{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-bb6c345f42fa194c", "name": "Possibly dead Python function: loop", "shortDescription": {"text": "Possibly dead Python function: loop"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-159fcba0a54bbc8d", "name": "Possibly dead Python function: close_db", "shortDescription": {"text": "Possibly dead Python function: close_db"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1b17e56b65944e89", "name": "Possibly dead Python function: decorator", "shortDescription": {"text": "Possibly dead Python function: decorator"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-362a373a264631bb", "name": "Possibly dead Python function: events_between", "shortDescription": {"text": "Possibly dead Python function: events_between"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cdb9e434b4842630", "name": "Possibly dead Python function: loop", "shortDescription": {"text": "Possibly dead Python function: loop"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-280908a5b2c6ed32", "name": "Icon-only button without accessible name \u2014 static/js/admin.js:141", "shortDescription": {"text": "Icon-only button without accessible name \u2014 static/js/admin.js:141"}, "fullDescription": {"text": "A `<button>` whose only child is a single glyph or symbol needs `title=` or `aria-label=` so screen readers (and tooltips on hover) work.\n\nWhy: P3 in CHECKLIST.md \u2014 icon-only buttons skipped a title.\nRule id: fq.button.no-label"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f49e98fa9e836fbf", "name": "Insecure pattern 'direct_innerhtml_assignment' in static/js/console.js:108", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/js/console.js:108"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-066461fe498b750d", "name": "Insecure pattern 'direct_innerhtml_assignment' in static/js/admin.js:66", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/js/admin.js:66"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-acc5fd23d9fd7e55", "name": "Insecure pattern 'direct_innerhtml_assignment' in static/js/dashboard.js:107", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/js/dashboard.js:107"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-55b2e111bae5ac1a", "name": "Insecure pattern 'direct_innerhtml_assignment' in static/js/stats.js:144", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/js/stats.js:144"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "2 test file(s) for 25 source file(s) (ratio 0.08). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 17 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4190d4dc77331c10", "name": "Commented-code block (6 lines) in app.py:37", "shortDescription": {"text": "Commented-code block (6 lines) in app.py:37"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-eec953c569ba9542", "name": "Legacy-named symbol `make_backup` in backup_db.py:27", "shortDescription": {"text": "Legacy-named symbol `make_backup` in backup_db.py:27"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f01468c9743810f0", "name": "Commented-code block (5 lines) in baytracker/db.py:220", "shortDescription": {"text": "Commented-code block (5 lines) in baytracker/db.py:220"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-5adffe28f14b1eca", "name": "Network/subprocess call without timeout or try/except \u2014 baytracker/notify.py:102", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 baytracker/notify.py:102"}, "fullDescription": {"text": "`requests.post(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\napp.py:admin_division, app.py:admin_recipient\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbaytracker/state.py:is_open, baytracker/state.py:is_open, baytracker/state.py:is_open\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fdc597bd72c1e972", "name": "Flask mutation route `api_action` without `@login_required` \u2014 app.py:156", "shortDescription": {"text": "Flask mutation route `api_action` without `@login_required` \u2014 app.py:156"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3945a603411fff6a", "name": "Flask mutation route `api_correct` without `@login_required` \u2014 app.py:183", "shortDescription": {"text": "Flask mutation route `api_correct` without `@login_required` \u2014 app.py:183"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f508929ccc74dc9d", "name": "Flask mutation route `unlock` without `@login_required` \u2014 app.py:243", "shortDescription": {"text": "Flask mutation route `unlock` without `@login_required` \u2014 app.py:243"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-6b14ab8b9f8d4a44", "name": "Flask mutation route `lock` without `@login_required` \u2014 