{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-a94a89b654424f96", "name": "Possibly dead Python function: translate_piece", "shortDescription": {"text": "Possibly dead Python function: translate_piece"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-386b7fec58da33f6", "name": "Possibly dead Python function: wrap_en", "shortDescription": {"text": "Possibly dead Python function: wrap_en"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cc753b22ef7e47ca", "name": "TODO/FIXME marker in shipping code \u2014 wechatXiamuagent/typings/types/wx/lib.wx.api.d.ts:15740", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 wechatXiamuagent/typings/types/wx/lib.wx.api.d.ts:15740"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9a85602012ca69a4", "name": "Stray `console.log` in TS/JS \u2014 wechatXiamuagent/typings/types/wx/lib.wx.api.d.ts:2816", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 wechatXiamuagent/typings/types/wx/lib.wx.api.d.ts:2816"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9eb6df3f978d64cd", "name": "Stray `console.log` in TS/JS \u2014 backend/worker.js:418", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 backend/worker.js:418"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b6ef4819b60f1c03", "name": "Stray `console.log` in TS/JS \u2014 backend/initDb.js:471", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 backend/initDb.js:471"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2beaf49c3d5c45b6", "name": "Stray `console.log` in TS/JS \u2014 backend/oss.js:124", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 backend/oss.js:124"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c061f8c9a0abb799", "name": "Stray `console.log` in TS/JS \u2014 backend/server.js:89", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 backend/server.js:89"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f671a81620e2157", "name": "Stray `console.log` in TS/JS \u2014 backend/install_skill.js:44", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 backend/install_skill.js:44"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-93e5bb209fc573be", "name": "Stray `console.log` in TS/JS \u2014 backend/frontend/build.js:32", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 backend/frontend/build.js:32"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-81c66b3f3443d769", "name": "Icon-only button without accessible name \u2014 backend/frontend/src/30-original-home-skill.js:242", "shortDescription": {"text": "Icon-only button without accessible name \u2014 backend/frontend/src/30-original-home-skill.js:242"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-db3b8559b2fc1f5b", "name": "Icon-only button without accessible name \u2014 backend/frontend/src/32-original-chat-project.js:102", "shortDescription": {"text": "Icon-only button without accessible name \u2014 backend/frontend/src/32-original-chat-project.js:102"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3384fa97923767af", "name": "Stray `console.log` in TS/JS \u2014 backend/lib/asrHelper.js:52", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 backend/lib/asrHelper.js:52"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8d5b1d7d9ff1f152", "name": "Stray `console.log` in TS/JS \u2014 backend/routes/ai.js:331", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 backend/routes/ai.js:331"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-700ac1681ee87953", "name": "Stray `console.log` in TS/JS \u2014 backend/routes/industryVideos.js:41", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 backend/routes/industryVideos.js:41"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-efbe1d62aac41b6b", "name": "Stray `console.log` in TS/JS \u2014 backend/routes/original.js:143", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 backend/routes/original.js:143"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-859604bae877b4c5", "name": "Stray `console.log` in TS/JS \u2014 backend/routes/extract.js:123", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 backend/routes/extract.js:123"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7aa538bb459f2331", "name": "Stray `console.log` in TS/JS \u2014 backend/routes/douyinToText.js:66", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 backend/routes/douyinToText.js:66"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-094028125c662700", "name": "Stray `console.log` in TS/JS \u2014 backend/routes/novel.js:456", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 backend/routes/novel.js:456"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ba7826bdf9bf0ecf", "name": "Insecure pattern 'cors_wildcard' in desktop_client/heygem_server_v2.py:66", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in desktop_client/heygem_server_v2.py:66"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e14bc3ec6dceab16", "name": "Insecure pattern 'direct_innerhtml_assignment' in backend/frontend/baseline.html:1457", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in backend/frontend/baseline.html:1457"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-f9eda2f356758b4c", "name": "Insecure pattern 'local_storage_auth_token' in backend/frontend/baseline.html:1189", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in backend/frontend/baseline.html:1189"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0f9e1aa333d0dc59", "name": "Insecure pattern 'direct_innerhtml_assignment' in backend/frontend/src/20-extract-clone-views.js:612", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in backend/frontend/src/20-extract-clone-views.js:612"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-07c9ea24c9191f47", "name": "Insecure pattern 'direct_innerhtml_assignment' in backend/frontend/src/10-config-state.js:274", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in backend/frontend/src/10-config-state.js:274"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-27bb20724bf201f1", "name": "Insecure pattern 'local_storage_auth_token' in backend/frontend/src/10-config-state.js:6", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in backend/frontend/src/10-config-state.js:6"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0d98b1f81aee256d", "name": "Insecure pattern 'direct_innerhtml_assignment' in backend/frontend/src/32-original-chat-project.js:265", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in backend/frontend/src/32-original-chat-project.js:265"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b17e43a8a5a60dae", "name": "Insecure pattern 'direct_innerhtml_assignment' in backend/frontend/src/24-tts-voice-handlers.js:161", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in backend/frontend/src/24-tts-voice-handlers.js:161"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-462e30e550f40f68", "name": "Insecure pattern 'cors_wildcard' in backend/routes/ai.js:1159", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in backend/routes/ai.js:1159"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c83c0ecbd99d70c6", "name": "Insecure pattern 'direct_innerhtml_assignment' in backend/public/index.html:1457", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in backend/public/index.html:1457"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e1dff5d897efd5e0", "name": "Insecure pattern 'local_storage_auth_token' in backend/public/index.html:1189", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in backend/public/index.html:1189"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-883d4a62bb2c6cad", "name": "Insecure pattern 'direct_innerhtml_assignment' in backend/public/admin.html:640", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in backend/public/admin.html:640"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a700d6e1687c8b98", "name": "Insecure pattern 'local_storage_auth_token' in backend/public/admin.html:556", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in backend/public/admin.html:556"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c98be4a2d8017aa6", "name": "Insecure pattern 'direct_innerhtml_assignment' in backend/public/desktop.html:1512", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in backend/public/desktop.html:1512"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-beebe169a5172059", "name": "Insecure pattern 'local_storage_auth_token' in backend/public/desktop.html:770", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in backend/public/desktop.html:770"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-87b92d0f5ab6200b", "name": "Insecure pattern 'cors_wildcard' in local_asr_server/main.py:37", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in local_asr_server/main.py:37"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9fe84b676163ffd5", "name": "Very large file: wechatXiamuagent/typings/types/wx/lib.wx.api.d.ts (19671 lines)", "shortDescription": {"text": "Very large file: wechatXiamuagent/typings/types/wx/lib.wx.api.d.ts (19671 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5be0f51979bebbcb", "name": "Very large file: backend/frontend/src/20-extract-clone-views.js (902 lines)", "shortDescription": {"text": "Very large file: backend/frontend/src/20-extract-clone-views.js (902 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-89ce4133bf41278f", "name": "Very large file: backend/routes/ai.js (1168 lines)", "shortDescription": {"text": "Very large file: backend/routes/ai.js (1168 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-efd5f48fc92136e3", "name": "Very large file: backend/routes/original.js (2372 lines)", "shortDescription": {"text": "Very large file: backend/routes/original.js (2372 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f42bf0fb2c0c6482", "name": "Very large file: backend/routes/novel.js (1018 lines)", "shortDescription": {"text": "Very large file: backend/routes/novel.js (1018 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7ea91248a85793ef", "name": "Very large file: local_asr_server/main.py (1399 lines)", "shortDescription": {"text": "Very large file: local_asr_server/main.py (1399 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 61 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c0e5d7ebfbe6581a", "name": "Node manifest has dependencies but no lockfile: wechatXiamuagent/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: wechatXiamuagent/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a092b5c39e242a1", "name": "Node manifest has dependencies but no lockfile: backend/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: backend/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 116 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 40 placeholder/mock markers across 13 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9d79c4077342a7d0", "name": "Runtime service client appears to use placeholder configuration", "shortDescription": {"text": "Runtime service client appears to use placeholder configuration"}, "fullDescription": {"text": "A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, tests, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci, tests, lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-17d866d91a7c451e", "name": "Agent instruction/config may expose a secret: CLAUDE.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: CLAUDE.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bea357a6497a2d5d", "name": "Agent authority lacks a verifier contract: CLAUDE.