutation route `api_user_create` without `@login_required` \u2014 ekko_trips_app.py:1714", "shortDescription": {"text": "Flask mutation route `api_user_create` without `@login_required` \u2014 ekko_trips_app.py:1714"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f267418d8f820660", "name": "Flask mutation route `api_user_update` without `@login_required` \u2014 ekko_trips_app.py:1740", "shortDescription": {"text": "Flask mutation route `api_user_update` without `@login_required` \u2014 ekko_trips_app.py:1740"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-738d2c3a2f116d87", "name": "Flask mutation route `api_user_delete` without `@login_required` \u2014 ekko_trips_app.py:1765", "shortDescription": {"text": "Flask mutation route `api_user_delete` without `@login_required` \u2014 ekko_trips_app.py:1765"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-723b84bc78dd7873", "name": "Flask mutation route `api_create_campground` without `@login_required` \u2014 ekko_trips_app.py:1817", "shortDescription": {"text": "Flask mutation route `api_create_campground` without `@login_required` \u2014 ekko_trips_app.py:1817"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a1571db9182ebeb3", "name": "Flask mutation route `api_update_campground` without `@login_required` \u2014 ekko_trips_app.py:1857", "shortDescription": {"text": "Flask mutation route `api_update_campground` without `@login_required` \u2014 ekko_trips_app.py:1857"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-82a6e0337249c7b3", "name": "Flask mutation route `api_suppress_pings` without `@login_required` \u2014 ekko_trips_app.py:3712", "shortDescription": {"text": "Flask mutation route `api_suppress_pings` without `@login_required` \u2014 ekko_trips_app.py:3712"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6d5923a6403149c0", "name": "Flask mutation route `api_unsuppress_pings` without `@login_required` \u2014 ekko_trips_app.py:3728", "shortDescription": {"text": "Flask mutation route `api_unsuppress_pings` without `@login_required` \u2014 ekko_trips_app.py:3728"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7f6ab092410871ad", "name": "Flask mutation route `api_relocate_pings` without `@login_required` \u2014 ekko_trips_app.py:3744", "shortDescription": {"text": "Flask mutation route `api_relocate_pings` without `@login_required` \u2014 ekko_trips_app.py:3744"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9cdcb3e09ca20fa1", "name": "Flask mutation route `api_unrelocate_pings` without `@login_required` \u2014 ekko_trips_app.py:3780", "shortDescription": {"text": "Flask mutation route `api_unrelocate_pings` without `@login_required` \u2014 ekko_trips_app.py:3780"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9409284baeacd147", "name": "Flask mutation route `api_set_tid_override` without `@login_required` \u2014 ekko_trips_app.py:3820", "shortDescription": {"text": "Flask mutation route `api_set_tid_override` without `@login_required` \u2014 ekko_trips_app.py:3820"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8705c0000c1962fa", "name": "Flask mutation route `api_detect_stops` without `@login_required` \u2014 ekko_trips_app.py:3942", "shortDescription": {"text": "Flask mutation route `api_detect_stops` without `@login_required` \u2014 ekko_trips_app.py:3942"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4b5dc9cdaaf42d1d", "name": "Flask mutation route `api_accept_stops` without `@login_required` \u2014 ekko_trips_app.py:4100", "shortDescription": {"text": "Flask mutation route `api_accept_stops` without `@login_required` \u2014 ekko_trips_app.py:4100"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-583796a4f11a5866", "name": "Flask mutation route `api_delete_campground` without `@login_required` \u2014 ekko_trips_app.py:4149", "shortDescription": {"text": "Flask mutation route `api_delete_campground` without `@login_required` \u2014 ekko_trips_app.py:4149"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2644d38539df7608", "name": "Dangling fetch: POST /api/trips/${TRIP_ID}/detect-stops (static/trip-detail/detect-stops.js:196)", "shortDescription": {"text": "Dangling fetch: POST /api/trips/${TRIP_ID}/detect-stops (static/trip-detail/detect-stops.js:196)"}, "fullDescription": {"text": "`static/trip-detail/detect-stops.js:196` calls `POST /api/trips/${TRIP_ID}/detect-stops` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/trips/<p>/detect-stops`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b615cc509b137b54", "name": "Dangling fetch: POST /api/trips/${TRIP_ID}/accept-stops (static/trip-detail/detect-stops.js:366)", "shortDescription": {"text": "Dangling fetch: POST /api/trips/${TRIP_ID}/accept-stops (static/trip-detail/detect-stops.js:366)"}, "fullDescription": {"text": "`static/trip-detail/detect-stops.js:366` calls `POST /api/trips/${TRIP_ID}/accept-stops` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/trips/<p>/accept-stops`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a779256e40d441ef", "name": "Dangling fetch: POST /api/trips/${TRIP_ID}/relocate-pings (static/trip-detail/overrides.js:325)", "shortDescription": {"text": "Dangling fetch: POST /api/trips/${TRIP_ID}/relocate-pings (static/trip-detail/overrides.js:325)"}, "fullDescription": {"text": "`static/trip-detail/overrides.js:325` calls `POST /api/trips/${TRIP_ID}/relocate-pings` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/trips/<p>/relocate-pings`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-327f690906bb2e92", "name": "Dangling fetch: PUT /api/trips/${TRIP_ID}/stays/${best.idx} (static/trip-detail/overrides.js:530)", "shortDescription": {"text": "Dangling fetch: PUT /api/trips/${TRIP_ID}/stays/${best.idx} (static/trip-detail/overrides.js:530)"}, "fullDescription": {"text": "`static/trip-detail/overrides.js:530` calls `PUT /api/trips/${TRIP_ID}/stays/${best.idx}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/trips/<p>/stays/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d546d86211acef99", "name": "Dangling fetch: POST /api/trips/${TRIP_ID}/suppress-pings (static/trip-detail/overrides.js:559)", "shortDescription": {"text": "Dangling fetch: POST /api/trips/${TRIP_ID}/suppress-pings (static/trip-detail/overrides.js:559)"}, "fullDescription": {"text": "`static/trip-detail/overrides.js:559` calls `POST /api/trips/${TRIP_ID}/suppress-pings` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/trips/<p>/suppress-pings`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-388dae9b73e9184c", "name": "Dangling fetch: POST /api/trips/${TRIP_ID}/relocate-pings (static/trip-detail/overrides.js:622)", "shortDescription": {"text": "Dangling fetch: POST /api/trips/${TRIP_ID}/relocate-pings (static/trip-detail/overrides.js:622)"}, "fullDescription": {"text": "`static/trip-detail/overrides.js:622` calls `POST /api/trips/${TRIP_ID}/relocate-pings` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/trips/<p>/relocate-pings`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-18c6ee5a163b767a", "name": "Dangling fetch: DELETE /api/trips/${TRIP_ID}/relocate-pings (static/trip-detail/overrides.js:686)", "shortDescription": {"text": "Dangling fetch: DELETE /api/trips/${TRIP_ID}/relocate-pings (static/trip-detail/overrides.js:686)"}, "fullDescription": {"text": "`static/trip-detail/overrides.js:686` calls `DELETE /api/trips/${TRIP_ID}/relocate-pings` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/trips/<p>/relocate-pings`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1213d6f3b95f3074", "name": "Dangling fetch: DELETE /api/trips/${TRIP_ID}/suppress-pings (static/trip-detail/overrides.js:705)", "shortDescription": {"text": "Dangling fetch: DELETE /api/trips/${TRIP_ID}/suppress-pings (static/trip-detail/overrides.js:705)"}, "fullDescription": {"text": "`static/trip-detail/overrides.js:705` calls `DELETE /api/trips/${TRIP_ID}/suppress-pings` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/trips/<p>/suppress-pings`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ed3189e161a845c3", "name": "Dangling fetch: PUT /api/trips/${TRIP_ID} (static/trip-detail/timeline.js:169)", "shortDescription": {"text": "Dangling fetch: PUT /api/trips/${TRIP_ID} (static/trip-detail/timeline.js:169)"}, "fullDescription": {"text": "`static/trip-detail/timeline.js:169` calls `PUT /api/trips/${TRIP_ID}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/trips/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-476268cd1c7e3cfb", "name": "Dangling fetch: PUT /api/trips/${TRIP_ID} (static/trip-detail/timeline.js:198)", "shortDescription": {"text": "Dangling fetch: PUT /api/trips/${TRIP_ID} (static/trip-detail/timeline.js:198)"}, "fullDescription": {"text": "`static/trip-detail/timeline.js:198` calls `PUT /api/trips/${TRIP_ID}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/trips/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1ac15a39bd53393b", "name": "Dangling fetch: DELETE /api/trips/${TRIP_ID} (static/trip-detail/timeline.js:212)", "shortDescription": {"text": "Dangling fetch: DELETE /api/trips/${TRIP_ID} (static/trip-detail/timeline.js:212)"}, "fullDescription": {"text": "`static/trip-detail/timeline.js:212` calls `DELETE /api/trips/${TRIP_ID}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/trips/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1c527edb2379cebb", "name": "Dangling fetch: GET /api/trips/${TRIP_ID}/tid-choices (static/trip-detail/timeline.js:244)", "shortDescription": {"text": "Dangling fetch: GET /api/trips/${TRIP_ID}/tid-choices (static/trip-detail/timeline.js:244)"}, "fullDescription": {"text": "`static/trip-detail/timeline.js:244` calls `GET /api/trips/${TRIP_ID}/tid-choices` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/trips/<p>/tid-choices`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8ec4fac163e692bb", "name": "Dangling fetch: PUT /api/trips/${TRIP_ID}/tid-overrides (static/trip-detail/timeline.js:332)", "shortDescription": {"text": "Dangling fetch: PUT /api/trips/${TRIP_ID}/tid-overrides (static/trip-detail/timeline.js:332)"}, "fullDescription": {"text": "`static/trip-detail/timeline.js:332` calls `PUT /api/trips/${TRIP_ID}/tid-overrides` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/trips/<p>/tid-overrides`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-994f8ab3dee4e186", "name": "Dangling fetch: PUT /api/trips/${TRIP_ID}/stays/${idx} (static/trip-detail/timeline.js:388)", "shortDescription": {"text": "Dangling fetch: PUT /api/trips/${TRIP_ID}/stays/${idx} (static/trip-detail/timeline.js:388)"}, "fullDescription": {"text": "`static/trip-detail/timeline.js:388` calls `PUT /api/trips/${TRIP_ID}/stays/${idx}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/trips/<p>/stays/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-347308a8fa072f72", "name": "Dangling fetch: DELETE /api/trips/${TRIP_ID}/stays/${idx} (static/trip-detail/timeline.js:439)", "shortDescription": {"text": "Dangling fetch: DELETE /api/trips/${TRIP_ID}/stays/${idx} (static/trip-detail/timeline.js:439)"}, "fullDescription": {"text": "`static/trip-detail/timeline.js:439` calls `DELETE /api/trips/${TRIP_ID}/stays/${idx}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/trips/<p>/stays/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-12b0221f8232c106", "name": "Dangling fetch: PUT /api/trips/${TRIP_ID}/events/${idx} (static/trip-detail/timeline.js:625)", "shortDescription": {"text": "Dangling fetch: PUT /api/trips/${TRIP_ID}/events/${idx} (static/trip-detail/timeline.js:625)"}, "fullDescription": {"text": "`static/trip-detail/timeline.js:625` calls `PUT /api/trips/${TRIP_ID}/events/${idx}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/trips/<p>/events/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1a4972b721ea457d", "name": "Dangling fetch: DELETE /api/trips/${TRIP_ID}/events/${idx} (static/trip-detail/timeline.js:646)", "shortDescription": {"text": "Dangling fetch: DELETE /api/trips/${TRIP_ID}/events/${idx} (static/trip-detail/timeline.js:646)"}, "fullDescription": {"text": "`static/trip-detail/timeline.js:646` calls `DELETE /api/trips/${TRIP_ID}/events/${idx}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/trips/<p>/events/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-46306c8f59eab14b", "name": "Dangling fetch: DELETE /trips/${tripId}/events/${eventIdx}/photos (static/trip-detail/photos.js:80)", "shortDescription": {"text": "Dangling fetch: DELETE /trips/${tripId}/events/${eventIdx}/photos (static/trip-detail/photos.js:80)"}, "fullDescription": {"text": "`static/trip-detail/photos.js:80` calls `DELETE /trips/${tripId}/events/${eventIdx}/photos` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/trips/<p>/events/<p>/photos`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5484c31b4166f77f", "name": "Dangling fetch: POST /trips/${tripId}/stays/${stayIdx}/caption (static/trip-detail/photos.js:187)", "shortDescription": {"text": "Dangling fetch: POST /trips/${tripId}/stays/${stayIdx}/caption (static/trip-detail/photos.js:187)"}, "fullDescription": {"text": "`static/trip-detail/photos.js:187` calls `POST /trips/${tripId}/stays/${stayIdx}/caption` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/trips/<p>/stays/<p>/caption`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7ff6ed739b775bdc", "name": "Dangling fetch: DELETE /trips/${tripId}/stays/${stayIdx}/photos (static/trip-detail/photos.js:236)", "shortDescription": {"text": "Dangling fetch: DELETE /trips/${tripId}/stays/${stayIdx}/photos (static/trip-detail/photos.js:236)"}, "fullDescription": {"text": "`static/trip-detail/photos.js:236` calls `DELETE /trips/${tripId}/stays/${stayIdx}/photos` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/trips/<p>/stays/<p>/photos`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-35b4653a3dea0d1e", "name": "Dangling fetch: POST /trips/${TRIP_ID}/move-photo (static/trip-detail/photos.js:436)", "shortDescription": {"text": "Dangling fetch: POST /trips/${TRIP_ID}/move-photo (static/trip-detail/photos.js:436)"}, "fullDescription": {"text": "`static/trip-detail/photos.js:436` calls `POST /trips/${TRIP_ID}/move-photo` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/trips/<p>/move-photo`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1a6d91f2236825bf", "name": "Unused endpoint: ANY /", "shortDescription": {"text": "Unused endpoint: ANY /"}, "fullDescription": {"text": "`summer_seeker_app.py` declares `ANY /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-722b9c3df5fc807a", "name": "Unused endpoint: ANY /geocode", "shortDescription": {"text": "Unused endpoint: ANY /geocode"}, "fullDescription": {"text": "`summer_seeker_app.py` declares `ANY /geocode` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-117531c0d0465186", "name": "Unused endpoint: ANY /search", "shortDescription": {"text": "Unused endpoint: ANY /search"}, "fullDescription": {"text": "`summer_seeker_app.py` declares `ANY /search` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fbf75d1534d0991f", "name": "Unused endpoint: ANY /thumb/<path:subpath>", "shortDescription": {"text": "Unused endpoint: ANY /thumb/<path:subpath>"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /thumb/<path:subpath>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eba3d61a670b6f09", "name": "Unused endpoint: ANY /sw.js", "shortDescription": {"text": "Unused endpoint: ANY /sw.js"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /sw.js` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5a6392a7c6694326", "name": "Unused endpoint: ANY /offline", "shortDescription": {"text": "Unused endpoint: ANY /offline"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /offline` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-030245d358a9d4f0", "name": "Unused endpoint: ANY /sw-reset", "shortDescription": {"text": "Unused endpoint: ANY /sw-reset"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /sw-reset` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4c7ad61ba1b23915", "name": "Unused endpoint: ANY /login", "shortDescription": {"text": "Unused endpoint: ANY /login"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c9e449c3b9e73b73", "name": "Unused endpoint: ANY /logout", "shortDescription": {"text": "Unused endpoint: ANY /logout"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-139e72f7e8b70097", "name": "Unused endpoint: ANY /trips", "shortDescription": {"text": "Unused endpoint: ANY /trips"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /trips` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e6ca626e3090889f", "name": "Unused endpoint: ANY /trips/map", "shortDescription": {"text": "Unused endpoint: ANY /trips/map"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /trips/map` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d72e5f6783bcfbd2", "name": "Unused endpoint: ANY /trips/poster", "shortDescription": {"text": "Unused endpoint: ANY /trips/poster"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /trips/poster` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-deae64c74c8c2459", "name": "Unused endpoint: ANY /trips/calendar", "shortDescription": {"text": "Unused endpoint: ANY /trips/calendar"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /trips/calendar` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ba715ca3193fc831", "name": "Unused endpoint: ANY /trips/list", "shortDescription": {"text": "Unused endpoint: ANY /trips/list"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /trips/list` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aee1ba756d9ab17f", "name": "Unused endpoint: ANY /trips/stats", "shortDescription": {"text": "Unused endpoint: ANY /trips/stats"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /trips/stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4e11f09b46b4d8d9", "name": "Unused endpoint: ANY /trips/<int:trip_id>", "shortDescription": {"text": "Unused endpoint: ANY /trips/<int:trip_id>"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /trips/<int:trip_id>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5df1b37ac4197cd6", "name": "Unused endpoint: ANY /trips/<int:trip_id>/stays/<int:stay_idx>/upload", "shortDescription": {"text": "Unused endpoint: ANY /trips/<int:trip_id>/stays/<int:stay_idx>/upload"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /trips/<int:trip_id>/stays/<int:stay_idx>/upload` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-451e6e8f8f063ecc", "name": "Unused