critical System graph security Secrets conf 1.00 Possible secret in backend/src/scripts/seed-dev.ts

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

backend/src/scripts/seed-dev.ts:33

critical System graph security Secrets conf 1.00 2 occurrences Possible secret in frontend/src/constants/api.ts

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

lines 11, 12

frontend/src/constants/api.ts:11, 12 (2 hits)

critical System graph security Secrets conf 1.00 2 occurrences Possible secret in frontend/src/constants/routes.ts

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

lines 47, 48

frontend/src/constants/routes.ts:47, 48 (2 hits)

critical System graph security Secrets conf 1.00 Possible secret in infra/ansible/playbooks/03-post-install.yml

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

infra/ansible/playbooks/03-post-install.yml:108

critical System graph security Secrets conf 1.00 Possible secret in infra/k8s/apps/backend/configmap.yaml

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

infra/k8s/apps/backend/configmap.yaml:40

critical System graph security Secrets conf 1.00 Possible secret in infra/k8s/monitoring/kube-prometheus-values.yaml

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

infra/k8s/monitoring/kube-prometheus-values.yaml:134

critical System graph security Secrets conf 1.00 Possible secret in infra/scripts/sealed-secret-create.sh

Detected pattern matching password_literal. Rotate the credential and move to a secret manager.

infra/scripts/sealed-secret-create.sh:78

high System graph api Wiring conf 1.00 Dangling fetch: GET /api/auth/firebase-token (frontend/src/lib/firebase.ts:133)

`frontend/src/lib/firebase.ts:133` calls `GET /api/auth/firebase-token` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/auth/firebase-token` If this points at an external API, prefix it with `https://` so the matcher…

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: GET /api/auth/me (frontend/src/services/auth.service.ts:114)

`frontend/src/services/auth.service.ts:114` calls `GET /api/auth/me` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: axios Normalized path used for matching: `/auth/me` If this points at an external API, prefix it with `https://` so the matcher skips it.

Dangling fetchAxios

high System graph api Wiring conf 1.00 Dangling fetch: GET /api/auth/socket-token (frontend/src/hooks/use-socket.ts:37)

`frontend/src/hooks/use-socket.ts:37` calls `GET /api/auth/socket-token` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/auth/socket-token` If this points at an external API, prefix it with `https://` so the matcher …

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: GET http://ip-api.com/json/${ip}?fields=status,country,city,lat,lon (backend/src/services/device-security.service.ts:29)

`backend/src/services/device-security.service.ts:29` calls `GET http://ip-api.com/json/${ip}?fields=status,country,city,lat,lon` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/http:/ip-api.com/json/<p>` If this poin…

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: GET https://nominatim.openstreetmap.org/reverse?lat=${lat}&lon=${lon}&format=json&zoom=10 (frontend/src/app/employer/candidates/page.tsx:943)

`frontend/src/app/employer/candidates/page.tsx:943` calls `GET https://nominatim.openstreetmap.org/reverse?lat=${lat}&lon=${lon}&format=json&zoom=10` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/nominatim.o…

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: GET https://nominatim.openstreetmap.org/search?format=json&viewbox=${viewbox}&bounded=1&featuretype=city&limit=15&addressdetails=0 (frontend/src/app/employer/candidates/page.tsx:902)

`frontend/src/app/employer/candidates/page.tsx:902` calls `GET https://nominatim.openstreetmap.org/search?format=json&viewbox=${viewbox}&bounded=1&featuretype=city&limit=15&addressdetails=0` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized pat…

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: PATCH /api/auth/me/profile (frontend/src/services/auth.service.ts:324)

`frontend/src/services/auth.service.ts:324` calls `PATCH /api/auth/me/profile` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: axios Normalized path used for matching: `/auth/me/profile` If this points at an external API, prefix it with `https://` so the matc…

Dangling fetchAxios

high System graph api Wiring conf 1.00 Dangling fetch: POST /api/auth/firebase-login (frontend/src/services/auth.service.ts:135)

`frontend/src/services/auth.service.ts:135` calls `POST /api/auth/firebase-login` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: axios Normalized path used for matching: `/auth/firebase-login` If this points at an external API, prefix it with `https://` so t…

Dangling fetchAxios

high System graph api Wiring conf 1.00 Dangling fetch: POST /api/auth/login (frontend/src/services/auth.service.ts:86)

`frontend/src/services/auth.service.ts:86` calls `POST /api/auth/login` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: axios Normalized path used for matching: `/auth/login` If this points at an external API, prefix it with `https://` so the matcher skips it.

Dangling fetchAxios

high System graph api Wiring conf 1.00 Dangling fetch: POST /api/auth/logout (frontend/src/lib/api.ts:138)

`frontend/src/lib/api.ts:138` calls `POST /api/auth/logout` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: axios Normalized path used for matching: `/auth/logout` If this points at an external API, prefix it with `https://` so the matcher skips it.