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cbb5857940ba0dc2", "name": "Agent instruction/config may expose a secret: AGENTS.md", "shortDescription": {"text": "Agent instruction/config may expose a secret: AGENTS.md"}, "fullDescription": {"text": "Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2679282aa1c484b5", "name": "Agent authority lacks a verifier contract: AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ecb0d2c55ed6875d", "name": "Agent authority lacks a verifier contract: .claude/settings.local.json", "shortDescription": {"text": "Agent authority lacks a verifier contract: .claude/settings.local.json"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a9ef50a9a423f7ad", "name": "Commented-code block (7 lines) in wechatXiamuagent/typings/types/wx/lib.wx.api.d.ts:5810", "shortDescription": {"text": "Commented-code block (7 lines) in wechatXiamuagent/typings/types/wx/lib.wx.api.d.ts:5810"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-57107d175446b0d5", "name": "Legacy-named symbol `heygem_server_v2` in desktop_client/heygem_server_v2.py:5", "shortDescription": {"text": "Legacy-named symbol `heygem_server_v2` in desktop_client/heygem_server_v2.py:5"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8372c1b322fc3f85", "name": "Commented-code block (6 lines) in backend/install_skill.js:1", "shortDescription": {"text": "Commented-code block (6 lines) in backend/install_skill.js:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-bdaf78dc0c2d04bb", "name": "Legacy-named symbol `pwdOld` in backend/frontend/src/22-profile-vip-views.js:105", "shortDescription": {"text": "Legacy-named symbol `pwdOld` in backend/frontend/src/22-profile-vip-views.js:105"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b03cbe25c4125242", "name": "`fetch()` without try/.catch or AbortSignal \u2014 backend/lib/callAI.js:38", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 backend/lib/callAI.js:38"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-63c00a451bce113a", "name": "`fetch()` without try/.catch or AbortSignal \u2014 backend/routes/ai.js:88", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 backend/routes/ai.js:88"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7700be219b83e9c1", "name": "Legacy-named symbol `toOld` in backend/routes/industryVideos.js:384", "shortDescription": {"text": "Legacy-named symbol `toOld` in backend/routes/industryVideos.js:384"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d4538b02a787d892", "name": "`fetch()` without try/.catch or AbortSignal \u2014 backend/routes/original.js:84", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 backend/routes/original.js:84"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7ea2b7c9eb1ef0ad", "name": "`fetch()` without try/.catch or AbortSignal \u2014 backend/routes/douyinToText.js:74", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 backend/routes/douyinToText.js:74"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e3026eded0f83be6", "name": "Legacy-named symbol `infer_v2` in local_asr_server/indextts_server.py:48", "shortDescription": {"text": "Legacy-named symbol `infer_v2` in local_asr_server/indextts_server.py:48"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c8f7a60380f22a4e", "name": "Legacy-named symbol `_build_ass_douyin_legacy` in local_asr_server/main.py:418", "shortDescription": {"text": "Legacy-named symbol `_build_ass_douyin_legacy` in local_asr_server/main.py:418"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9a82cf7d16234d20", "name": "21 env vars used in code but missing from .env.example", "shortDescription": {"text": "21 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `ADMIN_PHONES`, `ALIYUN_SMS_KEY_ID`, `ALIYUN_SMS_KEY_SECRET`, `ALIYUN_SMS_SIGN`, `ALIYUN_SMS_TEMPLATE_LOGIN`, `ALIYUN_SMS_TEMPLATE_REG`, `CORS_ORIGINS`, `HEYGEM_DIR` + 13 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nlocal_asr_server/main.py:highlight_kw, local_asr_server/main.py:highlight_kw\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a7f93b115797610b", "name": "FastAPI POST `generate` without auth dependency \u2014 desktop_client/heygem_server_v2.py:102", "shortDescription": {"text": "FastAPI POST `generate` without auth dependency \u2014 desktop_client/heygem_server_v2.py:102"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0cc3994b86f08b9d", "name": "FastAPI POST `cancel_task` without auth dependency \u2014 desktop_client/heygem_server_v2.py:204", "shortDescription": {"text": "FastAPI POST `cancel_task` without auth dependency \u2014 desktop_client/heygem_server_v2.py:204"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dcc2a087cc3a81b0", "name": "FastAPI POST `generate` without auth dependency \u2014 local_asr_server/indextts_server.py:141", "shortDescription": {"text": "FastAPI POST `generate` without auth dependency \u2014 local_asr_server/indextts_server.py:141"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bc2b961cfdf67874", "name": "FastAPI POST `tts_submit` without auth dependency \u2014 local_asr_server/indextts_server.py:216", "shortDescription": {"text": "FastAPI POST `tts_submit` without auth dependency \u2014 local_asr_server/indextts_server.py:216"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-346505f48e011ace", "name": "FastAPI POST `asr_submit` without auth dependency \u2014 local_asr_server/main.py:89", "shortDescription": {"text": "FastAPI POST `asr_submit` without auth dependency \u2014 local_asr_server/main.py:89"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6857bfd57d9b0930", "name": "FastAPI POST `transcribe` without auth dependency \u2014 local_asr_server/main.py:108", "shortDescription": {"text": "FastAPI POST `transcribe` without auth dependency \u2014 local_asr_server/main.py:108"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c838eaed0ac8d6aa", "name": "FastAPI POST `tts_synthesize` without auth dependency \u2014 local_asr_server/main.py:154", "shortDescription": {"text": "FastAPI POST `tts_synthesize` without auth dependency \u2014 local_asr_server/main.py:154"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a900992c6e443ba1", "name": "FastAPI POST `tts_indextts_proxy` without auth dependency \u2014 local_asr_server/main.py:186", "shortDescription": {"text": "FastAPI POST `tts_indextts_proxy` without auth dependency \u2014 local_asr_server/main.py:186"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ffcd06c79ccd4da1", "name": "FastAPI POST `tts_indextts_register_voice` without auth dependency \u2014 local_asr_server/main.py:219", "shortDescription": {"text": "FastAPI POST `tts_indextts_register_voice` without auth dependency \u2014 local_asr_server/main.py:219"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9e5e8c63b3412d8a", "name": "FastAPI POST `tts_indextts_submit` without auth dependency \u2014 local_asr_server/main.py:236", "shortDescription": {"text": "FastAPI POST `tts_indextts_submit` without auth dependency \u2014 local_asr_server/main.py:236"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3ae89a35d79fa82f", "name": "FastAPI POST `video_generate_proxy` without auth dependency \u2014 local_asr_server/main.py:270", "shortDescription": {"text": "FastAPI POST `video_generate_proxy` without auth dependency \u2014 local_asr_server/main.py:270"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4f0b7cca4f0ca21a", "name": "FastAPI POST `video_cancel_proxy` without auth dependency \u2014 local_asr_server/main.py:329", "shortDescription": {"text": "FastAPI POST `video_cancel_proxy` without auth dependency \u2014 local_asr_server/main.py:329"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8d16b6d6f9b96af0", "name": "FastAPI POST `video_postprocess` without auth dependency \u2014 local_asr_server/main.py:811", "shortDescription": {"text": "FastAPI POST `video_postprocess` without auth dependency \u2014 local_asr_server/main.py:811"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5b381ab5fbdbb6e4", "name": "FastAPI POST `avatar_upload` without auth dependency \u2014 local_asr_server/main.py:949", "shortDescription": {"text": "FastAPI POST `avatar_upload` without auth dependency \u2014 local_asr_server/main.py:949"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-04d2667f571f11f0", "name": "FastAPI POST `avatar_bg_compress` without auth dependency \u2014 local_asr_server/main.py:1003", "shortDescription": {"text": "FastAPI POST `avatar_bg_compress` without auth dependency \u2014 local_asr_server/main.py:1003"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9f5c62872524ce0e", "name": "FastAPI DELETE `avatar_delete` without auth dependency \u2014 local_asr_server/main.py:1103", "shortDescription": {"text": "FastAPI DELETE `avatar_delete` without auth dependency \u2014 local_asr_server/main.py:1103"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d1457b434651220e", "name": "Dangling fetch: GET https://api.tikhub.io/api/v1/douyin/app/v3/fetch_one_video?aweme_id=${aweme_id} (backend/worker.js:2", "shortDescription": {"text": "Dangling fetch: GET https://api.tikhub.io/api/v1/douyin/app/v3/fetch_one_video?aweme_id=${aweme_id} (backend/worker.js:264)"}, "fullDescription": {"text": "`backend/worker.js:264` calls `GET https://api.tikhub.io/api/v1/douyin/app/v3/fetch_one_video?aweme_id=${aweme_id}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.tikhub.io/api/v1/douyin/app/v3/fetch_one_video`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a2e2ea9269c29c1c", "name": "Dangling fetch: POST /api/ai/avatar/upload (backend/frontend/src/27-extract-inspire-misc.js:452)", "shortDescription": {"text": "Dangling fetch: POST /api/ai/avatar/upload (backend/frontend/src/27-extract-inspire-misc.js:452)"}, "fullDescription": {"text": "`backend/frontend/src/27-extract-inspire-misc.js:452` calls `POST /api/ai/avatar/upload` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/ai/avatar/upload`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-aa6c9a7bba1a3f51", "name": "Dangling fetch: POST /api/ai/avatar/upload (backend/frontend/src/27-extract-inspire-misc.js:575)", "shortDescription": {"text": "Dangling fetch: POST /api/ai/avatar/upload (backend/frontend/src/27-extract-inspire-misc.js:575)"}, "fullDescription": {"text": "`backend/frontend/src/27-extract-inspire-misc.js:575` calls `POST /api/ai/avatar/upload` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/ai/avatar/upload`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-373d3c073134fa11", "name": "Dangling fetch: DELETE /api/ai/voices/${id} (backend/frontend/src/24-tts-voice-handlers.js:323)", "shortDescription": {"text": "Dangling fetch: DELETE /api/ai/voices/${id} (backend/frontend/src/24-tts-voice-handlers.js:323)"}, "fullDescription": {"text": "`backend/frontend/src/24-tts-voice-handlers.js:323` calls `DELETE /api/ai/voices/${id}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/ai/voices/<p>`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f83f68c4b51b1f77", "name": "Dangling fetch: POST https://api.anthropic.com/v1/messages (backend/lib/callAI.js:54)", "shortDescription": {"text": "Dangling fetch: POST https://api.anthropic.com/v1/messages (backend/lib/callAI.js:54)"}, "fullDescription": {"text": "`backend/lib/callAI.js:54` calls `POST https://api.anthropic.com/v1/messages` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.anthropic.com/v1/messages`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7271a4df511499d6", "name": "Dangling