app.py:255", "shortDescription": {"text": "Flask mutation route `lock` without `@login_required` \u2014 app.py:255"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d2de88563c27d561", "name": "Flask mutation route `admin_division` without `@login_required` \u2014 app.py:495", "shortDescription": {"text": "Flask mutation route `admin_division` without `@login_required` \u2014 app.py:495"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c1e8f8861743ae93", "name": "Flask mutation route `admin_reason` without `@login_required` \u2014 app.py:525", "shortDescription": {"text": "Flask mutation route `admin_reason` without `@login_required` \u2014 app.py:525"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-42cd6ce638b511e8", "name": "Flask mutation route `admin_product` without `@login_required` \u2014 app.py:565", "shortDescription": {"text": "Flask mutation route `admin_product` without `@login_required` \u2014 app.py:565"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-17dd1dccc4b76d6c", "name": "Flask mutation route `admin_initials` without `@login_required` \u2014 app.py:594", "shortDescription": {"text": "Flask mutation route `admin_initials` without `@login_required` \u2014 app.py:594"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dbf19a19416f4f0d", "name": "Flask mutation route `admin_bay` without `@login_required` \u2014 app.py:619", "shortDescription": {"text": "Flask mutation route `admin_bay` without `@login_required` \u2014 app.py:619"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e1aebce09da253ef", "name": "Flask mutation route `admin_layout` without `@login_required` \u2014 app.py:649", "shortDescription": {"text": "Flask mutation route `admin_layout` without `@login_required` \u2014 app.py:649"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-603116f8f6df76f0", "name": "Flask mutation route `admin_schedule` without `@login_required` \u2014 app.py:660", "shortDescription": {"text": "Flask mutation route `admin_schedule` without `@login_required` \u2014 app.py:660"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-19ccbcb7a3b44035", "name": "Flask mutation route `admin_settings` without `@login_required` \u2014 app.py:672", "shortDescription": {"text": "Flask mutation route `admin_settings` without `@login_required` \u2014 app.py:672"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f655e722d490d8f0", "name": "Flask mutation route `admin_pin` without `@login_required` \u2014 app.py:683", "shortDescription": {"text": "Flask mutation route `admin_pin` without `@login_required` \u2014 app.py:683"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d0e06bc7bf4fd6c5", "name": "Flask mutation route `admin_recipient` without `@login_required` \u2014 app.py:695", "shortDescription": {"text": "Flask mutation route `admin_recipient` without `@login_required` \u2014 app.py:695"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-574bfc6996f4b767", "name": "Flask mutation route `admin_recipient_test` without `@login_required` \u2014 app.py:736", "shortDescription": {"text": "Flask mutation route `admin_recipient_test` without `@login_required` \u2014 app.py:736"}, "fullDescription": {"text": "Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1a6d91f2236825bf", "name": "Unused endpoint: ANY /", "shortDescription": {"text": "Unused endpoint: ANY /"}, "fullDescription": {"text": "`app.py` declares `ANY /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8877994083ed2902", "name": "Unused endpoint: ANY /dashboard", "shortDescription": {"text": "Unused endpoint: ANY /dashboard"}, "fullDescription": {"text": "`app.py` declares `ANY /dashboard` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d1c9cd28cea8a887", "name": "Unused endpoint: ANY /console", "shortDescription": {"text": "Unused endpoint: ANY /console"}, "fullDescription": {"text": "`app.py` declares `ANY /console` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b45e064b63184b76", "name": "Unused endpoint: ANY /stats", "shortDescription": {"text": "Unused endpoint: ANY /stats"}, "fullDescription": {"text": "`app.py` declares `ANY /stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-98356fa7ff420a14", "name": "Unused endpoint: ANY /admin", "shortDescription": {"text": "Unused endpoint: ANY /admin"}, "fullDescription": {"text": "`app.py` declares `ANY /admin` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52917a4a34f757a2", "name": "Unused endpoint: ANY /events", "shortDescription": {"text": "Unused endpoint: ANY /events"}, "fullDescription": {"text": "`app.py` declares `ANY /events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-36d677a7715b9807", "name": "Unused endpoint: ANY /api/config", "shortDescription": {"text": "Unused endpoint: ANY /api/config"}, "fullDescription": {"text": "`app.py` declares `ANY /api/config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c79648dd30387f99", "name": "Unused endpoint: ANY /api/action", "shortDescription": {"text": "Unused endpoint: ANY /api/action"}, "fullDescription": {"text": "`app.py` declares `ANY /api/action` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6334c85f8f5442fa", "name": "Unused endpoint: ANY /api/correct", "shortDescription": {"text": "Unused endpoint: ANY /api/correct"}, "fullDescription": {"text": "`app.py` declares `ANY /api/correct` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ec3442aa0b6ba39d", "name": "Unused endpoint: ANY /api/stats", "shortDescription": {"text": "Unused endpoint: ANY /api/stats"}, "fullDescription": {"text": "`app.py` declares `ANY /api/stats` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-74ac775dfcc1ade6", "name": "Unused endpoint: ANY /api/open_recent", "shortDescription": {"text": "Unused endpoint: ANY /api/open_recent"}, "fullDescription": {"text": "`app.py` declares `ANY /api/open_recent` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-85238554249cfd2c", "name": "Unused endpoint: ANY /export.xlsx", "shortDescription": {"text": "Unused endpoint: ANY /export.xlsx"}, "fullDescription": {"text": "`app.py` declares `ANY /export.xlsx` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ba1dd250e10ef1b2", "name": "Unused endpoint: ANY /export.zip", "shortDescription": {"text": "Unused endpoint: ANY /export.zip"}, "fullDescription": {"text": "`app.py` declares `ANY /export.zip` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-234fe8735b8093f2", "name": "Unused endpoint: ANY /unlock", "shortDescription": {"text": "Unused endpoint: ANY /unlock"}, "fullDescription": {"text": "`app.py` declares `ANY /unlock` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-93db3c3118c06741", "name": "Unused endpoint: ANY /lock", "shortDescription": {"text": "Unused endpoint: ANY /lock"}, "fullDescription": {"text": "`app.py` declares `ANY /lock` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c3ba676dd441e0f7", "name": "Unused endpoint: ANY /api/admin/data", "shortDescription": {"text": "Unused endpoint: ANY /api/admin/data"}, "fullDescription": {"text": "`app.py` declares `ANY /api/admin/data` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0e9e1d9eecc40e5f", "name": "Unused endpoint: ANY /api/admin/division", "shortDescription": {"text": "Unused endpoint: ANY /api/admin/division"}, "fullDescription": {"text": "`app.py` declares `ANY /api/admin/division` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ed8e2b076792e0e9", "name": "Unused endpoint: ANY /api/admin/reason", "shortDescription": {"text": "Unused endpoint: ANY /api/admin/reason"}, "fullDescription": {"text": "`app.py` declares `ANY /api/admin/reason` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bb78f533df5e00b3", "name": "Unused endpoint: ANY /api/admin/product", "shortDescription": {"text": "Unused endpoint: ANY /api/admin/product"}, "fullDescription": {"text": "`app.py` declares `ANY /api/admin/product` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d99227daebc5d07e", "name": "Unused endpoint: ANY /api/admin/initials", "shortDescription": {"text": "Unused endpoint: ANY /api/admin/initials"}, "fullDescription": {"text": "`app.py` declares `ANY /api/admin/initials` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-20523b3f5485c1b0", "name": "Unused endpoint: ANY /api/admin/bay", "shortDescription": {"text": "Unused endpoint: ANY /api/admin/bay"}, "fullDescription": {"text": "`app.py` declares `ANY /api/admin/bay` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5b58cf4bd4576443", "name": "Unused endpoint: ANY /api/admin/layout", "shortDescription": {"text": "Unused endpoint: ANY /api/admin/layout"}, "fullDescription": {"text": "`app.py` declares `ANY /api/admin/layout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c04504c2f0f6cd3", "name": "Unused endpoint: ANY /api/admin/schedule", "shortDescription": {"text": "Unused endpoint: ANY /api/admin/schedule"}, "fullDescription": {"text": "`app.py` declares `ANY /api/admin/schedule` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-966d464a2f5d32a9", "name": "Unused endpoint: ANY /api/admin/settings", "shortDescription": {"text": "Unused endpoint: ANY /api/admin/settings"}, "fullDescription": {"text": "`app.py` declares `ANY /api/admin/settings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e6ffe79af61395d0", "name": "Unused endpoint: ANY /api/admin/pin", "shortDescription": {"text": "Unused endpoint: ANY /api/admin/pin"}, "fullDescription": {"text": "`app.py` declares `ANY /api/admin/pin` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-595853094e2c679a", "name": "Unused endpoint: ANY /api/admin/recipient", "shortDescription": {"text": "Unused endpoint: ANY /api/admin/recipient"}, "fullDescription": {"text": "`app.py` declares `ANY /api/admin/recipient` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-99d62f8ce50cd75c", "name": "Unused endpoint: ANY /api/admin/recipient_test", "shortDescription": {"text": "Unused endpoint: ANY /api/admin/recipient_test"}, "fullDescription": {"text": "`app.py` declares `ANY /api/admin/recipient_test` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7aa4b2518cbbbfa2", "name": "Unused endpoint: GET /api/config", "shortDescription": {"text": "Unused endpoint: GET /api/config"}, "fullDescription": {"text": "`static/js/console.js` declares `GET /api/config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a10a1ec0d0e7530d", "name": "Unused endpoint: POST /api/action", "shortDescription": {"text": "Unused endpoint: POST /api/action"}, "fullDescription": {"text": "`static/js/console.js` declares `POST /api/action` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-209a98e46035c911", "name": "Unused endpoint: GET /api/admin/data", "shortDescription": {"text": "Unused endpoint: GET /api/admin/data"}, "fullDescription": {"text": "`static/js/admin.js` declares `GET /api/admin/data` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-847792e4356c7363", "name": "Unused endpoint: POST /api/admin/recipient_test", "shortDescription": {"text": "Unused endpoint: POST /api/admin/recipient_test"}, "fullDescription": {"text": "`static/js/admin.js` declares `POST /api/admin/recipient_test` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c08b9b715a7a2ac", "name": "Unused endpoint: POST /api/admin/pin", "shortDescription": {"text": "Unused endpoint: POST /api/admin/pin"}, "fullDescription": {"text": "`static/js/admin.js` declares `POST /api/admin/pin` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-74bb2e86e37216c6", "name": "Unused endpoint: POST /lock", "shortDescription": {"text": "Unused endpoint: POST /lock"}, "fullDescription": {"text": "`static/js/admin.js` declares `POST /lock` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bd0e1145d8bdec57", "name": "Unused endpoint: GET /api/stats?", "shortDescription": {"text": "Unused endpoint: GET /api/stats?"}, "fullDescription": {"text": "`static/js/stats.js` declares `GET /api/stats?` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fea02fda82a64f61", "name": "Unused endpoint: GET /api/open_recent", "shortDescription": {"text": "Unused endpoint: GET /api/open_recent"}, "fullDescription": {"text": "`static/js/stats.js` declares `GET /api/open_recent` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-89070201973164a5", "name": "Unused endpoint: POST /api/correct", "shortDescription": {"text": "Unused endpoint: POST /api/correct"}, "fullDescription": {"text": "`static/js/stats.js` declares `POST /api/correct` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22942"}, "properties": {"repository": "Xavier8264/bay-tracker", "repoUrl": "https://github.com/Xavier8264/bay-tracker", "branch": "main"}, "results": [{"ruleId": "scanner-bb6c345f42fa194c", "level": "note", "message": {"text": "Possibly dead Python function: loop"}, "properties": {"repobilityId": "ef7a4029179da27e", "scanner": "scanner-primary", "fingerprint": "bb6c345f42fa194c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app.py:418"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-159fcba0a54bbc8d", "level": "note", "message": {"text": "Possibly dead Python function: close_db"}, "properties": {"repobilityId": "c3b06ac4c16e2787", "scanner": "scanner-primary", "fingerprint": "159fcba0a54bbc8d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "baytracker/app_db.py:23"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1b17e56b65944e89", "level": "note", "message": {"text": "Possibly dead Python function: decorator"}, "properties": {"repobilityId": "ffbcbc9bc189af1c", "scanner": "scanner-primary", "fingerprint": "1b17e56b65944e89", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "baytracker/auth.py:66"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-362a373a264631bb", "level": "note", "message": {"text": "Possibly dead Python function: events_between"}, "properties": {"repobilityId": "7f2fd1f6cb17366c", "scanner": "scanner-primary", "fingerprint": "362a373a264631bb", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "baytracker/events.py:84"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-cdb9e434b4842630", "level": "note", "message": {"text": "Possibly dead