endpoint: ANY /trips/<int:trip_id>/stays/<int:stay_idx>/caption", "shortDescription": {"text": "Unused endpoint: ANY /trips/<int:trip_id>/stays/<int:stay_idx>/caption"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /trips/<int:trip_id>/stays/<int:stay_idx>/caption` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-71b0ae871db3282b", "name": "Unused endpoint: ANY /trips/<int:trip_id>/stays/<int:stay_idx>/photos/<filename>", "shortDescription": {"text": "Unused endpoint: ANY /trips/<int:trip_id>/stays/<int:stay_idx>/photos/<filename>"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /trips/<int:trip_id>/stays/<int:stay_idx>/photos/<filename>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6994b073a96c26ea", "name": "Unused endpoint: ANY /trips/<int:trip_id>/stays/<int:stay_idx>/photos/<filename>/restore", "shortDescription": {"text": "Unused endpoint: ANY /trips/<int:trip_id>/stays/<int:stay_idx>/photos/<filename>/restore"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /trips/<int:trip_id>/stays/<int:stay_idx>/photos/<filename>/restore` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be6dd0d825105a3e", "name": "Unused endpoint: ANY /trips/<int:trip_id>/stays/<int:stay_idx>/photos", "shortDescription": {"text": "Unused endpoint: ANY /trips/<int:trip_id>/stays/<int:stay_idx>/photos"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /trips/<int:trip_id>/stays/<int:stay_idx>/photos` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-68876efdf480aae2", "name": "Unused endpoint: ANY /trips/<int:trip_id>/stays/<int:stay_idx>/reorder", "shortDescription": {"text": "Unused endpoint: ANY /trips/<int:trip_id>/stays/<int:stay_idx>/reorder"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /trips/<int:trip_id>/stays/<int:stay_idx>/reorder` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-45e0d78ddedebf07", "name": "Unused endpoint: ANY /trips/<int:trip_id>/events/<int:event_idx>/upload", "shortDescription": {"text": "Unused endpoint: ANY /trips/<int:trip_id>/events/<int:event_idx>/upload"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /trips/<int:trip_id>/events/<int:event_idx>/upload` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-14bb577036c8d842", "name": "Unused endpoint: ANY /trips/<int:trip_id>/events/<int:event_idx>/caption", "shortDescription": {"text": "Unused endpoint: ANY /trips/<int:trip_id>/events/<int:event_idx>/caption"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /trips/<int:trip_id>/events/<int:event_idx>/caption` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c28dd7538e184c3", "name": "Unused endpoint: ANY /trips/<int:trip_id>/events/<int:event_idx>/photos/<filename>", "shortDescription": {"text": "Unused endpoint: ANY /trips/<int:trip_id>/events/<int:event_idx>/photos/<filename>"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /trips/<int:trip_id>/events/<int:event_idx>/photos/<filename>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2ed0f27429c9a9c1", "name": "Unused endpoint: ANY /trips/<int:trip_id>/events/<int:event_idx>/photos/<filename>/restore", "shortDescription": {"text": "Unused endpoint: ANY /trips/<int:trip_id>/events/<int:event_idx>/photos/<filename>/restore"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /trips/<int:trip_id>/events/<int:event_idx>/photos/<filename>/restore` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c8fdfc04b28ab412", "name": "Unused endpoint: ANY /trips/<int:trip_id>/events/<int:event_idx>/photos", "shortDescription": {"text": "Unused endpoint: ANY /trips/<int:trip_id>/events/<int:event_idx>/photos"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /trips/<int:trip_id>/events/<int:event_idx>/photos` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-294c5a40eb5a7b43", "name": "Unused endpoint: ANY /trips/<int:trip_id>/events/<int:event_idx>/reorder", "shortDescription": {"text": "Unused endpoint: ANY /trips/<int:trip_id>/events/<int:event_idx>/reorder"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /trips/<int:trip_id>/events/<int:event_idx>/reorder` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-645e867920784f45", "name": "Unused endpoint: ANY /api/trips", "shortDescription": {"text": "Unused endpoint: ANY /api/trips"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /api/trips` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b101b38ce7bb2e18", "name": "Unused endpoint: ANY /api/trips/<int:trip_id>", "shortDescription": {"text": "Unused endpoint: ANY /api/trips/<int:trip_id>"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /api/trips/<int:trip_id>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fdd41cba1fcbf15f", "name": "Unused endpoint: ANY /api/trips/<int:trip_id>/stays", "shortDescription": {"text": "Unused endpoint: ANY /api/trips/<int:trip_id>/stays"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /api/trips/<int:trip_id>/stays` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0b40bb4219b026e3", "name": "Unused endpoint: ANY /api/trips/<int:trip_id>/stays/<int:stay_idx>", "shortDescription": {"text": "Unused endpoint: ANY /api/trips/<int:trip_id>/stays/<int:stay_idx>"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /api/trips/<int:trip_id>/stays/<int:stay_idx>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e332efbb3a22a0b0", "name": "Unused endpoint: ANY /api/trips/<int:trip_id>/events", "shortDescription": {"text": "Unused endpoint: ANY /api/trips/<int:trip_id>/events"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /api/trips/<int:trip_id>/events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-efb30e441b11f155", "name": "Unused endpoint: ANY /api/trips/<int:trip_id>/events/<int:event_idx>", "shortDescription": {"text": "Unused endpoint: ANY /api/trips/<int:trip_id>/events/<int:event_idx>"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /api/trips/<int:trip_id>/events/<int:event_idx>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1d827f524e015147", "name": "Unused endpoint: ANY /campgrounds/map", "shortDescription": {"text": "Unused endpoint: ANY /campgrounds/map"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /campgrounds/map` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f4957d75b55d04ed", "name": "Unused endpoint: ANY /campgrounds/waterfront", "shortDescription": {"text": "Unused endpoint: ANY /campgrounds/waterfront"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /campgrounds/waterfront` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d111ea55d0c896e9", "name": "Unused endpoint: ANY /campgrounds/climate", "shortDescription": {"text": "Unused endpoint: ANY /campgrounds/climate"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /campgrounds/climate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4f4cbec06a623da7", "name": "Unused endpoint: ANY /trips/<int:trip_id>/move-photo", "shortDescription": {"text": "Unused endpoint: ANY /trips/<int:trip_id>/move-photo"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /trips/<int:trip_id>/move-photo` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-73344ad56881805a", "name": "Unused endpoint: ANY /admin/users", "shortDescription": {"text": "Unused endpoint: ANY /admin/users"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /admin/users` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-33de9c10cc501140", "name": "Unused endpoint: ANY /api/users", "shortDescription": {"text": "Unused endpoint: ANY /api/users"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /api/users` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-06b89185a1d98e85", "name": "Unused endpoint: ANY /api/users/<username>", "shortDescription": {"text": "Unused endpoint: ANY /api/users/<username>"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /api/users/<username>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b0705664f271ad59", "name": "Unused endpoint: ANY /campgrounds/manage", "shortDescription": {"text": "Unused endpoint: ANY /campgrounds/manage"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /campgrounds/manage` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52b301faba7c2ece", "name": "Unused endpoint: ANY /api/campgrounds/all", "shortDescription": {"text": "Unused endpoint: ANY /api/campgrounds/all"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /api/campgrounds/all` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8bdccc9ead39959e", "name": "Unused endpoint: ANY /api/campgrounds/<int:cg_id>", "shortDescription": {"text": "Unused endpoint: ANY /api/campgrounds/<int:cg_id>"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /api/campgrounds/<int:cg_id>` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4eb2187fbaec8439", "name": "Unused endpoint: ANY /api/geocode", "shortDescription": {"text": "Unused endpoint: ANY /api/geocode"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /api/geocode` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-25a3adfa9f43bb2a", "name": "Unused endpoint: ANY /api/reverse-geocode", "shortDescription": {"text": "Unused endpoint: ANY /api/reverse-geocode"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /api/reverse-geocode` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d7ce7c08afd2ab37", "name": "Unused endpoint: ANY /api/trips/<int:trip_id>/track", "shortDescription": {"text": "Unused endpoint: ANY /api/trips/<int:trip_id>/track"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /api/trips/<int:trip_id>/track` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6c895802e2f22f4f", "name": "Unused endpoint: ANY /api/trips/<int:trip_id>/suppress-pings", "shortDescription": {"text": "Unused endpoint: ANY /api/trips/<int:trip_id>/suppress-pings"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /api/trips/<int:trip_id>/suppress-pings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-10413c6b9bbef041", "name": "Unused endpoint: ANY /api/trips/<int:trip_id>/relocate-pings", "shortDescription": {"text": "Unused endpoint: ANY /api/trips/<int:trip_id>/relocate-pings"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /api/trips/<int:trip_id>/relocate-pings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-40566ba8de9102ea", "name": "Unused endpoint: ANY /api/trips/<int:trip_id>/tid-overrides", "shortDescription": {"text": "Unused endpoint: ANY /api/trips/<int:trip_id>/tid-overrides"}, "fullDescription": {"text": "`ekko_trips_app.py` declares `ANY /api/trips/<int:trip_id>/tid-overrides` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19339"}, "properties": {"repository": "shade-tree-software/campgrounds", "repoUrl": "https://github.com/shade-tree-software/campgrounds", "branch": "main"}, "results": [{"ruleId": "scanner-e77fbf35ff514e80", "level": "note", "message": {"text": "Possibly dead Python function: lookup"}, "properties": {"repobilityId": "16e76142eb4f59a9", "scanner": "scanner-primary", "fingerprint": "e77fbf35ff514e80", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py:2362"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bba7b08754eb1d1d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 static/trip-detail/map.js:201"}, "properties": {"repobilityId": "06f79cebfd6a03ae", "scanner": "scanner-primary", "fingerprint": "bba7b08754eb1d1d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c48659d2d0f04864", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 static/trip-detail/timeline.js:906"}, "properties": {"repobilityId": "f8a039e14c182c0d", "scanner": "scanner-primary", "fingerprint": "c48659d2d0f04864", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-cdb35b14a9bbf866", "level": "note", "message": {"text": "Insecure pattern 'debug_true' in summer_seeker_app.py:133"}, "properties": {"repobilityId": "d3bf53945ec789cf", "scanner": "scanner-primary", "fingerprint": "cdb35b14a9bbf866", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "debug_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "summer_seeker_app.py"}, "region": {"startLine": 133}}}]}, {"ruleId": "scanner-8249228b2ebad5c3", "level": "note", "message": {"text": "Insecure pattern 'debug_true' in ekko_trips_app.py:4186"}, "properties": {"repobilityId": "637e209f48152d92", "scanner": "scanner-primary", "fingerprint": "8249228b2ebad5c3", "layer": "security", "severity": "low", "confidence": 1.0, "tags": ["owasp", "debug_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 4186}}}]}, {"ruleId": "scanner-86c38e5faf8ac1c7", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/map-picker.js:247"}, "properties": {"repobilityId": "dd86752410dcf656", "scanner": "scanner-primary", "fingerprint": "86c38e5faf8ac1c7", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "static/map-picker.js"}, "region": {"startLine": 247}}}]}, {"ruleId": "scanner-d2c22d7aa210544d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/trip-detail/detect-stops.js:178"}, "properties": {"repobilityId": "abfbd2b9a2f75a64", "scanner": "scanner-primary", "fingerprint": "d2c22d7aa210544d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "static/trip-detail/detect-stops.js"}, "region": {"startLine": 178}}}]}, {"ruleId": "scanner-dd554912b23ffde0", "level": "warning", "message": {"text": "Insecure pattern 'direct_outerhtml_assignment' in static/trip-detail/detect-stops.js:293"}, "properties": {"repobilityId": "f95902b314cb207b", "scanner": "scanner-primary", "fingerprint": "dd554912b23ffde0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_outerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "static/trip-detail/detect-stops.js"}, "region": {"startLine": 293}}}]}, {"ruleId": "scanner-0f7440715830b5e3", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/trip-detail/timeline.js:26"}, "properties": {"repobilityId": "d059971321054d16", "scanner": "scanner-primary", "fingerprint": "0f7440715830b5e3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "static/trip-detail/timeline.js"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-2e7bd7ba458f1662", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/trip-detail/photos.js:84"}, "properties": {"repobilityId": "c4275b00244f3d9d", "scanner": "scanner-primary", "fingerprint": "2e7bd7ba458f1662", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "static/trip-detail/photos.js"}, "region": {"startLine": 84}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-e0f57dc4b5480076", "level": "note", "message": {"text": "Very large file: ekko_trips_app.py (4186 lines)"}, "properties": {"repobilityId": "5ab4acc8152ff881", "scanner": "scanner-primary", "fingerprint": "e0f57dc4b5480076", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4604ed2fe4ee59d0", "level": "note", "message": {"text": "Very large file: static/trip-detail/map.js (1072 lines)"}, "properties": {"repobilityId": "3a344ff1a2e03362", "scanner": "scanner-primary", "fingerprint": "4604ed2fe4ee59d0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "d6631494b2017305", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "d5210fe727c010c0", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "b1491a767cb5bba3", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "abf9386c7b155f04", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "822c7f80bfe55761", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "93078caffc553c00", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "ea3a30ed9919720b", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "fb046fb24086f271", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-122f91b7f2906dc4", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.json"}, "properties": {"repobilityId": "a2967269048b6a9d", "scanner": "scanner-primary", "fingerprint": "122f91b7f2906dc4", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-293f4b384576722a", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 get_elevation.py:14"}, "properties": {"repobilityId": "57d930846407a2cf", "scanner": "scanner-primary", "fingerprint": "293f4b384576722a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ec56a79b3a935988", "level": "note", "message": {"text": "Stub function `progress_callback` (body is just `pass`/`return`) \u2014 summer_seeker_app.py:88"}, "properties": {"repobilityId": "a939926f631c18b1", "scanner": "scanner-primary", "fingerprint": "ec56a79b3a935988", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-7944e9432ad92648", "level": "none", "message": {"text": "Commented-code block (8 lines) in trips.py:442"}, "properties": {"repobilityId": "7dd4fbe5a846e28b", "scanner": "scanner-primary", "fingerprint": "7944e9432ad92648", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-c813abd7d50e1848", "level": "note", "message": {"text": "Legacy-named symbol `is_old` in ekko_trips_app.py:2417"}, "properties": {"repobilityId": "e15759efd88ca76f", "scanner": "scanner-primary", "fingerprint": "c813abd7d50e1848", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c1bd8a0acd387654", "level": "none", "message": {"text": "Commented-code block (9 lines) in ekko_trips_app.py:295"}, "properties": {"repobilityId": "72de0bdb07f9d053", "scanner": "scanner-primary", "fingerprint": "c1bd8a0acd387654", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f21df64af324fab0", "level": "none", "message": {"text": "Commented-code block (13 lines) in static/sw.js:3"}, "properties": {"repobilityId": "97c95c4683b93d1c", "scanner": "scanner-primary", "fingerprint": "f21df64af324fab0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-35d0bf15b797d3c2", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 static/map-picker.js:243"}, "properties": {"repobilityId": "b4557e984a77afff", "scanner": "scanner-primary", "fingerprint": "35d0bf15b797d3c2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-74cd133559175960", "level": "none", "message": {"text": "Commented-code block (9 lines) in static/trip-detail/detect-stops.js:1"}, "properties": {"repobilityId": "78130d44678ff26c", "scanner": "scanner-primary", "fingerprint": "74cd133559175960", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-7eff4179ec11ec9c", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 static/trip-detail/detect-stops.js:196"}, "properties": {"repobilityId": "c66a5db52ff6cd8e", "scanner": "scanner-primary", "fingerprint": "7eff4179ec11ec9c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-fe24ad24708b6cd0", "level": "none", "message": {"text": "Commented-code