fetch: POST https://open.bigmodel.cn/api/paas/v4/chat/completions (backend/lib/callAI.js:70)", "shortDescription": {"text": "Dangling fetch: POST https://open.bigmodel.cn/api/paas/v4/chat/completions (backend/lib/callAI.js:70)"}, "fullDescription": {"text": "`backend/lib/callAI.js:70` calls `POST https://open.bigmodel.cn/api/paas/v4/chat/completions` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/open.bigmodel.cn/api/paas/v4/chat/completions`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b15b9d8d1a376a99", "name": "Dangling fetch: POST https://api.deepseek.com/v1/chat/completions (backend/lib/callAI.js:86)", "shortDescription": {"text": "Dangling fetch: POST https://api.deepseek.com/v1/chat/completions (backend/lib/callAI.js:86)"}, "fullDescription": {"text": "`backend/lib/callAI.js:86` calls `POST https://api.deepseek.com/v1/chat/completions` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.deepseek.com/v1/chat/completions`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-44f88d982d319054", "name": "Dangling fetch: POST https://api.anthropic.com/v1/messages (backend/routes/ai.js:105)", "shortDescription": {"text": "Dangling fetch: POST https://api.anthropic.com/v1/messages (backend/routes/ai.js:105)"}, "fullDescription": {"text": "`backend/routes/ai.js:105` calls `POST https://api.anthropic.com/v1/messages` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.anthropic.com/v1/messages`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a19af21b7aea424d", "name": "Dangling fetch: POST https://open.bigmodel.cn/api/paas/v4/chat/completions (backend/routes/ai.js:122)", "shortDescription": {"text": "Dangling fetch: POST https://open.bigmodel.cn/api/paas/v4/chat/completions (backend/routes/ai.js:122)"}, "fullDescription": {"text": "`backend/routes/ai.js:122` calls `POST https://open.bigmodel.cn/api/paas/v4/chat/completions` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/open.bigmodel.cn/api/paas/v4/chat/completions`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-814b09c1233be17e", "name": "Dangling fetch: POST https://api.deepseek.com/v1/chat/completions (backend/routes/ai.js:138)", "shortDescription": {"text": "Dangling fetch: POST https://api.deepseek.com/v1/chat/completions (backend/routes/ai.js:138)"}, "fullDescription": {"text": "`backend/routes/ai.js:138` calls `POST https://api.deepseek.com/v1/chat/completions` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.deepseek.com/v1/chat/completions`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8a9440474951be3b", "name": "Dangling fetch: POST https://api.fish.audio/v1/tts (backend/routes/ai.js:301)", "shortDescription": {"text": "Dangling fetch: POST https://api.fish.audio/v1/tts (backend/routes/ai.js:301)"}, "fullDescription": {"text": "`backend/routes/ai.js:301` calls `POST https://api.fish.audio/v1/tts` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.fish.audio/v1/tts`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-383c3e028ae4d143", "name": "Dangling fetch: POST https://api.fish.audio/model (backend/routes/ai.js:449)", "shortDescription": {"text": "Dangling fetch: POST https://api.fish.audio/model (backend/routes/ai.js:449)"}, "fullDescription": {"text": "`backend/routes/ai.js:449` calls `POST https://api.fish.audio/model` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.fish.audio/model`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-652797f1ca87d97a", "name": "Dangling fetch: GET https://api.tikhub.io/api/v1/douyin/app/v3/fetch_one_video?aweme_id=${awemeId} (backend/routes/origi", "shortDescription": {"text": "Dangling fetch: GET https://api.tikhub.io/api/v1/douyin/app/v3/fetch_one_video?aweme_id=${awemeId} (backend/routes/original.js:84)"}, "fullDescription": {"text": "`backend/routes/original.js:84` calls `GET https://api.tikhub.io/api/v1/douyin/app/v3/fetch_one_video?aweme_id=${awemeId}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.tikhub.io/api/v1/douyin/app/v3/fetch_one_video`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cfda2fe0041a93b3", "name": "Dangling fetch: GET https://api.tikhub.io/api/v1/douyin/web/fetch_one_video?aweme_id=${awemeId} (backend/routes/original", "shortDescription": {"text": "Dangling fetch: GET https://api.tikhub.io/api/v1/douyin/web/fetch_one_video?aweme_id=${awemeId} (backend/routes/original.js:93)"}, "fullDescription": {"text": "`backend/routes/original.js:93` calls `GET https://api.tikhub.io/api/v1/douyin/web/fetch_one_video?aweme_id=${awemeId}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.tikhub.io/api/v1/douyin/web/fetch_one_video`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8bc427e53f51e1c8", "name": "Dangling fetch: GET https://api.tikhub.io/api/v1/douyin/app/v3/fetch_video_subtitle?aweme_id=${awemeId} (backend/routes/", "shortDescription": {"text": "Dangling fetch: GET https://api.tikhub.io/api/v1/douyin/app/v3/fetch_video_subtitle?aweme_id=${awemeId} (backend/routes/original.js:119)"}, "fullDescription": {"text": "`backend/routes/original.js:119` calls `GET https://api.tikhub.io/api/v1/douyin/app/v3/fetch_video_subtitle?aweme_id=${awemeId}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.tikhub.io/api/v1/douyin/app/v3/fetch_video_subtitle`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6491dc806f9ce5de", "name": "Dangling fetch: GET https://api.tikhub.io/api/v1/douyin/web/fetch_user_post_videos?sec_user_id=${encodeURIComponent(secU", "shortDescription": {"text": "Dangling fetch: GET https://api.tikhub.io/api/v1/douyin/web/fetch_user_post_videos?sec_user_id=${encodeURIComponent(secUserId)}&max_cursor=0&count=${count} (backend/routes/original.js:171)"}, "fullDescription": {"text": "`backend/routes/original.js:171` calls `GET https://api.tikhub.io/api/v1/douyin/web/fetch_user_post_videos?sec_user_id=${encodeURIComponent(secUserId)}&max_cursor=0&count=${count}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.tikhub.io/api/v1/douyin/web/fetch_user_post_videos`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8abb9d5530963833", "name": "Dangling fetch: GET https://api.tikhub.io/api/v1/douyin/app/v3/fetch_video_subtitle?aweme_id=${awemeId} (backend/routes/", "shortDescription": {"text": "Dangling fetch: GET https://api.tikhub.io/api/v1/douyin/app/v3/fetch_video_subtitle?aweme_id=${awemeId} (backend/routes/extract.js:105)"}, "fullDescription": {"text": "`backend/routes/extract.js:105` calls `GET https://api.tikhub.io/api/v1/douyin/app/v3/fetch_video_subtitle?aweme_id=${awemeId}` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.tikhub.io/api/v1/douyin/app/v3/fetch_video_subtitle`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-bb18fe31fd5070d2", "name": "Dangling fetch: POST https://api.coze.cn/v1/workflow/run (backend/routes/agents.js:56)", "shortDescription": {"text": "Dangling fetch: POST https://api.coze.cn/v1/workflow/run (backend/routes/agents.js:56)"}, "fullDescription": {"text": "`backend/routes/agents.js:56` calls `POST https://api.coze.cn/v1/workflow/run` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.coze.cn/v1/workflow/run`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-194570ee378dc07f", "name": "Dangling fetch: GET https://api.tikhub.io/api/v1/douyin/app/v3/fetch_user_post_videos?sec_user_id=${encodeURIComponent(s", "shortDescription": {"text": "Dangling fetch: GET https://api.tikhub.io/api/v1/douyin/app/v3/fetch_user_post_videos?sec_user_id=${encodeURIComponent(sec_user_id)}&max_cursor=0&count=20&sort_type=0 (backend/routes/inspire.js:118)"}, "fullDescription": {"text": "`backend/routes/inspire.js:118` calls `GET https://api.tikhub.io/api/v1/douyin/app/v3/fetch_user_post_videos?sec_user_id=${encodeURIComponent(sec_user_id)}&max_cursor=0&count=20&sort_type=0` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/https:/api.tikhub.io/api/v1/douyin/app/v3/fetch_user_post_videos`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b7812c3824a003fc", "name": "Unused endpoint: POST /video/generate", "shortDescription": {"text": "Unused endpoint: POST /video/generate"}, "fullDescription": {"text": "`desktop_client/heygem_server_v2.py` declares `POST /video/generate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-253bdfc79b17e682", "name": "Unused endpoint: GET /video/task/{task_id}", "shortDescription": {"text": "Unused endpoint: GET /video/task/{task_id}"}, "fullDescription": {"text": "`desktop_client/heygem_server_v2.py` declares `GET /video/task/{task_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7246177f967b5363", "name": "Unused endpoint: GET /video/file/{task_id}", "shortDescription": {"text": "Unused endpoint: GET /video/file/{task_id}"}, "fullDescription": {"text": "`desktop_client/heygem_server_v2.py` declares `GET /video/file/{task_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-42ecba0d1f40a5ce", "name": "Unused endpoint: POST /video/cancel/{task_id}", "shortDescription": {"text": "Unused endpoint: POST /video/cancel/{task_id}"}, "fullDescription": {"text": "`desktop_client/heygem_server_v2.py` declares `POST /video/cancel/{task_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4050cdb59f998b65", "name": "Unused endpoint: POST /tts/generate", "shortDescription": {"text": "Unused endpoint: POST /tts/generate"}, "fullDescription": {"text": "`local_asr_server/indextts_server.py` declares `POST /tts/generate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7caff84be2fb5493", "name": "Unused endpoint: POST /tts/register_voice", "shortDescription": {"text": "Unused endpoint: POST /tts/register_voice"}, "fullDescription": {"text": "`local_asr_server/indextts_server.py` declares `POST /tts/register_voice` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3d5d0e8ab6c1a7a1", "name": "Unused endpoint: POST /tts/submit", "shortDescription": {"text": "Unused endpoint: POST /tts/submit"}, "fullDescription": {"text": "`local_asr_server/indextts_server.py` declares `POST /tts/submit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-870f1264829d32c5", "name": "Unused endpoint: GET /tts/task/{task_id}", "shortDescription": {"text": "Unused endpoint: GET /tts/task/{task_id}"}, "fullDescription": {"text": "`local_asr_server/indextts_server.py` declares `GET /tts/task/{task_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0bac4e48ec3ddd83", "name": "Unused endpoint: POST /asr/submit", "shortDescription": {"text": "Unused endpoint: POST /asr/submit"}, "fullDescription": {"text": "`local_asr_server/main.py` declares `POST /asr/submit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-351339316ebcb95f", "name": "Unused endpoint: GET /asr/task/{task_id}", "shortDescription": {"text": "Unused endpoint: GET /asr/task/{task_id}"}, "fullDescription": {"text": "`local_asr_server/main.py` declares `GET /asr/task/{task_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9beed81154d7aaea", "name": "Unused endpoint: POST /asr/transcribe", "shortDescription": {"text": "Unused endpoint: POST /asr/transcribe"}, "fullDescription": {"text": "`local_asr_server/main.py` declares `POST /asr/transcribe` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-232d1ce5ec5453d2", "name": "Unused endpoint: POST /tts/synthesize", "shortDescription": {"text": "Unused endpoint: POST /tts/synthesize"}, "fullDescription": {"text": "`local_asr_server/main.py` declares `POST /tts/synthesize` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c82de0bcb6111d2", "name": "Unused endpoint: POST /tts/indextts", "shortDescription": {"text": "Unused endpoint: POST /tts/indextts"}, "fullDescription": {"text": "`local_asr_server/main.py` declares `POST /tts/indextts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-683c777bcc8996a1", "name": "Unused endpoint: GET /tts/indextts/health", "shortDescription": {"text": "Unused endpoint: GET /tts/indextts/health"}, "fullDescription": {"text": "`local_asr_server/main.py` declares `GET /tts/indextts/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d6efd41b3c6189d", "name": "Unused endpoint: POST /tts/indextts/register_voice", "shortDescription": {"text": "Unused endpoint: POST /tts/indextts/register_voice"}, "fullDescription": {"text": "`local_asr_server/main.py` declares `POST /tts/indextts/register_voice` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-32c825ccfcae8063", "name": "Unused endpoint: POST /tts/indextts/submit", "shortDescription": {"text": "Unused endpoint: POST /tts/indextts/submit"}, "fullDescription": {"text": "`local_asr_server/main.py` declares `POST /tts/indextts/submit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-26421a5cb0e9b86a", "name": "Unused endpoint: GET /tts/indextts/task/{task_id}", "shortDescription": {"text": "Unused endpoint: GET /tts/indextts/task/{task_id}"}, "fullDescription": {"text": "`local_asr_server/main.py` declares `GET /tts/indextts/task/{task_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-89998a3e8b59a897", "name": "Unused endpoint: POST /video/postprocess", "shortDescription": {"text": "Unused endpoint: POST /video/postprocess"}, "fullDescription": {"text": "`local_asr_server/main.py` declares `POST /video/postprocess` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86e78de49314d549", "name": "Unused endpoint: POST /avatar/upload", "shortDescription": {"text": "Unused endpoint: POST /avatar/upload"}, "fullDescription": {"text": "`local_asr_server/main.py` declares `POST /avatar/upload` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8bdb6e6580425187", "name": "Unused endpoint: POST /avatar/bg-compress", "shortDescription": {"text": "Unused endpoint: POST /avatar/bg-compress"}, "fullDescription": {"text": "`local_asr_server/main.py` declares `POST /avatar/bg-compress` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-182e456eea77efc2", "name": "Unused endpoint: GET /avatar/list/{user_id}", "shortDescription": {"text": "Unused endpoint: GET /avatar/list/{user_id}"}, "fullDescription": {"text": "`local_asr_server/main.py` declares `GET /avatar/list/{user_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-44430b844ba27fb6", "name": "Unused endpoint: DELETE /avatar/{user_id}/{avatar_id}", "shortDescription": {"text": "Unused endpoint: DELETE /avatar/{user_id}/{avatar_id}"}, "fullDescription": {"text": "`local_asr_server/main.py` declares `DELETE /avatar/{user_id}/{avatar_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d08a07e9540ad561", "name": "Unused endpoint: GET /avatar/file/{user_id}/{avatar_id}", "shortDescription": {"text": "Unused endpoint: GET /avatar/file/{user_id}/{avatar_id}"}, "fullDescription": {"text": "`local_asr_server/main.py` declares `GET /avatar/file/{user_id}/{avatar_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6eb452fbfb454d20", "name": "Unused endpoint: USE /api/auth", "shortDescription": {"text": "Unused endpoint: USE /api/auth"}, "fullDescription": {"text": "`backend/server.js` declares `USE /api/auth` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6f63dbe78bf2280a", "name": "Unused endpoint: USE /api/config", "shortDescription": {"text": "Unused endpoint: USE /api/config"}, "fullDescription": {"text": "`backend/server.js` declares `USE /api/config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-316c43db307befc3", "name": "Unused endpoint: USE /api/ai", "shortDescription": {"text": "Unused endpoint: USE /api/ai"}, "fullDescription": {"text": "`backend/server.js` declares `USE /api/ai` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7620b08065ac7789", "name": "Unused endpoint: USE /api/extract", "shortDescription": {"text": "Unused endpoint: USE /api/extract"}, "fullDescription": {"text": "`backend/server.js` declares `USE /api/extract` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6144d3a3081af4ef", "name": "Unused endpoint: USE /api/history", "shortDescription": {"text": "Unused endpoint: USE /api/history"}, "fullDescription": {"text": "`backend/server.js` declares `USE /api/history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-99e84783d94c75d8", "name": "Unused endpoint: USE /api/codes", "shortDescription": {"text": "Unused endpoint: USE /api/codes"}, "fullDescription": {"text": "`backend/server.js` declares `USE /api/codes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d3de1c8f413057c3", "name": "Unused endpoint: USE /api/video", "shortDescription": {"text": "Unused endpoint: USE /api/video"}, "fullDescription": {"text": "`backend/server.js` declares `USE /api/video` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9758d51e260d4881", "name": "Unused endpoint: USE /api/inspire", "shortDescription": {"text": "Unused endpoint: USE /api/inspire"}, "fullDescription": {"text": "`backend/server.js` declares `USE /api/inspire` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6330b0c4a0a152d3", "name": "Unused endpoint: USE /api/tasks", "shortDescription": {"text": "Unused endpoint: USE /api/tasks"}, "fullDescription": {"text": "`backend/server.js` declares `USE /api/tasks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1cacc08c93a646f3", "name": "Unused endpoint: USE /api/industry-videos", "shortDescription": {"text": "Unused endpoint: USE /api/industry-videos"}, "fullDescription": {"text": "`backend/server.js` declares `USE /api/industry-videos` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-00d2f0293753841f", "name": "Unused endpoint: USE /api/credits", "shortDescription": {"text": "Unused endpoint: USE /api/credits"}, "fullDescription": {"text": "`backend/server.js` declares `USE /api/credits` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-094608bf688f5d04", "name": "Unused endpoint: USE /api/agents", "shortDescription": {"text": "Unused endpoint: USE /api/agents"}, "fullDescription": {"text": "`backend/server.js` declares `USE /api/agents` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b230f730b81c4f1c", "name": "Unused endpoint: USE /api/original", "shortDescription": {"text": "Unused endpoint: USE /api/original"}, "fullDescription": {"text": "`backend/server.js` declares `USE /api/original` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-794cae1fa4cb91e6", "name": "Unused endpoint: USE /api/novel", "shortDescription": {"text": "Unused endpoint: USE /api/novel"}, "fullDescription": {"text": "`backend/server.js` declares `USE /api/novel` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4756b4c4da7d2088", "name": "Unused endpoint: GET /api/health", "shortDescription": {"text": "Unused endpoint: GET /api/health"}, "fullDescription": {"text": "`backend/server.js` declares `GET /api/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5bbf7ef577415207", "name": "Unused endpoint: GET /desktop", "shortDescription": {"text": "Unused endpoint: GET /desktop"}, "fullDescription": {"text": "`backend/server.js` declares `GET /desktop` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-190e73b6062088b5", "name": "Unused endpoint: GET /industry-videos/industries", "shortDescription": {"text": "Unused endpoint: GET /industry-videos/industries"}, "fullDescription": {"text": "`backend/frontend/src/21-inspire-views.js` declares `GET /industry-videos/industries` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c89225c80f7e29ca", "name": "Unused endpoint: POST /ai/inspire", "shortDescription": {"text": "Unused endpoint: POST /ai/inspire"}, "fullDescription": {"text": "`backend/frontend/src/27-extract-inspire-misc.js` declares `POST /ai/inspire` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8d20698cff65ae9f", "name": "Unused endpoint: POST /ai/inspire-expand", "shortDescription": {"text": "Unused endpoint: POST /ai/inspire-expand"}, "fullDescription": {"text": "`backend/frontend/src/27-extract-inspire-misc.js` declares `POST /ai/inspire-expand` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ef63bd6f8db6184d", "name": "Unused endpoint: GET /history?type=inspire", "shortDescription": {"text": "Unused endpoint: GET /history?type=inspire"}, "fullDescription": {"text": "`backend/frontend/src/27-extract-inspire-misc.js` declares `GET /history?type=inspire` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c71e95effdbb00d9", "name": "Unused endpoint: POST /auth/update-avatar", "shortDescription": {"text": "Unused endpoint: POST /auth/update-avatar"}, "fullDescription": {"text": "`backend/frontend/src/27-extract-inspire-misc.js` declares `POST /auth/update-avatar` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9143464946a01de5", "name": "Unused endpoint: PUT /auth/profile", "shortDescription": {"text": "Unused endpoint: PUT /auth/profile"}, "fullDescription": {"text": "`backend/frontend/src/27-extract-inspire-misc.js` declares `PUT /auth/profile` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-93aa577d37c33b33", "name": "Unused endpoint: GET /config/app-h5-settings", "shortDescription": {"text": "Unused endpoint: GET /config/app-h5-settings"}, "fullDescription": {"text": "`backend/frontend/src/27-extract-inspire-misc.js` declares `GET /config/app-h5-settings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3bf40e1406d45b9e", "name": "Unused endpoint: POST /auth/activate-code", "shortDescription": {"text": "Unused endpoint: POST /auth/activate-code"}, "fullDescription": {"text": "`backend/frontend/src/27-extract-inspire-misc.js` declares `POST /auth/activate-code` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d9379a3d934af4da", "name": "Unused endpoint: GET /ai/avatar/list", "shortDescription": {"text": "Unused endpoint: GET /ai/avatar/list"}, "fullDescription": {"text": "`backend/frontend/src/27-extract-inspire-misc.js` declares `GET /ai/avatar/list` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52e0d314873c244e", "name": "Unused endpoint: GET /ai/asr-url", "shortDescription": {"text": "Unused endpoint: GET /ai/asr-url"}, "fullDescription": {"text": "`backend/frontend/src/27-extract-inspire-misc.js` declares `GET /ai/asr-url` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-61d034ff7e780481", "name": "Unused endpoint: POST /credits/activate", "shortDescription": {"text": "Unused endpoint: POST /credits/activate"}, "fullDescription": {"text": "`backend/frontend/src/40-workshop-views.js` declares `POST /credits/activate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23486"}, "properties": {"repository": "yyuuyu12/XiaMuagent", "repoUrl": "https://github.com/yyuuyu12/XiaMuagent", "branch": "main"}, "results": [{"ruleId": "scanner-a94a89b654424f96", "level": "note", "message": {"text": "Possibly dead Python function: translate_piece"}, "properties": {"repobilityId": "3f9b87d6167c9f2f", "scanner": "scanner-primary", "fingerprint": "a94a89b654424f96", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "local_asr_server/main.py:578"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-386b7fec58da33f6", "level": "note", "message": {"text": "Possibly