Python function: loop"}, "properties": {"repobilityId": "ef7a4029179da27e", "scanner": "scanner-primary", "fingerprint": "cdb9e434b4842630", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "baytracker/notify.py:206"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-280908a5b2c6ed32", "level": "note", "message": {"text": "Icon-only button without accessible name \u2014 static/js/admin.js:141"}, "properties": {"repobilityId": "d3c4dfa2c2c7b446", "scanner": "scanner-primary", "fingerprint": "280908a5b2c6ed32", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.button.no-label"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-f49e98fa9e836fbf", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/js/console.js:108"}, "properties": {"repobilityId": "241d42bdda7bebfd", "scanner": "scanner-primary", "fingerprint": "f49e98fa9e836fbf", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "static/js/console.js"}, "region": {"startLine": 108}}}]}, {"ruleId": "scanner-066461fe498b750d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/js/admin.js:66"}, "properties": {"repobilityId": "2e893fbfa43c1aa4", "scanner": "scanner-primary", "fingerprint": "066461fe498b750d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "static/js/admin.js"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-acc5fd23d9fd7e55", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/js/dashboard.js:107"}, "properties": {"repobilityId": "9a8c59174355db60", "scanner": "scanner-primary", "fingerprint": "acc5fd23d9fd7e55", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "static/js/dashboard.js"}, "region": {"startLine": 107}}}]}, {"ruleId": "scanner-55b2e111bae5ac1a", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/js/stats.js:144"}, "properties": {"repobilityId": "c999ea6000ae222b", "scanner": "scanner-primary", "fingerprint": "55b2e111bae5ac1a", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "static/js/stats.js"}, "region": {"startLine": 144}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "34974e269cc225ed", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "1d1fce36f591eb27", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "8d6e8ab85ff2492f", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "d76b5eb208680692", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "f3d93da93eabfd71", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "fe24610fd6d49907", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-4190d4dc77331c10", "level": "none", "message": {"text": "Commented-code block (6 lines) in app.py:37"}, "properties": {"repobilityId": "0bdcb47632ffbb49", "scanner": "scanner-primary", "fingerprint": "4190d4dc77331c10", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-eec953c569ba9542", "level": "note", "message": {"text": "Legacy-named symbol `make_backup` in backup_db.py:27"}, "properties": {"repobilityId": "7443e5932538e3d2", "scanner": "scanner-primary", "fingerprint": "eec953c569ba9542", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f01468c9743810f0", "level": "none", "message": {"text": "Commented-code block (5 lines) in baytracker/db.py:220"}, "properties": {"repobilityId": "d21044e20341d7e1", "scanner": "scanner-primary", "fingerprint": "f01468c9743810f0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-5adffe28f14b1eca", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 baytracker/notify.py:102"}, "properties": {"repobilityId": "9893be25a7f84954", "scanner": "scanner-primary", "fingerprint": "5adffe28f14b1eca", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "c9af719bff202a20", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "7d327788cb633f84", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-fdc597bd72c1e972", "level": "error", "message": {"text": "Flask mutation route `api_action` without `@login_required` \u2014 app.py:156"}, "properties": {"repobilityId": "247fe5f0acbee1fe", "scanner": "scanner-primary", "fingerprint": "fdc597bd72c1e972", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app.py"}, "region": {"startLine": 156}}}]}, {"ruleId": "scanner-3945a603411fff6a", "level": "error", "message": {"text": "Flask mutation route `api_correct` without `@login_required` \u2014 app.py:183"}, "properties": {"repobilityId": "d61453a0b0ba45bd", "scanner": "scanner-primary", "fingerprint": "3945a603411fff6a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app.py"}, "region": {"startLine": 183}}}]}, {"ruleId": "scanner-f508929ccc74dc9d", "level": "error", "message": {"text": "Flask mutation route `unlock` without `@login_required` \u2014 app.py:243"}, "properties": {"repobilityId": "236ecd1d1dfcf2ba", "scanner": "scanner-primary", "fingerprint": "f508929ccc74dc9d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app.py"}, "region": {"startLine": 