block (6 lines) in static/trip-detail/overrides.js:1"}, "properties": {"repobilityId": "f622ba97a2f9c930", "scanner": "scanner-primary", "fingerprint": "fe24ad24708b6cd0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-159d84a515c8d95b", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 static/trip-detail/overrides.js:325"}, "properties": {"repobilityId": "196b422a4d100e5b", "scanner": "scanner-primary", "fingerprint": "159d84a515c8d95b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-746a816efad9ee64", "level": "none", "message": {"text": "Commented-code block (5 lines) in static/trip-detail/map.js:102"}, "properties": {"repobilityId": "905d4d6d4bdc0243", "scanner": "scanner-primary", "fingerprint": "746a816efad9ee64", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-a814e6fec1cf69b1", "level": "none", "message": {"text": "Commented-code block (7 lines) in static/trip-detail/timeline.js:225"}, "properties": {"repobilityId": "65998369a03c195f", "scanner": "scanner-primary", "fingerprint": "a814e6fec1cf69b1", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bb655e70eadaac7e", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 static/trip-detail/timeline.js:6"}, "properties": {"repobilityId": "a9f174663b8a063b", "scanner": "scanner-primary", "fingerprint": "bb655e70eadaac7e", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-1c81ed48f9b52384", "level": "none", "message": {"text": "Commented-code block (7 lines) in static/trip-detail/lightbox.js:1"}, "properties": {"repobilityId": "4c4f23437b45fe86", "scanner": "scanner-primary", "fingerprint": "1c81ed48f9b52384", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-76de0d006f97548d", "level": "none", "message": {"text": "Commented-code block (6 lines) in static/trip-detail/boot.js:1"}, "properties": {"repobilityId": "4548aa0aac40a5e5", "scanner": "scanner-primary", "fingerprint": "76de0d006f97548d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e777f329ff82c63c", "level": "none", "message": {"text": "Commented-code block (10 lines) in static/trip-detail/photos.js:1"}, "properties": {"repobilityId": "a6be31ebfee8f86f", "scanner": "scanner-primary", "fingerprint": "e777f329ff82c63c", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ca49f140e1d68c61", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 static/trip-detail/photos.js:55"}, "properties": {"repobilityId": "bf4e4b5385b713dc", "scanner": "scanner-primary", "fingerprint": "ca49f140e1d68c61", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "aa4d23f2a58a2b83", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "8dab58ecf7e23689", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "0088354cd5996ebb", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "7860b56756824f92", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-5ab5c9bdfaa13e7d", "level": "error", "message": {"text": "Flask mutation route `search` without `@login_required` \u2014 summer_seeker_app.py:46"}, "properties": {"repobilityId": "5b068e6ffc657312", "scanner": "scanner-primary", "fingerprint": "5ab5c9bdfaa13e7d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "summer_seeker_app.py"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-6373ce291c3b615c", "level": "error", "message": {"text": "Flask mutation route `login` without `@login_required` \u2014 ekko_trips_app.py:665"}, "properties": {"repobilityId": "d0ac62de3f8d275c", "scanner": "scanner-primary", "fingerprint": "6373ce291c3b615c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 665}}}]}, {"ruleId": "scanner-de96369d9bfad277", "level": "error", "message": {"text": "Flask mutation route `upload_photo` without `@login_required` \u2014 ekko_trips_app.py:1186"}, "properties": {"repobilityId": "268c993373bf6d69", "scanner": "scanner-primary", "fingerprint": "de96369d9bfad277", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 1186}}}]}, {"ruleId": "scanner-badef4dd36e9f7bc", "level": "error", "message": {"text": "Flask mutation route `save_caption` without `@login_required` \u2014 ekko_trips_app.py:1224"}, "properties": {"repobilityId": "efd1c440cfd53b6a", "scanner": "scanner-primary", "fingerprint": "badef4dd36e9f7bc", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 1224}}}]}, {"ruleId": "scanner-3d58afb1ef1eae8b", "level": "error", "message": {"text": "Flask mutation route `delete_photo` without `@login_required` \u2014 ekko_trips_app.py:1244"}, "properties": {"repobilityId": "6a303d4c83c1260c", "scanner": "scanner-primary", "fingerprint": "3d58afb1ef1eae8b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 1244}}}]}, {"ruleId": "scanner-70da1f65b6c47b85", "level": "error", "message": {"text": "Flask mutation route `restore_photo` without `@login_required` \u2014 ekko_trips_app.py:1262"}, "properties": {"repobilityId": "dea88a3ed0517fe0", "scanner": "scanner-primary", "fingerprint": "70da1f65b6c47b85", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 1262}}}]}, {"ruleId": "scanner-deb87e6d45c1cb8f", "level": "error", "message": {"text": "Flask mutation route `delete_all_stay_photos` without `@login_required` \u2014 ekko_trips_app.py:1272"}, "properties": {"repobilityId": "94337a99334a5c74", "scanner": "scanner-primary", "fingerprint": "deb87e6d45c1cb8f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 1272}}}]}, {"ruleId": "scanner-010c390aaadd0b12", "level": "error", "message": {"text": "Flask mutation route `reorder_stay_photos` without `@login_required` \u2014 ekko_trips_app.py:1297"}, "properties": {"repobilityId": "59c579d77679bc63", "scanner": "scanner-primary", "fingerprint": "010c390aaadd0b12", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 1297}}}]}, {"ruleId": "scanner-2c0d6970968752f4", "level": "error", "message": {"text": "Flask mutation route `upload_event_photo` without `@login_required` \u2014 ekko_trips_app.py:1313"}, "properties": {"repobilityId": "744e15fe465ec3fd", "scanner": "scanner-primary", "fingerprint": "2c0d6970968752f4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 1313}}}]}, {"ruleId": "scanner-7ce8b2b3b56eda5f", "level": "error", "message": {"text": "Flask mutation route `save_event_caption` without `@login_required` \u2014 ekko_trips_app.py:1352"}, "properties": {"repobilityId": "25386a7c4572bc21", "scanner": "scanner-primary", "fingerprint": "7ce8b2b3b56eda5f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 1352}}}]}, {"ruleId": "scanner-fdd3e521b40f9fc0", "level": "error", "message": {"text": "Flask mutation route `delete_event_photo` without `@login_required` \u2014 ekko_trips_app.py:1372"}, "properties": {"repobilityId": "feb07124450a1d0b", "scanner": "scanner-primary", "fingerprint": "fdd3e521b40f9fc0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 1372}}}]}, {"ruleId": "scanner-e0a4e5d02e42c2f2", "level": "error", "message": {"text": "Flask mutation route `restore_event_photo` without `@login_required` \u2014 ekko_trips_app.py:1389"}, "properties": {"repobilityId": "42acdac5ab6896dd", "scanner": "scanner-primary", "fingerprint": "e0a4e5d02e42c2f2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 1389}}}]}, {"ruleId": "scanner-bdc88c0b76c1ca7b", "level": "error", "message": {"text": "Flask mutation route `delete_all_event_photos` without `@login_required` \u2014 ekko_trips_app.py:1399"}, "properties": {"repobilityId": "cb32fe5e43ddf322", "scanner": "scanner-primary", "fingerprint": "bdc88c0b76c1ca7b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 1399}}}]}, {"ruleId": "scanner-69bcc1fb0d6201b4", "level": "error", "message": {"text": "Flask mutation route `reorder_event_photos` without `@login_required` \u2014 ekko_trips_app.py:1424"}, "properties": {"repobilityId": "44f8b36623166f4e", "scanner": "scanner-primary", "fingerprint": "69bcc1fb0d6201b4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 1424}}}]}, {"ruleId": "scanner-2d238b13ffce375b", "level": "error", "message": {"text": "Flask mutation route `api_create_trip` without `@login_required` \u2014 ekko_trips_app.py:1440"}, "properties": {"repobilityId": "bc60a5433443620e", "scanner": "scanner-primary", "fingerprint": "2d238b13ffce375b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 1440}}}]}, {"ruleId": "scanner-b656ab9469c67636", "level": "error", "message": {"text": "Flask mutation route `api_update_trip` without `@login_required` \u2014 ekko_trips_app.py:1450"}, "properties": {"repobilityId": "e1c9a143682c3e28", "scanner": "scanner-primary", "fingerprint": "b656ab9469c67636", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 1450}}}]}, {"ruleId": "scanner-e964f4b9479f4bf2", "level": "error", "message": {"text": "Flask mutation route `api_delete_trip` without `@login_required` \u2014 ekko_trips_app.py:1462"}, "properties": {"repobilityId": "84010da9e5723626", "scanner": "scanner-primary", "fingerprint": "e964f4b9479f4bf2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 1462}}}]}, {"ruleId": "scanner-25710b47768de32f", "level": "error", "message": {"text": "Flask mutation route `api_add_stay` without `@login_required` \u2014 ekko_trips_app.py:1475"}, "properties": {"repobilityId": "24c74d187e504e79", "scanner": "scanner-primary", "fingerprint": "25710b47768de32f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 