dead Python function: wrap_en"}, "properties": {"repobilityId": "f8a1ebbc76eb1bdc", "scanner": "scanner-primary", "fingerprint": "386b7fec58da33f6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "local_asr_server/main.py:649"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cc753b22ef7e47ca", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 wechatXiamuagent/typings/types/wx/lib.wx.api.d.ts:15740"}, "properties": {"repobilityId": "3892af7a24382645", "scanner": "scanner-primary", "fingerprint": "cc753b22ef7e47ca", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-9a85602012ca69a4", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 wechatXiamuagent/typings/types/wx/lib.wx.api.d.ts:2816"}, "properties": {"repobilityId": "714ed157766328f0", "scanner": "scanner-primary", "fingerprint": "9a85602012ca69a4", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9eb6df3f978d64cd", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 backend/worker.js:418"}, "properties": {"repobilityId": "327165c688a4160f", "scanner": "scanner-primary", "fingerprint": "9eb6df3f978d64cd", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b6ef4819b60f1c03", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 backend/initDb.js:471"}, "properties": {"repobilityId": "471f4931cb7896aa", "scanner": "scanner-primary", "fingerprint": "b6ef4819b60f1c03", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2beaf49c3d5c45b6", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 backend/oss.js:124"}, "properties": {"repobilityId": "bc456b43f1c15de7", "scanner": "scanner-primary", "fingerprint": "2beaf49c3d5c45b6", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-c061f8c9a0abb799", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 backend/server.js:89"}, "properties": {"repobilityId": "ec6c625862fd9ddc", "scanner": "scanner-primary", "fingerprint": "c061f8c9a0abb799", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-6f671a81620e2157", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 backend/install_skill.js:44"}, "properties": {"repobilityId": "64511e64f944505e", "scanner": "scanner-primary", "fingerprint": "6f671a81620e2157", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-93e5bb209fc573be", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 backend/frontend/build.js:32"}, "properties": {"repobilityId": "24544d7a1a06a4e0", "scanner": "scanner-primary", "fingerprint": "93e5bb209fc573be", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-81c66b3f3443d769", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 backend/frontend/src/30-original-home-skill.js:242"}, "properties": {"repobilityId": "8ea62cd689c2eeb3", "scanner": "scanner-primary", "fingerprint": "81c66b3f3443d769", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-db3b8559b2fc1f5b", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 backend/frontend/src/32-original-chat-project.js:102"}, "properties": {"repobilityId": "4664f3561e7cf330", "scanner": "scanner-primary", "fingerprint": "db3b8559b2fc1f5b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-3384fa97923767af", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 backend/lib/asrHelper.js:52"}, "properties": {"repobilityId": "c4310c87f50b9ef5", "scanner": "scanner-primary", "fingerprint": "3384fa97923767af", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8d5b1d7d9ff1f152", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 backend/routes/ai.js:331"}, "properties": {"repobilityId": "b4642b7989bcb69d", "scanner": "scanner-primary", "fingerprint": "8d5b1d7d9ff1f152", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-700ac1681ee87953", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 backend/routes/industryVideos.js:41"}, "properties": {"repobilityId": "a5606d2e08fe459f", "scanner": "scanner-primary", "fingerprint": "700ac1681ee87953", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-efbe1d62aac41b6b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 backend/routes/original.js:143"}, "properties": {"repobilityId": "52fd4105497b8b45", "scanner": "scanner-primary", "fingerprint": "efbe1d62aac41b6b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-859604bae877b4c5", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 backend/routes/extract.js:123"}, "properties": {"repobilityId": "9eb3a89d886b6ada", "scanner": "scanner-primary", "fingerprint": "859604bae877b4c5", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7aa538bb459f2331", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 backend/routes/douyinToText.js:66"}, "properties": {"repobilityId": "8cfbab0a537adb4b", "scanner": "scanner-primary", "fingerprint": "7aa538bb459f2331", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-094028125c662700", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 backend/routes/novel.js:456"}, "properties": {"repobilityId": "58b1e7e6ea913887", "scanner": "scanner-primary", "fingerprint": "094028125c662700", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-ba7826bdf9bf0ecf", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in desktop_client/heygem_server_v2.py:66"}, "properties": {"repobilityId": "45c41e550a67113e", "scanner": "scanner-primary", "fingerprint": "ba7826bdf9bf0ecf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "desktop_client/heygem_server_v2.py"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-e14bc3ec6dceab16", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in backend/frontend/baseline.html:1457"}, "properties": {"repobilityId": "b0cbff4f44cdb388", "scanner": "scanner-primary", "fingerprint": "e14bc3ec6dceab16", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/frontend/baseline.html"}, "region": {"startLine": 1457}}}]}, {"ruleId": "scanner-f9eda2f356758b4c", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in backend/frontend/baseline.html:1189"}, "properties": {"repobilityId": "e09f8c4ea231f37c", "scanner": "scanner-primary", "fingerprint": "f9eda2f356758b4c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/frontend/baseline.html"}, "region": {"startLine": 1189}}}]}, {"ruleId": "scanner-0f9e1aa333d0dc59", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in backend/frontend/src/20-extract-clone-views.js:612"}, "properties": {"repobilityId": "d906824d9ee60c18", "scanner": "scanner-primary", "fingerprint": "0f9e1aa333d0dc59", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/frontend/src/20-extract-clone-views.js"}, "region": {"startLine": 612}}}]}, {"ruleId": "scanner-07c9ea24c9191f47", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in backend/frontend/src/10-config-state.js:274"}, "properties": {"repobilityId": "8a97e5037804228e", "scanner": "scanner-primary", "fingerprint": "07c9ea24c9191f47", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/frontend/src/10-config-state.js"}, "region": {"startLine": 274}}}]}, {"ruleId": "scanner-27bb20724bf201f1", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in backend/frontend/src/10-config-state.js:6"}, "properties": {"repobilityId": "88950d903c878b5b", "scanner": "scanner-primary", "fingerprint": "27bb20724bf201f1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/frontend/src/10-config-state.js"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-0d98b1f81aee256d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in backend/frontend/src/32-original-chat-project.js:265"}, "properties": {"repobilityId": "f0d8f1623262f04c", "scanner": "scanner-primary", "fingerprint": "0d98b1f81aee256d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/frontend/src/32-original-chat-project.js"}, "region": {"startLine": 265}}}]}, {"ruleId": "scanner-b17e43a8a5a60dae", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in backend/frontend/src/24-tts-voice-handlers.js:161"}, "properties": {"repobilityId": "9174524286bbf506", "scanner": "scanner-primary", "fingerprint": "b17e43a8a5a60dae", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/frontend/src/24-tts-voice-handlers.js"}, "region": {"startLine": 161}}}]}, {"ruleId": "scanner-462e30e550f40f68", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in backend/routes/ai.js:1159"}, "properties": {"repobilityId": "4b5cfb00ec2789f6", "scanner": "scanner-primary", "fingerprint": "462e30e550f40f68", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/routes/ai.js"}, "region": {"startLine": 1159}}}]}, {"ruleId": "scanner-c83c0ecbd99d70c6", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in backend/public/index.html:1457"}, "properties": {"repobilityId": "4f3fc65cbc5abe5d", "scanner": "scanner-primary", "fingerprint": "c83c0ecbd99d70c6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/public/index.html"}, "region": {"startLine": 1457}}}]}, {"ruleId": "scanner-e1dff5d897efd5e0", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in backend/public/index.html:1189"}, "properties": {"repobilityId": "0c777e1cf6d4dd2c", "scanner": "scanner-primary", "fingerprint": "e1dff5d897efd5e0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/public/index.html"}, "region": {"startLine": 1189}}}]}, {"ruleId": "scanner-883d4a62bb2c6cad", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in backend/public/admin.html:640"}, "properties": {"repobilityId": "26251df0d94e8aba", "scanner": "scanner-primary", "fingerprint": "883d4a62bb2c6cad", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/public/admin.html"}, "region": {"startLine": 640}}}]}, {"ruleId": "scanner-a700d6e1687c8b98", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in backend/public/admin.html:556"}, "properties": {"repobilityId": "304ab88bcc2fc426", "scanner": "scanner-primary", "fingerprint": "a700d6e1687c8b98", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/public/admin.html"}, "region": {"startLine": 556}}}]}, {"ruleId": "scanner-c98be4a2d8017aa6", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in backend/public/desktop.html:1512"}, "properties": {"repobilityId": "52500ec751dd4e8d", "scanner": "scanner-primary", "fingerprint": "c98be4a2d8017aa6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/public/desktop.html"}, "region": {"startLine": 1512}}}]}, {"ruleId": "scanner-beebe169a5172059", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in backend/public/desktop.html:770"}, "properties": {"repobilityId": "fce5eddda672d0f6", "scanner": "scanner-primary", "fingerprint": "beebe169a5172059", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/public/desktop.html"}, "region": {"startLine": 770}}}]}, {"ruleId": "scanner-87b92d0f5ab6200b", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in local_asr_server/main.py:37"}, "properties": {"repobilityId": "d2124ffcb61749b1", "scanner": "scanner-primary", "fingerprint": "87b92d0f5ab6200b", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "local_asr_server/main.py"}, "region": {"startLine": 37}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-9fe84b676163ffd5", "level": "note", "message": {"text": "Very large file: wechatXiamuagent/typings/types/wx/lib.wx.api.d.ts (19671 lines)"}, "properties": {"repobilityId": "6a1eeeaf73838dc0", "scanner": "scanner-primary", "fingerprint": "9fe84b676163ffd5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-5be0f51979bebbcb", "level": "note", "message": {"text": "Very large file: backend/frontend/src/20-extract-clone-views.js (902 