243}}}]}, {"ruleId": "scanner-6b14ab8b9f8d4a44", "level": "error", "message": {"text": "Flask mutation route `lock` without `@login_required` \u2014 app.py:255"}, "properties": {"repobilityId": "0d09df93996ebf6d", "scanner": "scanner-primary", "fingerprint": "6b14ab8b9f8d4a44", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app.py"}, "region": {"startLine": 255}}}]}, {"ruleId": "scanner-d2de88563c27d561", "level": "error", "message": {"text": "Flask mutation route `admin_division` without `@login_required` \u2014 app.py:495"}, "properties": {"repobilityId": "0a608a1f0024294d", "scanner": "scanner-primary", "fingerprint": "d2de88563c27d561", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app.py"}, "region": {"startLine": 495}}}]}, {"ruleId": "scanner-c1e8f8861743ae93", "level": "error", "message": {"text": "Flask mutation route `admin_reason` without `@login_required` \u2014 app.py:525"}, "properties": {"repobilityId": "bfaa141d1114727c", "scanner": "scanner-primary", "fingerprint": "c1e8f8861743ae93", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app.py"}, "region": {"startLine": 525}}}]}, {"ruleId": "scanner-42cd6ce638b511e8", "level": "error", "message": {"text": "Flask mutation route `admin_product` without `@login_required` \u2014 app.py:565"}, "properties": {"repobilityId": "9114c12a2b455dd9", "scanner": "scanner-primary", "fingerprint": "42cd6ce638b511e8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app.py"}, "region": {"startLine": 565}}}]}, {"ruleId": "scanner-17dd1dccc4b76d6c", "level": "error", "message": {"text": "Flask mutation route `admin_initials` without `@login_required` \u2014 app.py:594"}, "properties": {"repobilityId": "ff1f7463e7198fea", "scanner": "scanner-primary", "fingerprint": "17dd1dccc4b76d6c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app.py"}, "region": {"startLine": 594}}}]}, {"ruleId": "scanner-dbf19a19416f4f0d", "level": "error", "message": {"text": "Flask mutation route `admin_bay` without `@login_required` \u2014 app.py:619"}, "properties": {"repobilityId": "5180aca1e297ac31", "scanner": "scanner-primary", "fingerprint": "dbf19a19416f4f0d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app.py"}, "region": {"startLine": 619}}}]}, {"ruleId": "scanner-e1aebce09da253ef", "level": "error", "message": {"text": "Flask mutation route `admin_layout` without `@login_required` \u2014 app.py:649"}, "properties": {"repobilityId": "9ddef727b1d2c758", "scanner": "scanner-primary", "fingerprint": "e1aebce09da253ef", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app.py"}, "region": {"startLine": 649}}}]}, {"ruleId": "scanner-603116f8f6df76f0", "level": "error", "message": {"text": "Flask mutation route `admin_schedule` without `@login_required` \u2014 app.py:660"}, "properties": {"repobilityId": "08fb58a57814a5f9", "scanner": "scanner-primary", "fingerprint": "603116f8f6df76f0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app.py"}, "region": {"startLine": 660}}}]}, {"ruleId": "scanner-19ccbcb7a3b44035", "level": "error", "message": {"text": "Flask mutation route `admin_settings` without `@login_required` \u2014 app.py:672"}, "properties": {"repobilityId": "181af70fa85d741f", "scanner": "scanner-primary", "fingerprint": "19ccbcb7a3b44035", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app.py"}, "region": {"startLine": 672}}}]}, {"ruleId": "scanner-f655e722d490d8f0", "level": "error", "message": {"text": "Flask mutation route `admin_pin` without `@login_required` \u2014 app.py:683"}, "properties": {"repobilityId": "90512debe8c7d95c", "scanner": "scanner-primary", "fingerprint": "f655e722d490d8f0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app.py"}, "region": {"startLine": 683}}}]}, {"ruleId": "scanner-d0e06bc7bf4fd6c5", "level": "error", "message": {"text": "Flask mutation route `admin_recipient` without `@login_required` \u2014 app.py:695"}, "properties": {"repobilityId": "9fc60788128502b4", "scanner": "scanner-primary", "fingerprint": "d0e06bc7bf4fd6c5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app.py"}, "region": {"startLine": 695}}}]}, {"ruleId": "scanner-574bfc6996f4b767", "level": "error", "message": {"text": "Flask mutation route `admin_recipient_test` without `@login_required` \u2014 app.py:736"}, "properties": {"repobilityId": "7f3fd1dc95840d44", "scanner": "scanner-primary", "fingerprint": "574bfc6996f4b767", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.flask.unauth_route"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "app.py"}, "region": {"startLine": 736}}}]}, {"ruleId": "scanner-1a6d91f2236825bf", "level": "note", "message": {"text": "Unused