1475}}}]}, {"ruleId": "scanner-923897730fc00983", "level": "error", "message": {"text": "Flask mutation route `api_update_stay` without `@login_required` \u2014 ekko_trips_app.py:1487"}, "properties": {"repobilityId": "af7219b8c0b6dfaa", "scanner": "scanner-primary", "fingerprint": "923897730fc00983", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 1487}}}]}, {"ruleId": "scanner-891f27964a8f0813", "level": "error", "message": {"text": "Flask mutation route `api_delete_stay` without `@login_required` \u2014 ekko_trips_app.py:1499"}, "properties": {"repobilityId": "8a35d434567d4b81", "scanner": "scanner-primary", "fingerprint": "891f27964a8f0813", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 1499}}}]}, {"ruleId": "scanner-f6ca83f447cdb924", "level": "error", "message": {"text": "Flask mutation route `api_add_event` without `@login_required` \u2014 ekko_trips_app.py:1514"}, "properties": {"repobilityId": "e2d039ef132aa3f6", "scanner": "scanner-primary", "fingerprint": "f6ca83f447cdb924", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 1514}}}]}, {"ruleId": "scanner-33d0b19eb2586845", "level": "error", "message": {"text": "Flask mutation route `api_update_event` without `@login_required` \u2014 ekko_trips_app.py:1526"}, "properties": {"repobilityId": "bdc83d4e26366809", "scanner": "scanner-primary", "fingerprint": "33d0b19eb2586845", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 1526}}}]}, {"ruleId": "scanner-68e68be61fd3330a", "level": "error", "message": {"text": "Flask mutation route `api_delete_event` without `@login_required` \u2014 ekko_trips_app.py:1538"}, "properties": {"repobilityId": "22f0a88089dfbc90", "scanner": "scanner-primary", "fingerprint": "68e68be61fd3330a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 1538}}}]}, {"ruleId": "scanner-dcfe952072369005", "level": "error", "message": {"text": "Flask mutation route `move_photo` without `@login_required` \u2014 ekko_trips_app.py:1606"}, "properties": {"repobilityId": "95961abf4196a829", "scanner": "scanner-primary", "fingerprint": "dcfe952072369005", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 1606}}}]}, {"ruleId": "scanner-c056958abec28352", "level": "error", "message": {"text": "Flask mutation route `api_user_create` without `@login_required` \u2014 ekko_trips_app.py:1714"}, "properties": {"repobilityId": "caf337a3793aa468", "scanner": "scanner-primary", "fingerprint": "c056958abec28352", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 1714}}}]}, {"ruleId": "scanner-f267418d8f820660", "level": "error", "message": {"text": "Flask mutation route `api_user_update` without `@login_required` \u2014 ekko_trips_app.py:1740"}, "properties": {"repobilityId": "a3e87165a635db90", "scanner": "scanner-primary", "fingerprint": "f267418d8f820660", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 1740}}}]}, {"ruleId": "scanner-738d2c3a2f116d87", "level": "error", "message": {"text": "Flask mutation route `api_user_delete` without `@login_required` \u2014 ekko_trips_app.py:1765"}, "properties": {"repobilityId": "1a486eb45a804d65", "scanner": "scanner-primary", "fingerprint": "738d2c3a2f116d87", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 1765}}}]}, {"ruleId": "scanner-723b84bc78dd7873", "level": "error", "message": {"text": "Flask mutation route `api_create_campground` without `@login_required` \u2014 ekko_trips_app.py:1817"}, "properties": {"repobilityId": "54282ec3cb25ff3a", "scanner": "scanner-primary", "fingerprint": "723b84bc78dd7873", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 1817}}}]}, {"ruleId": "scanner-a1571db9182ebeb3", "level": "error", "message": {"text": "Flask mutation route `api_update_campground` without `@login_required` \u2014 ekko_trips_app.py:1857"}, "properties": {"repobilityId": "a3e14d402a34426d", "scanner": "scanner-primary", "fingerprint": "a1571db9182ebeb3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 1857}}}]}, {"ruleId": "scanner-82a6e0337249c7b3", "level": "error", "message": {"text": "Flask mutation route `api_suppress_pings` without `@login_required` \u2014 ekko_trips_app.py:3712"}, "properties": {"repobilityId": "ff53001020941401", "scanner": "scanner-primary", "fingerprint": "82a6e0337249c7b3", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 3712}}}]}, {"ruleId": "scanner-6d5923a6403149c0", "level": "error", "message": {"text": "Flask mutation route `api_unsuppress_pings` without `@login_required` \u2014 ekko_trips_app.py:3728"}, "properties": {"repobilityId": "e12df44534a7b0ab", "scanner": "scanner-primary", "fingerprint": "6d5923a6403149c0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 3728}}}]}, {"ruleId": "scanner-7f6ab092410871ad", "level": "error", "message": {"text": "Flask mutation route `api_relocate_pings` without `@login_required` \u2014 ekko_trips_app.py:3744"}, "properties": {"repobilityId": "eb19db91b1d6136e", "scanner": "scanner-primary", "fingerprint": "7f6ab092410871ad", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 3744}}}]}, {"ruleId": "scanner-9cdcb3e09ca20fa1", "level": "error", "message": {"text": "Flask mutation route `api_unrelocate_pings` without `@login_required` \u2014 ekko_trips_app.py:3780"}, "properties": {"repobilityId": "307bb51444dbf592", "scanner": "scanner-primary", "fingerprint": "9cdcb3e09ca20fa1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 3780}}}]}, {"ruleId": "scanner-9409284baeacd147", "level": "error", "message": {"text": "Flask mutation route `api_set_tid_override` without `@login_required` \u2014 ekko_trips_app.py:3820"}, "properties": {"repobilityId": "d430d4bd7c59947f", "scanner": "scanner-primary", "fingerprint": "9409284baeacd147", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 3820}}}]}, {"ruleId": "scanner-8705c0000c1962fa", "level": "error", "message": {"text": "Flask mutation route `api_detect_stops` without `@login_required` \u2014 ekko_trips_app.py:3942"}, "properties": {"repobilityId": "ed96403fdb40173e", "scanner": "scanner-primary", "fingerprint": "8705c0000c1962fa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 3942}}}]}, {"ruleId": "scanner-4b5dc9cdaaf42d1d", "level": "error", "message": {"text": "Flask mutation route `api_accept_stops` without `@login_required` \u2014 ekko_trips_app.py:4100"}, "properties": {"repobilityId": "0dec24fcf0e6a980", "scanner": "scanner-primary", "fingerprint": "4b5dc9cdaaf42d1d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 4100}}}]}, {"ruleId": "scanner-583796a4f11a5866", "level": "error", "message": {"text": "Flask mutation route `api_delete_campground` without `@login_required` \u2014 ekko_trips_app.py:4149"}, "properties": {"repobilityId": "85e0b1237101cfd1", "scanner": "scanner-primary", "fingerprint": "583796a4f11a5866", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "ekko_trips_app.py"}, "region": {"startLine": 4149}}}]}, {"ruleId": "scanner-2644d38539df7608", "level": "error", "message": {"text": "Dangling fetch: POST /api/trips/${TRIP_ID}/detect-stops (static/trip-detail/detect-stops.js:196)"}, "properties": {"repobilityId": "3bc5cd38c2c6b9b8", "scanner": "scanner-primary", "fingerprint": "2644d38539df7608", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-b615cc509b137b54", "level": "error", "message": {"text": "Dangling fetch: POST /api/trips/${TRIP_ID}/accept-stops (static/trip-detail/detect-stops.js:366)"}, "properties": {"repobilityId": "91e83dc9cd299f9c", "scanner": "scanner-primary", "fingerprint": "b615cc509b137b54", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-a779256e40d441ef", "level": "error", "message": {"text": "Dangling fetch: POST /api/trips/${TRIP_ID}/relocate-pings (static/trip-detail/overrides.js:325)"}, "properties": {"repobilityId": "8adfff29eed7f4f5", "scanner": "scanner-primary", "fingerprint": "a779256e40d441ef", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-327f690906bb2e92", "level": "error", "message": {"text": "Dangling fetch: PUT /api/trips/${TRIP_ID}/stays/${best.idx} (static/trip-detail/overrides.js:530)"}, "properties": {"repobilityId": "592fcc717faa0fdc", "scanner": "scanner-primary", "fingerprint": "327f690906bb2e92", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-d546d86211acef99", "level": "error", "message": {"text": "Dangling fetch: POST /api/trips/${TRIP_ID}/suppress-pings (static/trip-detail/overrides.js:559)"}, "properties": {"repobilityId": "69e8983007b79b4a", "scanner": "scanner-primary", "fingerprint": "d546d86211acef99", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-388dae9b73e9184c", "level": "error", "message": {"text": "Dangling fetch: POST /api/trips/${TRIP_ID}/relocate-pings (static/trip-detail/overrides.js:622)"}, "properties": {"repobilityId": "4533ecee62d4f66c", "scanner": "scanner-primary", "fingerprint": "388dae9b73e9184c", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-18c6ee5a163b767a", "level": "error", "message": {"text": "Dangling fetch: DELETE /api/trips/${TRIP_ID}/relocate-pings (static/trip-detail/overrides.js:686)"}, "properties": {"repobilityId": "02554767a6117656", "scanner": "scanner-primary", "fingerprint": "18c6ee5a163b767a", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-1213d6f3b95f3074", "level": "error", "message": {"text": "Dangling