lines)"}, "properties": {"repobilityId": "396c83c102b95a9b", "scanner": "scanner-primary", "fingerprint": "5be0f51979bebbcb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-89ce4133bf41278f", "level": "note", "message": {"text": "Very large file: backend/routes/ai.js (1168 lines)"}, "properties": {"repobilityId": "f96d30685d962ea0", "scanner": "scanner-primary", "fingerprint": "89ce4133bf41278f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-efd5f48fc92136e3", "level": "note", "message": {"text": "Very large file: backend/routes/original.js (2372 lines)"}, "properties": {"repobilityId": "cd9753d158b1cdae", "scanner": "scanner-primary", "fingerprint": "efd5f48fc92136e3", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-f42bf0fb2c0c6482", "level": "note", "message": {"text": "Very large file: backend/routes/novel.js (1018 lines)"}, "properties": {"repobilityId": "ceb615bafb867fd4", "scanner": "scanner-primary", "fingerprint": "f42bf0fb2c0c6482", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-7ea91248a85793ef", "level": "note", "message": {"text": "Very large file: local_asr_server/main.py (1399 lines)"}, "properties": {"repobilityId": "5027a04557311616", "scanner": "scanner-primary", "fingerprint": "7ea91248a85793ef", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "09da6bf3f0709b4f", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-c0e5d7ebfbe6581a", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: wechatXiamuagent/package.json"}, "properties": {"repobilityId": "111025f2b726d483", "scanner": "scanner-primary", "fingerprint": "c0e5d7ebfbe6581a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "wechatXiamuagent/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3a092b5c39e242a1", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: backend/package.json"}, "properties": {"repobilityId": "fc853e57ce7048c4", "scanner": "scanner-primary", "fingerprint": "3a092b5c39e242a1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "0f166d8f6db86a41", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "3eefef7a8abf646f", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-9d79c4077342a7d0", "level": "warning", "message": {"text": "Runtime service client appears to use placeholder configuration"}, "properties": {"repobilityId": "9d90ac68dab58160", "scanner": "scanner-primary", "fingerprint": "9d79c4077342a7d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "runtime-config", "service-client", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "55b5edd0d4ceafa1", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "7dae6392e8e989ff", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "fad5d0870c4dbfea", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "d38ebac65d296209", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "0cbd10e905cd7494", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-17d866d91a7c451e", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: CLAUDE.md"}, "properties": {"repobilityId": "ccce5984e58a48f0", "scanner": "scanner-primary", "fingerprint": "17d866d91a7c451e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-bea357a6497a2d5d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: CLAUDE.md"}, "properties": {"repobilityId": "aae72df3934829ac", "scanner": "scanner-primary", "fingerprint": "bea357a6497a2d5d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cbb5857940ba0dc2", "level": "error", "message": {"text": "Agent instruction/config may expose a secret: AGENTS.md"}, "properties": {"repobilityId": "e12c7213d5eadf3e", "scanner": "scanner-primary", "fingerprint": "cbb5857940ba0dc2", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["agent-instructions", "secrets", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AGENTS.md"}, "region": {"startLine": 4}}}]}, {"ruleId": "scanner-2679282aa1c484b5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "properties": {"repobilityId": "27d579812e6be614", "scanner": "scanner-primary", "fingerprint": "2679282aa1c484b5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ecb0d2c55ed6875d", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: .claude/settings.local.json"}, "properties": {"repobilityId": "d8bae33a6d517bf0", "scanner": "scanner-primary", "fingerprint": "ecb0d2c55ed6875d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": ".claude/settings.local.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-a9ef50a9a423f7ad", "level": "none", "message": {"text": "Commented-code block (7 lines) in wechatXiamuagent/typings/types/wx/lib.wx.api.d.ts:5810"}, "properties": {"repobilityId": "925873e804f1f1c8", "scanner": "scanner-primary", "fingerprint": "a9ef50a9a423f7ad", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-57107d175446b0d5", "level": "note", "message": {"text": "Legacy-named symbol `heygem_server_v2` in desktop_client/heygem_server_v2.py:5"}, "properties": {"repobilityId": "3e5a112362022bc7", "scanner": "scanner-primary", "fingerprint": "57107d175446b0d5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-8372c1b322fc3f85", "level": "none", "message": {"text": "Commented-code block (6 lines) in backend/install_skill.js:1"}, "properties": {"repobilityId": "3645b85ff6db72d5", "scanner": "scanner-primary", "fingerprint": "8372c1b322fc3f85", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-bdaf78dc0c2d04bb", "level": "note", "message": {"text": "Legacy-named symbol `pwdOld` in backend/frontend/src/22-profile-vip-views.js:105"}, "properties": {"repobilityId": "066c2f5265de6a9d", "scanner": "scanner-primary", "fingerprint": "bdaf78dc0c2d04bb", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b03cbe25c4125242", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 backend/lib/callAI.js:38"}, "properties": {"repobilityId": "7a0f65f360a56aeb", "scanner": "scanner-primary", "fingerprint": "b03cbe25c4125242", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-63c00a451bce113a", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 backend/routes/ai.js:88"}, "properties": {"repobilityId": "5795aedad6d1ec8d", "scanner": "scanner-primary", "fingerprint": "63c00a451bce113a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-7700be219b83e9c1", "level": "note", "message": {"text": "Legacy-named symbol `toOld` in backend/routes/industryVideos.js:384"}, "properties": {"repobilityId": "883ecd0aa08fd08d", "scanner": "scanner-primary", "fingerprint": "7700be219b83e9c1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d4538b02a787d892", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 backend/routes/original.js:84"}, "properties": {"repobilityId": "34e892b502b8fdb1", "scanner": "scanner-primary", "fingerprint": "d4538b02a787d892", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-7ea2b7c9eb1ef0ad", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 backend/routes/douyinToText.js:74"}, "properties": {"repobilityId": "0edc1f31894a5732", "scanner": "scanner-primary", "fingerprint": "7ea2b7c9eb1ef0ad", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-e3026eded0f83be6", "level": "note", "message": {"text": "Legacy-named symbol `infer_v2` in local_asr_server/indextts_server.py:48"}, "properties": {"repobilityId": "bc604dfe9da02111", "scanner": "scanner-primary", "fingerprint": "e3026eded0f83be6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-c8f7a60380f22a4e", "level": "note", "message": {"text": "Legacy-named symbol `_build_ass_douyin_legacy` in local_asr_server/main.py:418"}, "properties": {"repobilityId": "8d7ae3cbc129a402", "scanner": "scanner-primary", "fingerprint": "c8f7a60380f22a4e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-9a82cf7d16234d20", "level": "note", "message": {"text": "21 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "2fad2cbef136ee78", "scanner": "scanner-primary", "fingerprint": "9a82cf7d16234d20", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "71593fba87a2276e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-a7f93b115797610b", "level": "error", "message": {"text": "FastAPI POST `generate` without auth dependency \u2014 desktop_client/heygem_server_v2.py:102"}, "properties": {"repobilityId": "d5e9aa4ba48df4a0", "scanner": "scanner-primary", "fingerprint": "a7f93b115797610b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "desktop_client/heygem_server_v2.py"}, "region": {"startLine": 102}}}]}, {"ruleId": "scanner-0cc3994b86f08b9d", "level": "error", "message": {"text": "FastAPI POST `cancel_task` without auth dependency \u2014 desktop_client/heygem_server_v2.py:204"}, "properties": {"repobilityId": "15664fb883ec0cab", "scanner": "scanner-primary", "fingerprint": "0cc3994b86f08b9d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "desktop_client/heygem_server_v2.py"}, "region": {"startLine": 204}}}]}, {"ruleId": "scanner-dcc2a087cc3a81b0", "level": "error", "message": {"text": "FastAPI POST `generate` without auth dependency \u2014 local_asr_server/indextts_server.py:141"}, "properties": {"repobilityId": "cb8432fea7bb4fd5", "scanner": "scanner-primary", "fingerprint": "dcc2a087cc3a81b0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "local_asr_server/indextts_server.py"}, "region": {"startLine": 141}}}]}, {"ruleId": "scanner-bc2b961cfdf67874", "level": "error", "message": {"text": "FastAPI POST `tts_submit` without auth dependency \u2014 local_asr_server/indextts_server.py:216"}, "properties": {"repobilityId": "6acbd01fc09540b9", "scanner": "scanner-primary", "fingerprint": "bc2b961cfdf67874", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "local_asr_server/indextts_server.py"}, "region": {"startLine": 216}}}]}, {"ruleId": "scanner-346505f48e011ace", "level": "error", "message": {"text": "FastAPI POST `asr_submit` without auth dependency \u2014 local_asr_server/main.py:89"}, "properties": {"repobilityId": "33614b5d845d5829", "scanner": "scanner-primary", "fingerprint": "346505f48e011ace", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "local_asr_server/main.py"}, "region": {"startLine": 89}}}]}, {"ruleId": "scanner-6857bfd57d9b0930", "level": "error", "message": {"text": "FastAPI POST `transcribe` without auth dependency \u2014 local_asr_server/main.py:108"}, "properties": {"repobilityId": "c1c745c844d848d2", "scanner": "scanner-primary", "fingerprint": "6857bfd57d9b0930", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "local_asr_server/main.py"}, "region": {"startLine": 108}}}]}, {"ruleId": "scanner-c838eaed0ac8d6aa", "level": "error", "message": {"text": "FastAPI POST `tts_synthesize` without auth dependency \u2014 local_asr_server/main.py:154"}, "properties": {"repobilityId": "9f8992a661323ca1", "scanner": "scanner-primary", "fingerprint": "c838eaed0ac8d6aa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "local_asr_server/main.py"}, "region": {"startLine": 154}}}]}, {"ruleId": "scanner-a900992c6e443ba1", "level": "error", "message": {"text": "FastAPI POST `tts_indextts_proxy` without auth dependency \u2014 local_asr_server/main.py:186"}, "properties": {"repobilityId": "9a183ef26054b626", "scanner": "scanner-primary", "fingerprint": "a900992c6e443ba1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "local_asr_server/main.py"}, "region": {"startLine": 186}}}]}, {"ruleId": "scanner-ffcd06c79ccd4da1", "level": "error", "message": {"text": "FastAPI POST `tts_indextts_register_voice` without auth dependency \u2014 local_asr_server/main.py:219"}, "properties": {"repobilityId": "db12f9bf19b16e52", "scanner": "scanner-primary", "fingerprint": "ffcd06c79ccd4da1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "local_asr_server/main.py"}, "region": {"startLine": 