endpoint: ANY /"}, "properties": {"repobilityId": "302fe621a396c5fd", "scanner": "scanner-primary", "fingerprint": "1a6d91f2236825bf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8877994083ed2902", "level": "note", "message": {"text": "Unused endpoint: ANY /dashboard"}, "properties": {"repobilityId": "768809eb7fb46080", "scanner": "scanner-primary", "fingerprint": "8877994083ed2902", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d1c9cd28cea8a887", "level": "note", "message": {"text": "Unused endpoint: ANY /console"}, "properties": {"repobilityId": "b1f9879fff66eb36", "scanner": "scanner-primary", "fingerprint": "d1c9cd28cea8a887", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b45e064b63184b76", "level": "note", "message": {"text": "Unused endpoint: ANY /stats"}, "properties": {"repobilityId": "c422931883dfd1dc", "scanner": "scanner-primary", "fingerprint": "b45e064b63184b76", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-98356fa7ff420a14", "level": "note", "message": {"text": "Unused endpoint: ANY /admin"}, "properties": {"repobilityId": "c05ef6c6e31aaece", "scanner": "scanner-primary", "fingerprint": "98356fa7ff420a14", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-52917a4a34f757a2", "level": "note", "message": {"text": "Unused endpoint: ANY /events"}, "properties": {"repobilityId": "b7b4410a1ebe7464", "scanner": "scanner-primary", "fingerprint": "52917a4a34f757a2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-36d677a7715b9807", "level": "note", "message": {"text": "Unused endpoint: ANY /api/config"}, "properties": {"repobilityId": "2fbc9f2e864e563f", "scanner": "scanner-primary", "fingerprint": "36d677a7715b9807", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c79648dd30387f99", "level": "note", "message": {"text": "Unused endpoint: ANY /api/action"}, "properties": {"repobilityId": "3648b0fa7244964c", "scanner": "scanner-primary", "fingerprint": "c79648dd30387f99", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6334c85f8f5442fa", "level": "note", "message": {"text": "Unused endpoint: ANY /api/correct"}, "properties": {"repobilityId": "1c20d12b0cddd49e", "scanner": "scanner-primary", "fingerprint": "6334c85f8f5442fa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ec3442aa0b6ba39d", "level": "note", "message": {"text": "Unused endpoint: ANY /api/stats"}, "properties": {"repobilityId": "3631f549692190fd", "scanner": "scanner-primary", "fingerprint": "ec3442aa0b6ba39d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-74ac775dfcc1ade6", "level": "note", "message": {"text": "Unused endpoint: ANY /api/open_recent"}, "properties": {"repobilityId": "e6d60d8779562f8b", "scanner": "scanner-primary", "fingerprint": "74ac775dfcc1ade6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-85238554249cfd2c", "level": "note", "message": {"text": "Unused endpoint: ANY /export.xlsx"}, "properties": {"repobilityId": "1d09304e2ac048c9", "scanner": "scanner-primary", "fingerprint": "85238554249cfd2c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ba1dd250e10ef1b2", "level": "note", "message": {"text": "Unused endpoint: ANY /export.zip"}, "properties": {"repobilityId": "b4d9c7d53d89e230", "scanner": "scanner-primary", "fingerprint": "ba1dd250e10ef1b2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-234fe8735b8093f2", "level": "note", "message": {"text": "Unused endpoint: ANY /unlock"}, "properties": {"repobilityId": "846bcdd0e24424a7", "scanner": "scanner-primary", "fingerprint": "234fe8735b8093f2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-93db3c3118c06741", "level": "note", "message": {"text": "Unused endpoint: ANY /lock"}, "properties": {"repobilityId": "0a67ef65ce1329b6", "scanner": "scanner-primary", "fingerprint": "93db3c3118c06741", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c3ba676dd441e0f7", "level": "note", "message": {"text": "Unused endpoint: ANY /api/admin/data"}, "properties": {"repobilityId": "876dab08f1670d48", "scanner": "scanner-primary", "fingerprint": "c3ba676dd441e0f7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0e9e1d9eecc40e5f", "level": "note", "message": {"text": "Unused endpoint: ANY /api/admin/division"}, "properties": {"repobilityId": "93a9a3a53a6b7e28", "scanner": "scanner-primary", "fingerprint": "0e9e1d9eecc40e5f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ed8e2b076792e0e9", "level": "note", "message": {"text": "Unused endpoint: ANY /api/admin/reason"}, "properties": {"repobilityId": "f5082ffe9d9497e1", "scanner": "scanner-primary", "fingerprint": "ed8e2b076792e0e9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bb78f533df5e00b3", "level": "note", "message": {"text": "Unused