Dangling fetchAxios

high System graph api Wiring conf 1.00 Dangling fetch: POST /api/auth/logout (frontend/src/services/auth.service.ts:105)

`frontend/src/services/auth.service.ts:105` calls `POST /api/auth/logout` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: axios Normalized path used for matching: `/auth/logout` If this points at an external API, prefix it with `https://` so the matcher skips…

Dangling fetchAxios

high System graph api Wiring conf 1.00 Dangling fetch: POST /api/auth/mfa-recovery (frontend/src/services/auth.service.ts:235)

`frontend/src/services/auth.service.ts:235` calls `POST /api/auth/mfa-recovery` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: axios Normalized path used for matching: `/auth/mfa-recovery` If this points at an external API, prefix it with `https://` so the m…

Dangling fetchAxios

high System graph api Wiring conf 1.00 Dangling fetch: POST /api/auth/migrate (frontend/src/app/auth/callback/page.tsx:50)

`frontend/src/app/auth/callback/page.tsx:50` calls `POST /api/auth/migrate` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/auth/migrate` If this points at an external API, prefix it with `https://` so the matcher sk…

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: POST /api/auth/refresh (frontend/src/services/auth.service.ts:123)

`frontend/src/services/auth.service.ts:123` calls `POST /api/auth/refresh` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: axios Normalized path used for matching: `/auth/refresh` If this points at an external API, prefix it with `https://` so the matcher ski…

Dangling fetchAxios

high System graph api Wiring conf 1.00 Dangling fetch: POST /api/auth/register (frontend/src/services/auth.service.ts:70)

`frontend/src/services/auth.service.ts:70` calls `POST /api/auth/register` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: axios Normalized path used for matching: `/auth/register` If this points at an external API, prefix it with `https://` so the matcher sk…

Dangling fetchAxios

high System graph api Wiring conf 1.00 Dangling fetch: POST /api/auth/verify-email (frontend/src/services/auth.service.ts:150)

`frontend/src/services/auth.service.ts:150` calls `POST /api/auth/verify-email` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: axios Normalized path used for matching: `/auth/verify-email` If this points at an external API, prefix it with `https://` so the m…

Dangling fetchAxios

high System graph api Wiring conf 1.00 Dangling fetch: POST https://challenges.cloudflare.com/turnstile/v0/siteverify (backend/src/middleware/turnstile.ts:36)

`backend/src/middleware/turnstile.ts:36` calls `POST https://challenges.cloudflare.com/turnstile/v0/siteverify` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/challenges.cloudflare.com/turnstile/v0/siteverify…

Dangling fetchFetch

high System graph api Wiring conf 1.00 Dangling fetch: POST https://www.google-analytics.com/mp/collect?measurement_id=${measurementId}&api_secret=${apiSecret} (backend/src/services/analytics.service.ts:29)

`backend/src/services/analytics.service.ts:29` calls `POST https://www.google-analytics.com/mp/collect?measurement_id=${measurementId}&api_secret=${apiSecret}` but no backend route matches that path. This is a runtime 404 waiting to happen. Tool: fetch Normalized path used for matching: `/https:/w…

Dangling fetchFetch

high System graph cicd CI/CD security conf 1.00 2 occurrences GitHub Action tracks a moving branch

aquasecurity/trivy-action@master can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

lines 182, 193

.github/workflows/ci.yml:182, 193 (2 hits)

CI/CD securitySupply chainGithub actions

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — frontend/src/app/admin/jobs/[id]/page.tsx:632

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — frontend/src/app/admin/tickets/[id]/page.tsx:216

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — frontend/src/app/candidate/jobs/[id]/page.tsx:291

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — frontend/src/app/companies/[slug]/page.tsx:374

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — frontend/src/app/employer/jobs/[id]/page.tsx:491

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — frontend/src/app/employer/jobs/new/page.tsx:1465

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — frontend/src/app/layout.tsx:235

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — frontend/src/app/pricing/[slug]/page.tsx:188

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — frontend/src/app/super-admin/billing/coupons/[id]/page.tsx:253

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — frontend/src/app/super-admin/billing/plans/[id]/page.tsx:302

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — frontend/src/app/super-admin/jobs/[id]/page.tsx:638

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — frontend/src/components/job-search/PublicJobDetailView.tsx:254

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph frontend Frontend quality conf 1.00 `dangerouslySetInnerHTML` used in a React component — frontend/src/components/seo/JsonLd.tsx:8

Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library. Why: OWASP basics. Already partially flagged by the security analyzer. Rule id: fq.dangerous-html

Fq dangerous html

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — backend/src/config/razorpay.ts:243

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — backend/src/jobs/image-processing.worker.ts:37

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — backend/src/kafka/event-router.ts:16

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — backend/src/middleware/turnstile.ts:36

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — backend/src/services/geocoding.service.ts:85

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — backend/src/services/public-stats.service.ts:209

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/public/sw.js:84

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/app/api/csrf-token/route.ts:22

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/app/api/proxy/[...path]/route.ts:84

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/app/auth/callback/page.tsx:50

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/app/companies/[slug]/reviews/ReviewsClient.tsx:8

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/app/employer/candidates/page.tsx:902

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/app/sitemap.ts:689

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/components/ui/ServerAutoSuggest.tsx:12

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — frontend/src/components/ui/ServerSuggestionInput.tsx:14

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Placeholder conf 1.00 Critical user flow still appears backed by mock or placeholder data

A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded.