219}}}]}, {"ruleId": "scanner-9e5e8c63b3412d8a", "level": "error", "message": {"text": "FastAPI POST `tts_indextts_submit` without auth dependency \u2014 local_asr_server/main.py:236"}, "properties": {"repobilityId": "80fbf71a17bee167", "scanner": "scanner-primary", "fingerprint": "9e5e8c63b3412d8a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "local_asr_server/main.py"}, "region": {"startLine": 236}}}]}, {"ruleId": "scanner-3ae89a35d79fa82f", "level": "error", "message": {"text": "FastAPI POST `video_generate_proxy` without auth dependency \u2014 local_asr_server/main.py:270"}, "properties": {"repobilityId": "9c9ece6ba85377f6", "scanner": "scanner-primary", "fingerprint": "3ae89a35d79fa82f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "local_asr_server/main.py"}, "region": {"startLine": 270}}}]}, {"ruleId": "scanner-4f0b7cca4f0ca21a", "level": "error", "message": {"text": "FastAPI POST `video_cancel_proxy` without auth dependency \u2014 local_asr_server/main.py:329"}, "properties": {"repobilityId": "a11c29c95d0d7f0c", "scanner": "scanner-primary", "fingerprint": "4f0b7cca4f0ca21a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "local_asr_server/main.py"}, "region": {"startLine": 329}}}]}, {"ruleId": "scanner-8d16b6d6f9b96af0", "level": "error", "message": {"text": "FastAPI POST `video_postprocess` without auth dependency \u2014 local_asr_server/main.py:811"}, "properties": {"repobilityId": "f33819b5e2141545", "scanner": "scanner-primary", "fingerprint": "8d16b6d6f9b96af0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "local_asr_server/main.py"}, "region": {"startLine": 811}}}]}, {"ruleId": "scanner-5b381ab5fbdbb6e4", "level": "error", "message": {"text": "FastAPI POST `avatar_upload` without auth dependency \u2014 local_asr_server/main.py:949"}, "properties": {"repobilityId": "b52eb8aab3f211e1", "scanner": "scanner-primary", "fingerprint": "5b381ab5fbdbb6e4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "local_asr_server/main.py"}, "region": {"startLine": 949}}}]}, {"ruleId": "scanner-04d2667f571f11f0", "level": "error", "message": {"text": "FastAPI POST `avatar_bg_compress` without auth dependency \u2014 local_asr_server/main.py:1003"}, "properties": {"repobilityId": "0dafcbeef2ac7fb6", "scanner": "scanner-primary", "fingerprint": "04d2667f571f11f0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "local_asr_server/main.py"}, "region": {"startLine": 1003}}}]}, {"ruleId": "scanner-9f5c62872524ce0e", "level": "error", "message": {"text": "FastAPI DELETE `avatar_delete` without auth dependency \u2014 local_asr_server/main.py:1103"}, "properties": {"repobilityId": "b5114a2665049a2e", "scanner": "scanner-primary", "fingerprint": "9f5c62872524ce0e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "local_asr_server/main.py"}, "region": {"startLine": 1103}}}]}, {"ruleId": "scanner-d1457b434651220e", "level": "error", "message": {"text": "Dangling fetch: GET https://api.tikhub.io/api/v1/douyin/app/v3/fetch_one_video?aweme_id=${aweme_id} (backend/worker.js:264)"}, "properties": {"repobilityId": "a9a586d61b7941f4", "scanner": "scanner-primary", "fingerprint": "d1457b434651220e", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-a2e2ea9269c29c1c", "level": "error", "message": {"text": "Dangling fetch: POST /api/ai/avatar/upload (backend/frontend/src/27-extract-inspire-misc.js:452)"}, "properties": {"repobilityId": "ea9a22a18fc7c337", "scanner": "scanner-primary", "fingerprint": "a2e2ea9269c29c1c", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-aa6c9a7bba1a3f51", "level": "error", "message": {"text": "Dangling fetch: POST /api/ai/avatar/upload (backend/frontend/src/27-extract-inspire-misc.js:575)"}, "properties": {"repobilityId": "69b16b4fe42ebdf5", "scanner": "scanner-primary", "fingerprint": "aa6c9a7bba1a3f51", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-373d3c073134fa11", "level": "error", "message": {"text": "Dangling fetch: DELETE /api/ai/voices/${id} (backend/frontend/src/24-tts-voice-handlers.js:323)"}, "properties": {"repobilityId": "fc89607cf4970b90", "scanner": "scanner-primary", "fingerprint": "373d3c073134fa11", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-f83f68c4b51b1f77", "level": "error", "message": {"text": "Dangling fetch: POST https://api.anthropic.com/v1/messages (backend/lib/callAI.js:54)"}, "properties": {"repobilityId": "928b47c12bfbad72", "scanner": "scanner-primary", "fingerprint": "f83f68c4b51b1f77", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-7271a4df511499d6", "level": "error", "message": {"text": "Dangling fetch: POST https://open.bigmodel.cn/api/paas/v4/chat/completions (backend/lib/callAI.js:70)"}, "properties": {"repobilityId": "cfb72fd89bbd381b", "scanner": "scanner-primary", "fingerprint": "7271a4df511499d6", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-b15b9d8d1a376a99", "level": "error", "message": {"text": "Dangling fetch: POST https://api.deepseek.com/v1/chat/completions (backend/lib/callAI.js:86)"}, "properties": {"repobilityId": "b85ba290b48e3f1b", "scanner": "scanner-primary", "fingerprint": "b15b9d8d1a376a99", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-44f88d982d319054", "level": "error", "message": {"text": "Dangling fetch: POST https://api.anthropic.com/v1/messages (backend/routes/ai.js:105)"}, "properties": {"repobilityId": "dcf677688e6d1e25", "scanner": "scanner-primary", "fingerprint": "44f88d982d319054", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-a19af21b7aea424d", "level": "error", "message": {"text": "Dangling fetch: POST https://open.bigmodel.cn/api/paas/v4/chat/completions (backend/routes/ai.js:122)"}, "properties": {"repobilityId": "89db4e51479a04a6", "scanner": "scanner-primary", "fingerprint": "a19af21b7aea424d", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-814b09c1233be17e", "level": "error", "message": {"text": "Dangling fetch: POST https://api.deepseek.com/v1/chat/completions (backend/routes/ai.js:138)"}, "properties": {"repobilityId": "724abfadc9f605a3", "scanner": "scanner-primary", "fingerprint": "814b09c1233be17e", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-8a9440474951be3b", "level": "error", "message": {"text": "Dangling fetch: POST https://api.fish.audio/v1/tts (backend/routes/ai.js:301)"}, "properties": {"repobilityId": "50999d8fdfa752f2", "scanner": "scanner-primary", "fingerprint": "8a9440474951be3b", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-383c3e028ae4d143", "level": "error", "message": {"text": "Dangling fetch: POST https://api.fish.audio/model (backend/routes/ai.js:449)"}, "properties": {"repobilityId": "62054b3692605941", "scanner": "scanner-primary", "fingerprint": "383c3e028ae4d143", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-652797f1ca87d97a", "level": "error", "message": {"text": "Dangling fetch: GET https://api.tikhub.io/api/v1/douyin/app/v3/fetch_one_video?aweme_id=${awemeId} (backend/routes/original.js:84)"}, "properties": {"repobilityId": "be24e6b4721f901a", "scanner": "scanner-primary", "fingerprint": "652797f1ca87d97a", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-cfda2fe0041a93b3", "level": "error", "message": {"text": "Dangling fetch: GET https://api.tikhub.io/api/v1/douyin/web/fetch_one_video?aweme_id=${awemeId} (backend/routes/original.js:93)"}, "properties": {"repobilityId": "00ab11af0358810b", "scanner": "scanner-primary", "fingerprint": "cfda2fe0041a93b3", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-8bc427e53f51e1c8", "level": "error", "message": {"text": "Dangling fetch: GET https://api.tikhub.io/api/v1/douyin/app/v3/fetch_video_subtitle?aweme_id=${awemeId} (backend/routes/original.js:119)"}, "properties": {"repobilityId": "b63093813ef26186", "scanner": "scanner-primary", "fingerprint": "8bc427e53f51e1c8", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-6491dc806f9ce5de", "level": "error", "message": {"text": "Dangling fetch: GET https://api.tikhub.io/api/v1/douyin/web/fetch_user_post_videos?sec_user_id=${encodeURIComponent(secUserId)}&max_cursor=0&count=${count} (backend/routes/original.js:171)"}, "properties": {"repobilityId": "bc8cab35ecb7abbb", "scanner": "scanner-primary", "fingerprint": "6491dc806f9ce5de", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-8abb9d5530963833", "level": "error", "message": {"text": "Dangling fetch: GET https://api.tikhub.io/api/v1/douyin/app/v3/fetch_video_subtitle?aweme_id=${awemeId} (backend/routes/extract.js:105)"}, "properties": {"repobilityId": "1251b9f9aa6a16b4", "scanner": "scanner-primary", "fingerprint": "8abb9d5530963833", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-bb18fe31fd5070d2", "level": "error", "message": {"text": "Dangling fetch: POST https://api.coze.cn/v1/workflow/run (backend/routes/agents.js:56)"}, "properties": {"repobilityId": "cfab699b09d9734c", "scanner": "scanner-primary", "fingerprint": "bb18fe31fd5070d2", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-194570ee378dc07f", "level": "error", "message": {"text": "Dangling fetch: GET https://api.tikhub.io/api/v1/douyin/app/v3/fetch_user_post_videos?sec_user_id=${encodeURIComponent(sec_user_id)}&max_cursor=0&count=20&sort_type=0 (backend/routes/inspire.js:118)"}, "properties": {"repobilityId": "ce13201b3e8974d3", "scanner": "scanner-primary", "fingerprint": "194570ee378dc07f", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-b7812c3824a003fc", "level": "note", "message": {"text": "Unused endpoint: POST /video/generate"}, "properties": {"repobilityId": "7b0aaddac604a600", "scanner": "scanner-primary", "fingerprint": "b7812c3824a003fc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-253bdfc79b17e682", "level": "note", "message": {"text": "Unused endpoint: GET /video/task/{task_id}"}, "properties": {"repobilityId": "ab5da66e4b10764e", "scanner": "scanner-primary", "fingerprint": "253bdfc79b17e682", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7246177f967b5363", "level": "note", "message": {"text": "Unused endpoint: GET /video/file/{task_id}"}, "properties": {"repobilityId": "746d79b9b2964a90", "scanner": "scanner-primary", "fingerprint": "7246177f967b5363", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-42ecba0d1f40a5ce", "level": "note", "message": {"text": "Unused endpoint: POST /video/cancel/{task_id}"}, "properties": {"repobilityId": "d6b36385ebf9dc87", "scanner": "scanner-primary", "fingerprint": "42ecba0d1f40a5ce", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4050cdb59f998b65", "level": "note", "message": {"text": "Unused endpoint: POST /tts/generate"}, "properties": {"repobilityId": "0bb55ced41f1869c", "scanner": "scanner-primary", "fingerprint": "4050cdb59f998b65", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7caff84be2fb5493", "level": "note", "message": {"text": "Unused endpoint: POST /tts/register_voice"}, "properties": {"repobilityId": "9d8fc20d472b60f2", "scanner": "scanner-primary", "fingerprint": "7caff84be2fb5493", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3d5d0e8ab6c1a7a1", "level": "note", "message": {"text": "Unused endpoint: POST /tts/submit"}, "properties": {"repobilityId": "c067b0a9a161bb0c", "scanner": "scanner-primary", "fingerprint": "3d5d0e8ab6c1a7a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-870f1264829d32c5", "level": "note", "message": {"text": "Unused