endpoint: ANY /api/admin/product"}, "properties": {"repobilityId": "4cc9b2e33fea5ab0", "scanner": "scanner-primary", "fingerprint": "bb78f533df5e00b3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d99227daebc5d07e", "level": "note", "message": {"text": "Unused endpoint: ANY /api/admin/initials"}, "properties": {"repobilityId": "9e17de4671c7f373", "scanner": "scanner-primary", "fingerprint": "d99227daebc5d07e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-20523b3f5485c1b0", "level": "note", "message": {"text": "Unused endpoint: ANY /api/admin/bay"}, "properties": {"repobilityId": "b5e84ecbb4469f45", "scanner": "scanner-primary", "fingerprint": "20523b3f5485c1b0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5b58cf4bd4576443", "level": "note", "message": {"text": "Unused endpoint: ANY /api/admin/layout"}, "properties": {"repobilityId": "fc69eb47dd9f80f4", "scanner": "scanner-primary", "fingerprint": "5b58cf4bd4576443", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8c04504c2f0f6cd3", "level": "note", "message": {"text": "Unused endpoint: ANY /api/admin/schedule"}, "properties": {"repobilityId": "4d61eefa89650016", "scanner": "scanner-primary", "fingerprint": "8c04504c2f0f6cd3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-966d464a2f5d32a9", "level": "note", "message": {"text": "Unused endpoint: ANY /api/admin/settings"}, "properties": {"repobilityId": "f3cbfedc88f5f13c", "scanner": "scanner-primary", "fingerprint": "966d464a2f5d32a9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e6ffe79af61395d0", "level": "note", "message": {"text": "Unused endpoint: ANY /api/admin/pin"}, "properties": {"repobilityId": "fd9331854b15657e", "scanner": "scanner-primary", "fingerprint": "e6ffe79af61395d0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-595853094e2c679a", "level": "note", "message": {"text": "Unused endpoint: ANY /api/admin/recipient"}, "properties": {"repobilityId": "a87e3a12161e3e9e", "scanner": "scanner-primary", "fingerprint": "595853094e2c679a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-99d62f8ce50cd75c", "level": "note", "message": {"text": "Unused endpoint: ANY /api/admin/recipient_test"}, "properties": {"repobilityId": "a04b3e831188794a", "scanner": "scanner-primary", "fingerprint": "99d62f8ce50cd75c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7aa4b2518cbbbfa2", "level": "note", "message": {"text": "Unused endpoint: GET /api/config"}, "properties": {"repobilityId": "d978a6d7705e095d", "scanner": "scanner-primary", "fingerprint": "7aa4b2518cbbbfa2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a10a1ec0d0e7530d", "level": "note", "message": {"text": "Unused endpoint: POST /api/action"}, "properties": {"repobilityId": "1e99d74e2acc9f3f", "scanner": "scanner-primary", "fingerprint": "a10a1ec0d0e7530d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-209a98e46035c911", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/data"}, "properties": {"repobilityId": "c03cb72268263c0b", "scanner": "scanner-primary", "fingerprint": "209a98e46035c911", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-847792e4356c7363", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/recipient_test"}, "properties": {"repobilityId": "3c68011d9282fd40", "scanner": "scanner-primary", "fingerprint": "847792e4356c7363", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5c08b9b715a7a2ac", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/pin"}, "properties": {"repobilityId": "736e52cb3e39e22b", "scanner": "scanner-primary", "fingerprint": "5c08b9b715a7a2ac", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-74bb2e86e37216c6", "level": "note", "message": {"text": "Unused endpoint: POST /lock"}, "properties": {"repobilityId": "d95d6a35e073d7b3", "scanner": "scanner-primary", "fingerprint": "74bb2e86e37216c6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bd0e1145d8bdec57", "level": "note", "message": {"text": "Unused endpoint: GET /api/stats?"}, "properties": {"repobilityId": "918adbca5204993f", "scanner": "scanner-primary", "fingerprint": "bd0e1145d8bdec57", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fea02fda82a64f61", "level": "note", "message": {"text": "Unused endpoint: GET /api/open_recent"}, "properties": {"repobilityId": "b9053a3e00a92c9a", "scanner": "scanner-primary", "fingerprint": "fea02fda82a64f61", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-89070201973164a5", "level": "note", "message": {"text": "Unused endpoint: POST /api/correct"}, "properties": {"repobilityId": "3cbcfa3f6fa04b59", "scanner": "scanner-primary", "fingerprint": "89070201973164a5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}