fetch: DELETE /api/trips/${TRIP_ID}/suppress-pings (static/trip-detail/overrides.js:705)"}, "properties": {"repobilityId": "aa0571ab1d98501b", "scanner": "scanner-primary", "fingerprint": "1213d6f3b95f3074", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-ed3189e161a845c3", "level": "error", "message": {"text": "Dangling fetch: PUT /api/trips/${TRIP_ID} (static/trip-detail/timeline.js:169)"}, "properties": {"repobilityId": "6dacdea6943fd65b", "scanner": "scanner-primary", "fingerprint": "ed3189e161a845c3", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-476268cd1c7e3cfb", "level": "error", "message": {"text": "Dangling fetch: PUT /api/trips/${TRIP_ID} (static/trip-detail/timeline.js:198)"}, "properties": {"repobilityId": "afd1218412110583", "scanner": "scanner-primary", "fingerprint": "476268cd1c7e3cfb", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-1ac15a39bd53393b", "level": "error", "message": {"text": "Dangling fetch: DELETE /api/trips/${TRIP_ID} (static/trip-detail/timeline.js:212)"}, "properties": {"repobilityId": "472ea5224d71dac9", "scanner": "scanner-primary", "fingerprint": "1ac15a39bd53393b", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-1c527edb2379cebb", "level": "error", "message": {"text": "Dangling fetch: GET /api/trips/${TRIP_ID}/tid-choices (static/trip-detail/timeline.js:244)"}, "properties": {"repobilityId": "2e91d8df8a0eff78", "scanner": "scanner-primary", "fingerprint": "1c527edb2379cebb", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-8ec4fac163e692bb", "level": "error", "message": {"text": "Dangling fetch: PUT /api/trips/${TRIP_ID}/tid-overrides (static/trip-detail/timeline.js:332)"}, "properties": {"repobilityId": "0eef14a3fd146de6", "scanner": "scanner-primary", "fingerprint": "8ec4fac163e692bb", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-994f8ab3dee4e186", "level": "error", "message": {"text": "Dangling fetch: PUT /api/trips/${TRIP_ID}/stays/${idx} (static/trip-detail/timeline.js:388)"}, "properties": {"repobilityId": "0ea49b59dbf1a450", "scanner": "scanner-primary", "fingerprint": "994f8ab3dee4e186", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-347308a8fa072f72", "level": "error", "message": {"text": "Dangling fetch: DELETE /api/trips/${TRIP_ID}/stays/${idx} (static/trip-detail/timeline.js:439)"}, "properties": {"repobilityId": "9fa7c718a5190f9b", "scanner": "scanner-primary", "fingerprint": "347308a8fa072f72", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-12b0221f8232c106", "level": "error", "message": {"text": "Dangling fetch: PUT /api/trips/${TRIP_ID}/events/${idx} (static/trip-detail/timeline.js:625)"}, "properties": {"repobilityId": "854aec9377744350", "scanner": "scanner-primary", "fingerprint": "12b0221f8232c106", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-1a4972b721ea457d", "level": "error", "message": {"text": "Dangling fetch: DELETE /api/trips/${TRIP_ID}/events/${idx} (static/trip-detail/timeline.js:646)"}, "properties": {"repobilityId": "07fb165780573c68", "scanner": "scanner-primary", "fingerprint": "1a4972b721ea457d", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-46306c8f59eab14b", "level": "error", "message": {"text": "Dangling fetch: DELETE /trips/${tripId}/events/${eventIdx}/photos (static/trip-detail/photos.js:80)"}, "properties": {"repobilityId": "9e6fc0cec606171a", "scanner": "scanner-primary", "fingerprint": "46306c8f59eab14b", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-5484c31b4166f77f", "level": "error", "message": {"text": "Dangling fetch: POST /trips/${tripId}/stays/${stayIdx}/caption (static/trip-detail/photos.js:187)"}, "properties": {"repobilityId": "cedb3d477f364843", "scanner": "scanner-primary", "fingerprint": "5484c31b4166f77f", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-7ff6ed739b775bdc", "level": "error", "message": {"text": "Dangling fetch: DELETE /trips/${tripId}/stays/${stayIdx}/photos (static/trip-detail/photos.js:236)"}, "properties": {"repobilityId": "f8f6870f0f8ed305", "scanner": "scanner-primary", "fingerprint": "7ff6ed739b775bdc", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-35b4653a3dea0d1e", "level": "error", "message": {"text": "Dangling fetch: POST /trips/${TRIP_ID}/move-photo (static/trip-detail/photos.js:436)"}, "properties": {"repobilityId": "6e83b14fc5668f6f", "scanner": "scanner-primary", "fingerprint": "35b4653a3dea0d1e", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-1a6d91f2236825bf", "level": "note", "message": {"text": "Unused endpoint: ANY /"}, "properties": {"repobilityId": "6f67615f6f46d7b5", "scanner": "scanner-primary", "fingerprint": "1a6d91f2236825bf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-722b9c3df5fc807a", "level": "note", "message": {"text": "Unused endpoint: ANY /geocode"}, "properties": {"repobilityId": "13070d96f82d53d0", "scanner": "scanner-primary", "fingerprint": "722b9c3df5fc807a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-117531c0d0465186", "level": "note", "message": {"text": "Unused endpoint: ANY /search"}, "properties": {"repobilityId": "a5f8cf3e80d77304", "scanner": "scanner-primary", "fingerprint": "117531c0d0465186", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fbf75d1534d0991f", "level": "note", "message": {"text": "Unused endpoint: ANY /thumb/<path:subpath>"}, "properties": {"repobilityId": "eb4fadf0feeb9b35", "scanner": "scanner-primary", "fingerprint": "fbf75d1534d0991f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-eba3d61a670b6f09", "level": "note", "message": {"text": "Unused endpoint: ANY /sw.js"}, "properties": {"repobilityId": "aca71a85212cc2ce", "scanner": "scanner-primary", "fingerprint": "eba3d61a670b6f09", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5a6392a7c6694326", "level": "note", "message": {"text": "Unused endpoint: ANY /offline"}, "properties": {"repobilityId": "514fa81dbfe55a59", "scanner": "scanner-primary", "fingerprint": "5a6392a7c6694326", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-030245d358a9d4f0", "level": "note", "message": {"text": "Unused endpoint: ANY /sw-reset"}, "properties": {"repobilityId": "1434f245ba110a88", "scanner": "scanner-primary", "fingerprint": "030245d358a9d4f0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4c7ad61ba1b23915", "level": "note", "message": {"text": "Unused endpoint: ANY /login"}, "properties": {"repobilityId": "2d98509b01a7e822", "scanner": "scanner-primary", "fingerprint": "4c7ad61ba1b23915", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c9e449c3b9e73b73", "level": "note", "message": {"text": "Unused endpoint: ANY /logout"}, "properties": {"repobilityId": "57bace87a1d4fb41", "scanner": "scanner-primary", "fingerprint": "c9e449c3b9e73b73", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-139e72f7e8b70097", "level": "note", "message": {"text": "Unused endpoint: ANY /trips"}, "properties": {"repobilityId": "72656d9f1f482f49", "scanner": "scanner-primary", "fingerprint": "139e72f7e8b70097", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e6ca626e3090889f", "level": "note", "message": {"text": "Unused endpoint: ANY /trips/map"}, "properties": {"repobilityId": "be379ceb0f677166", "scanner": "scanner-primary", "fingerprint": "e6ca626e3090889f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d72e5f6783bcfbd2", "level": "note", "message": {"text": "Unused endpoint: ANY /trips/poster"}, "properties": {"repobilityId": "fd8101f4e8b08cd1", "scanner": "scanner-primary", "fingerprint": "d72e5f6783bcfbd2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-deae64c74c8c2459", "level": "note", "message": {"text": "Unused endpoint: ANY /trips/calendar"}, "properties": {"repobilityId": "7bd2dd0a6914593f", "scanner": "scanner-primary", "fingerprint": "deae64c74c8c2459", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ba715ca3193fc831", "level": "note", "message": {"text": "Unused endpoint: ANY /trips/list"}, "properties": {"repobilityId": "5d2dbd37f5d3be97", "scanner": "scanner-primary", "fingerprint": "ba715ca3193fc831", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-aee1ba756d9ab17f", "level": "note", "message": {"text": "Unused endpoint: ANY /trips/stats"}, "properties": {"repobilityId": "994c72c6ec037bd4", "scanner": "scanner-primary", "fingerprint": "aee1ba756d9ab17f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4e11f09b46b4d8d9", "level": "note", "message": {"text": "Unused endpoint: ANY /trips/<int:trip_id>"}, "properties": {"repobilityId": "283e72e1d9fa8c4f", "scanner": "scanner-primary", "fingerprint": "4e11f09b46b4d8d9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5df1b37ac4197cd6", "level": "note", "message": {"text": "Unused endpoint: ANY /trips/<int:trip_id>/stays/<int:stay_idx>/upload"}, "properties": {"repobilityId": "11400bf94e029586", "scanner": "scanner-primary", "fingerprint": "5df1b37ac4197cd6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-451e6e8f8f063ecc", "level": "note", "message": {"text": "Unused endpoint: ANY /trips/<int:trip_id>/stays/<int:stay_idx>/caption"}, "properties": {"repobilityId": "25c2982df73dd316", "scanner": "scanner-primary", "fingerprint": "451e6e8f8f063ecc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-71b0ae871db3282b", "level": "note", "message": {"text": "Unused