endpoint: GET /tts/task/{task_id}"}, "properties": {"repobilityId": "a9de5f966cb712fd", "scanner": "scanner-primary", "fingerprint": "870f1264829d32c5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0bac4e48ec3ddd83", "level": "note", "message": {"text": "Unused endpoint: POST /asr/submit"}, "properties": {"repobilityId": "7e599e369e8f9ada", "scanner": "scanner-primary", "fingerprint": "0bac4e48ec3ddd83", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-351339316ebcb95f", "level": "note", "message": {"text": "Unused endpoint: GET /asr/task/{task_id}"}, "properties": {"repobilityId": "21d6dba56ac6f1eb", "scanner": "scanner-primary", "fingerprint": "351339316ebcb95f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9beed81154d7aaea", "level": "note", "message": {"text": "Unused endpoint: POST /asr/transcribe"}, "properties": {"repobilityId": "e6fcb29f0602b85d", "scanner": "scanner-primary", "fingerprint": "9beed81154d7aaea", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-232d1ce5ec5453d2", "level": "note", "message": {"text": "Unused endpoint: POST /tts/synthesize"}, "properties": {"repobilityId": "4c4dc598b6be9f4c", "scanner": "scanner-primary", "fingerprint": "232d1ce5ec5453d2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7c82de0bcb6111d2", "level": "note", "message": {"text": "Unused endpoint: POST /tts/indextts"}, "properties": {"repobilityId": "6011e1b9bae3fc98", "scanner": "scanner-primary", "fingerprint": "7c82de0bcb6111d2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-683c777bcc8996a1", "level": "note", "message": {"text": "Unused endpoint: GET /tts/indextts/health"}, "properties": {"repobilityId": "fffb7a2415f37be8", "scanner": "scanner-primary", "fingerprint": "683c777bcc8996a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9d6efd41b3c6189d", "level": "note", "message": {"text": "Unused endpoint: POST /tts/indextts/register_voice"}, "properties": {"repobilityId": "0b8ff6954f28fba8", "scanner": "scanner-primary", "fingerprint": "9d6efd41b3c6189d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-32c825ccfcae8063", "level": "note", "message": {"text": "Unused endpoint: POST /tts/indextts/submit"}, "properties": {"repobilityId": "44c1c17e9718a2f3", "scanner": "scanner-primary", "fingerprint": "32c825ccfcae8063", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-26421a5cb0e9b86a", "level": "note", "message": {"text": "Unused endpoint: GET /tts/indextts/task/{task_id}"}, "properties": {"repobilityId": "024e4e816d5e8781", "scanner": "scanner-primary", "fingerprint": "26421a5cb0e9b86a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-89998a3e8b59a897", "level": "note", "message": {"text": "Unused endpoint: POST /video/postprocess"}, "properties": {"repobilityId": "93573f4c26347317", "scanner": "scanner-primary", "fingerprint": "89998a3e8b59a897", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-86e78de49314d549", "level": "note", "message": {"text": "Unused endpoint: POST /avatar/upload"}, "properties": {"repobilityId": "c0ed106df68546e9", "scanner": "scanner-primary", "fingerprint": "86e78de49314d549", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8bdb6e6580425187", "level": "note", "message": {"text": "Unused endpoint: POST /avatar/bg-compress"}, "properties": {"repobilityId": "f4c01bc37e78c47d", "scanner": "scanner-primary", "fingerprint": "8bdb6e6580425187", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-182e456eea77efc2", "level": "note", "message": {"text": "Unused endpoint: GET /avatar/list/{user_id}"}, "properties": {"repobilityId": "357b71669722f4ab", "scanner": "scanner-primary", "fingerprint": "182e456eea77efc2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-44430b844ba27fb6", "level": "note", "message": {"text": "Unused endpoint: DELETE /avatar/{user_id}/{avatar_id}"}, "properties": {"repobilityId": "074621dd153403f4", "scanner": "scanner-primary", "fingerprint": "44430b844ba27fb6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d08a07e9540ad561", "level": "note", "message": {"text": "Unused endpoint: GET /avatar/file/{user_id}/{avatar_id}"}, "properties": {"repobilityId": "8e87f56a3b04a56d", "scanner": "scanner-primary", "fingerprint": "d08a07e9540ad561", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6eb452fbfb454d20", "level": "note", "message": {"text": "Unused endpoint: USE /api/auth"}, "properties": {"repobilityId": "0a5793afc5ea0a13", "scanner": "scanner-primary", "fingerprint": "6eb452fbfb454d20", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6f63dbe78bf2280a", "level": "note", "message": {"text": "Unused endpoint: USE /api/config"}, "properties": {"repobilityId": "bd0e8f8c3455252d", "scanner": "scanner-primary", "fingerprint": "6f63dbe78bf2280a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-316c43db307befc3", "level": "note", "message": {"text": "Unused endpoint: USE /api/ai"}, "properties": {"repobilityId": "821f40007ddc6699", "scanner": "scanner-primary", "fingerprint": "316c43db307befc3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7620b08065ac7789", "level": "note", "message": {"text": "Unused endpoint: USE /api/extract"}, "properties": {"repobilityId": "cb7438e2a3a15e3e", "scanner": "scanner-primary", "fingerprint": "7620b08065ac7789", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6144d3a3081af4ef", "level": "note", "message": {"text": "Unused endpoint: USE /api/history"}, "properties": {"repobilityId": "3ff85fe577aa91d3", "scanner": "scanner-primary", "fingerprint": "6144d3a3081af4ef", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-99e84783d94c75d8", "level": "note", "message": {"text": "Unused endpoint: USE /api/codes"}, "properties": {"repobilityId": "3670dff1e46e63bc", "scanner": "scanner-primary", "fingerprint": "99e84783d94c75d8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d3de1c8f413057c3", "level": "note", "message": {"text": "Unused endpoint: USE /api/video"}, "properties": {"repobilityId": "935e31467515f256", "scanner": "scanner-primary", "fingerprint": "d3de1c8f413057c3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9758d51e260d4881", "level": "note", "message": {"text": "Unused endpoint: USE /api/inspire"}, "properties": {"repobilityId": "e6ab3fde9c1510a4", "scanner": "scanner-primary", "fingerprint": "9758d51e260d4881", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6330b0c4a0a152d3", "level": "note", "message": {"text": "Unused endpoint: USE /api/tasks"}, "properties": {"repobilityId": "62b72227313b88f9", "scanner": "scanner-primary", "fingerprint": "6330b0c4a0a152d3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1cacc08c93a646f3", "level": "note", "message": {"text": "Unused endpoint: USE /api/industry-videos"}, "properties": {"repobilityId": "50f914fbb4cfa726", "scanner": "scanner-primary", "fingerprint": "1cacc08c93a646f3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-00d2f0293753841f", "level": "note", "message": {"text": "Unused endpoint: USE /api/credits"}, "properties": {"repobilityId": "cf3d446f7b134b9a", "scanner": "scanner-primary", "fingerprint": "00d2f0293753841f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-094608bf688f5d04", "level": "note", "message": {"text": "Unused endpoint: USE /api/agents"}, "properties": {"repobilityId": "78c2e0748bb16010", "scanner": "scanner-primary", "fingerprint": "094608bf688f5d04", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b230f730b81c4f1c", "level": "note", "message": {"text": "Unused endpoint: USE /api/original"}, "properties": {"repobilityId": "70cf5b874d47c7ac", "scanner": "scanner-primary", "fingerprint": "b230f730b81c4f1c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-794cae1fa4cb91e6", "level": "note", "message": {"text": "Unused endpoint: USE /api/novel"}, "properties": {"repobilityId": "3a7d04a0d5ae4b86", "scanner": "scanner-primary", "fingerprint": "794cae1fa4cb91e6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4756b4c4da7d2088", "level": "note", "message": {"text": "Unused endpoint: GET /api/health"}, "properties": {"repobilityId": "1e5295e69c6e06d8", "scanner": "scanner-primary", "fingerprint": "4756b4c4da7d2088", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5bbf7ef577415207", "level": "note", "message": {"text": "Unused endpoint: GET /desktop"}, "properties": {"repobilityId": "264c0979bf0f9636", "scanner": "scanner-primary", "fingerprint": "5bbf7ef577415207", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-190e73b6062088b5", "level": "note", "message": {"text": "Unused endpoint: GET /industry-videos/industries"}, "properties": {"repobilityId": "61db92eb7769101b", "scanner": "scanner-primary", "fingerprint": "190e73b6062088b5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c89225c80f7e29ca", "level": "note", "message": {"text": "Unused endpoint: POST /ai/inspire"}, "properties": {"repobilityId": "5d922a6a93159b80", "scanner": "scanner-primary", "fingerprint": "c89225c80f7e29ca", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8d20698cff65ae9f", "level": "note", "message": {"text": "Unused endpoint: POST /ai/inspire-expand"}, "properties": {"repobilityId": "1233a36d7c878411", "scanner": "scanner-primary", "fingerprint": "8d20698cff65ae9f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ef63bd6f8db6184d", "level": "note", "message": {"text": "Unused endpoint: GET /history?type=inspire"}, "properties": {"repobilityId": "4b3f675afafa9da5", "scanner": "scanner-primary", "fingerprint": "ef63bd6f8db6184d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c71e95effdbb00d9", "level": "note", "message": {"text": "Unused endpoint: POST /auth/update-avatar"}, "properties": {"repobilityId": "d278c9d463da46ae", "scanner": "scanner-primary", "fingerprint": "c71e95effdbb00d9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9143464946a01de5", "level": "note", "message": {"text": "Unused endpoint: PUT /auth/profile"}, "properties": {"repobilityId": "276ebb29b1b05541", "scanner": "scanner-primary", "fingerprint": "9143464946a01de5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-93aa577d37c33b33", "level": "note", "message": {"text": "Unused endpoint: GET /config/app-h5-settings"}, "properties": {"repobilityId": "d10496d7f267f8b3", "scanner": "scanner-primary", "fingerprint": "93aa577d37c33b33", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3bf40e1406d45b9e", "level": "note", "message": {"text": "Unused endpoint: POST /auth/activate-code"}, "properties": {"repobilityId": "984309dde134f3d0", "scanner": "scanner-primary", "fingerprint": "3bf40e1406d45b9e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d9379a3d934af4da", "level": "note", "message": {"text": "Unused endpoint: GET /ai/avatar/list"}, "properties": {"repobilityId": "f6f4f8706e20b627", "scanner": "scanner-primary", "fingerprint": "d9379a3d934af4da", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-52e0d314873c244e", "level": "note", "message": {"text": "Unused endpoint: GET /ai/asr-url"}, "properties": {"repobilityId": "3e9718e0c0e07724", "scanner": "scanner-primary", "fingerprint": "52e0d314873c244e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-61d034ff7e780481", "level": "note", "message": {"text": "Unused endpoint: POST /credits/activate"}, "properties": {"repobilityId": "a634bab7b836b68e", "scanner": "scanner-primary", "fingerprint": "61d034ff7e780481", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}