endpoint: ANY /trips/<int:trip_id>/stays/<int:stay_idx>/photos/<filename>"}, "properties": {"repobilityId": "1b460dc5a27540a7", "scanner": "scanner-primary", "fingerprint": "71b0ae871db3282b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6994b073a96c26ea", "level": "note", "message": {"text": "Unused endpoint: ANY /trips/<int:trip_id>/stays/<int:stay_idx>/photos/<filename>/restore"}, "properties": {"repobilityId": "eac7d834dabe1a85", "scanner": "scanner-primary", "fingerprint": "6994b073a96c26ea", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-be6dd0d825105a3e", "level": "note", "message": {"text": "Unused endpoint: ANY /trips/<int:trip_id>/stays/<int:stay_idx>/photos"}, "properties": {"repobilityId": "e43fe05334eb729d", "scanner": "scanner-primary", "fingerprint": "be6dd0d825105a3e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-68876efdf480aae2", "level": "note", "message": {"text": "Unused endpoint: ANY /trips/<int:trip_id>/stays/<int:stay_idx>/reorder"}, "properties": {"repobilityId": "05b3594444f47a8d", "scanner": "scanner-primary", "fingerprint": "68876efdf480aae2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-45e0d78ddedebf07", "level": "note", "message": {"text": "Unused endpoint: ANY /trips/<int:trip_id>/events/<int:event_idx>/upload"}, "properties": {"repobilityId": "afa5c41352f53c8b", "scanner": "scanner-primary", "fingerprint": "45e0d78ddedebf07", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-14bb577036c8d842", "level": "note", "message": {"text": "Unused endpoint: ANY /trips/<int:trip_id>/events/<int:event_idx>/caption"}, "properties": {"repobilityId": "06f7983cd3c5e7d0", "scanner": "scanner-primary", "fingerprint": "14bb577036c8d842", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5c28dd7538e184c3", "level": "note", "message": {"text": "Unused endpoint: ANY /trips/<int:trip_id>/events/<int:event_idx>/photos/<filename>"}, "properties": {"repobilityId": "4c1dc5462339f82a", "scanner": "scanner-primary", "fingerprint": "5c28dd7538e184c3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2ed0f27429c9a9c1", "level": "note", "message": {"text": "Unused endpoint: ANY /trips/<int:trip_id>/events/<int:event_idx>/photos/<filename>/restore"}, "properties": {"repobilityId": "7ebcb36013fce4f2", "scanner": "scanner-primary", "fingerprint": "2ed0f27429c9a9c1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c8fdfc04b28ab412", "level": "note", "message": {"text": "Unused endpoint: ANY /trips/<int:trip_id>/events/<int:event_idx>/photos"}, "properties": {"repobilityId": "bf4fd0ec8c22bd72", "scanner": "scanner-primary", "fingerprint": "c8fdfc04b28ab412", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-294c5a40eb5a7b43", "level": "note", "message": {"text": "Unused endpoint: ANY /trips/<int:trip_id>/events/<int:event_idx>/reorder"}, "properties": {"repobilityId": "aec89a665922fd9d", "scanner": "scanner-primary", "fingerprint": "294c5a40eb5a7b43", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-645e867920784f45", "level": "note", "message": {"text": "Unused endpoint: ANY /api/trips"}, "properties": {"repobilityId": "74b77605aa145f95", "scanner": "scanner-primary", "fingerprint": "645e867920784f45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b101b38ce7bb2e18", "level": "note", "message": {"text": "Unused endpoint: ANY /api/trips/<int:trip_id>"}, "properties": {"repobilityId": "75f00d6b4a30f4d3", "scanner": "scanner-primary", "fingerprint": "b101b38ce7bb2e18", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fdd41cba1fcbf15f", "level": "note", "message": {"text": "Unused endpoint: ANY /api/trips/<int:trip_id>/stays"}, "properties": {"repobilityId": "0b47fbb70e5061df", "scanner": "scanner-primary", "fingerprint": "fdd41cba1fcbf15f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0b40bb4219b026e3", "level": "note", "message": {"text": "Unused endpoint: ANY /api/trips/<int:trip_id>/stays/<int:stay_idx>"}, "properties": {"repobilityId": "3a584c0638fdaa89", "scanner": "scanner-primary", "fingerprint": "0b40bb4219b026e3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e332efbb3a22a0b0", "level": "note", "message": {"text": "Unused endpoint: ANY /api/trips/<int:trip_id>/events"}, "properties": {"repobilityId": "b340305059203c5d", "scanner": "scanner-primary", "fingerprint": "e332efbb3a22a0b0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-efb30e441b11f155", "level": "note", "message": {"text": "Unused endpoint: ANY /api/trips/<int:trip_id>/events/<int:event_idx>"}, "properties": {"repobilityId": "f4fa3ceee87db38a", "scanner": "scanner-primary", "fingerprint": "efb30e441b11f155", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1d827f524e015147", "level": "note", "message": {"text": "Unused endpoint: ANY /campgrounds/map"}, "properties": {"repobilityId": "3711168671ccf56e", "scanner": "scanner-primary", "fingerprint": "1d827f524e015147", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f4957d75b55d04ed", "level": "note", "message": {"text": "Unused endpoint: ANY /campgrounds/waterfront"}, "properties": {"repobilityId": "b9929585e4b5d89a", "scanner": "scanner-primary", "fingerprint": "f4957d75b55d04ed", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d111ea55d0c896e9", "level": "note", "message": {"text": "Unused endpoint: ANY /campgrounds/climate"}, "properties": {"repobilityId": "adfe169d83fd792a", "scanner": "scanner-primary", "fingerprint": "d111ea55d0c896e9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4f4cbec06a623da7", "level": "note", "message": {"text": "Unused endpoint: ANY /trips/<int:trip_id>/move-photo"}, "properties": {"repobilityId": "72988386c1621180", "scanner": "scanner-primary", "fingerprint": "4f4cbec06a623da7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-73344ad56881805a", "level": "note", "message": {"text": "Unused endpoint: ANY /admin/users"}, "properties": {"repobilityId": "c0b29eba4b6a2016", "scanner": "scanner-primary", "fingerprint": "73344ad56881805a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-33de9c10cc501140", "level": "note", "message": {"text": "Unused endpoint: ANY /api/users"}, "properties": {"repobilityId": "dd5cac4589402512", "scanner": "scanner-primary", "fingerprint": "33de9c10cc501140", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-06b89185a1d98e85", "level": "note", "message": {"text": "Unused endpoint: ANY /api/users/<username>"}, "properties": {"repobilityId": "8db19b2dbbdff9d1", "scanner": "scanner-primary", "fingerprint": "06b89185a1d98e85", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b0705664f271ad59", "level": "note", "message": {"text": "Unused endpoint: ANY /campgrounds/manage"}, "properties": {"repobilityId": "0dbf5376ea78191d", "scanner": "scanner-primary", "fingerprint": "b0705664f271ad59", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-52b301faba7c2ece", "level": "note", "message": {"text": "Unused endpoint: ANY /api/campgrounds/all"}, "properties": {"repobilityId": "8bc84c97d560ca85", "scanner": "scanner-primary", "fingerprint": "52b301faba7c2ece", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8bdccc9ead39959e", "level": "note", "message": {"text": "Unused endpoint: ANY /api/campgrounds/<int:cg_id>"}, "properties": {"repobilityId": "c5a64cb2a1b2ca24", "scanner": "scanner-primary", "fingerprint": "8bdccc9ead39959e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4eb2187fbaec8439", "level": "note", "message": {"text": "Unused endpoint: ANY /api/geocode"}, "properties": {"repobilityId": "8cffc162eb7cf812", "scanner": "scanner-primary", "fingerprint": "4eb2187fbaec8439", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-25a3adfa9f43bb2a", "level": "note", "message": {"text": "Unused endpoint: ANY /api/reverse-geocode"}, "properties": {"repobilityId": "fa8ad6f2948bff4f", "scanner": "scanner-primary", "fingerprint": "25a3adfa9f43bb2a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d7ce7c08afd2ab37", "level": "note", "message": {"text": "Unused endpoint: ANY /api/trips/<int:trip_id>/track"}, "properties": {"repobilityId": "3bd879c467ea5214", "scanner": "scanner-primary", "fingerprint": "d7ce7c08afd2ab37", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6c895802e2f22f4f", "level": "note", "message": {"text": "Unused endpoint: ANY /api/trips/<int:trip_id>/suppress-pings"}, "properties": {"repobilityId": "4d589756fa5c4b2c", "scanner": "scanner-primary", "fingerprint": "6c895802e2f22f4f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-10413c6b9bbef041", "level": "note", "message": {"text": "Unused endpoint: ANY /api/trips/<int:trip_id>/relocate-pings"}, "properties": {"repobilityId": "65935aa68a5c585a", "scanner": "scanner-primary", "fingerprint": "10413c6b9bbef041", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-40566ba8de9102ea", "level": "note", "message": {"text": "Unused endpoint: ANY /api/trips/<int:trip_id>/tid-overrides"}, "properties": {"repobilityId": "d13b3d8c0540f063", "scanner": "scanner-primary", "fingerprint": "40566ba8de9102ea", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}