Mock dataCritical flowGenerated repo pattern

medium System graph cicd CI/CD security conf 1.00 8 occurrences GitHub Action is tag-pinned rather than SHA-pinned

docker/login-action@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

3 files, 8 locations

.github/workflows/cd.yml:64, 71, 74, 99, 106, 119 (6 hits)

.github/workflows/deploy-k8s.yml:165

.github/workflows/deploy-vps.yml:165

CI/CD securitySupply chainGithub actions

medium System graph cicd CI/CD security conf 1.00 GitHub Actions workflow grants broad write permissions

CI tokens with write permissions increase blast radius when an action, dependency, or PR workflow is compromised. Prefer job-level least-privilege permissions.

.github/workflows/cd.yml CI/CD securitySupply chainGithub actions

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in frontend/src/app/admin/jobs/[id]/page.tsx:632

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

frontend/src/app/admin/jobs/[id]/page.tsx:632 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in frontend/src/app/admin/tickets/[id]/page.tsx:216

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

frontend/src/app/admin/tickets/[id]/page.tsx:216 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in frontend/src/app/candidate/jobs/[id]/page.tsx:291

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

frontend/src/app/candidate/jobs/[id]/page.tsx:291 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in frontend/src/app/companies/[slug]/page.tsx:374

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

frontend/src/app/companies/[slug]/page.tsx:374 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in frontend/src/app/employer/jobs/[id]/page.tsx:491

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

frontend/src/app/employer/jobs/[id]/page.tsx:491 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in frontend/src/app/employer/jobs/new/page.tsx:1465

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

frontend/src/app/employer/jobs/new/page.tsx:1465 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in frontend/src/app/layout.tsx:235

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

frontend/src/app/layout.tsx:235 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in frontend/src/app/pricing/[slug]/page.tsx:188

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

frontend/src/app/pricing/[slug]/page.tsx:188 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in frontend/src/app/super-admin/billing/coupons/[id]/page.tsx:253

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

frontend/src/app/super-admin/billing/coupons/[id]/page.tsx:253 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in frontend/src/app/super-admin/billing/plans/[id]/page.tsx:302

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

frontend/src/app/super-admin/billing/plans/[id]/page.tsx:302 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in frontend/src/app/super-admin/jobs/[id]/page.tsx:638

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

frontend/src/app/super-admin/jobs/[id]/page.tsx:638 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'dangerous_innerhtml' in frontend/src/components/job-search/PublicJobDetailView.tsx:254

Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible.

frontend/src/components/job-search/PublicJobDetailView.tsx:254 Dangerous innerhtml

medium System graph security security conf 1.00 Insecure pattern 'local_storage_auth_token' in frontend/src/components/auth/RoleLoginForm.tsx:59

Found a known-risky pattern (local_storage_auth_token). Review and replace if possible.

frontend/src/components/auth/RoleLoginForm.tsx:59 Local storage auth token

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in backend/src/jobs/backup.worker.ts:2

Found a known-risky pattern (node_child_process). Review and replace if possible.

backend/src/jobs/backup.worker.ts:2 Node child process

medium System graph security security conf 1.00 Insecure pattern 'node_child_process' in frontend/src/app/sitemap.ts:1

Found a known-risky pattern (node_child_process). Review and replace if possible.

frontend/src/app/sitemap.ts:1 Node child process

medium System graph quality Placeholder conf 1.00 Placeholder or mock-heavy implementation detected

Found 886 placeholder/mock markers across 161 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data.

Mock dataIncompleteGenerated repo pattern

medium System graph network Security conf 1.00 Privileged port 143 in use

Port 143 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

infra/k8s/security/network-policies/roundcube-policy.yaml Ports

medium System graph network Security conf 1.00 Privileged port 465 in use

Port 465 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

infra/k8s/security/network-policies/backend-policy.yaml Ports

medium System graph network Security conf 1.00 Privileged port 587 in use

Port 587 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

infra/k8s/security/network-policies/backend-policy.yaml Ports

medium System graph network Security conf 1.00 Privileged port 993 in use

Port 993 is privileged (<1024). Make sure the service runs with the right caps or front it with a non-privileged port via a load balancer.

infra/k8s/security/network-policies/roundcube-policy.yaml Ports

medium System graph quality Placeholder conf 1.00 Runtime service client appears to use placeholder configuration

A runtime source file appears to wire Supabase/Firebase/AI/payment-style clients to placeholder URLs, keys, or fallback values. In the Fable corpus this often means the UI/API shape is present while the backend service is not actually configured.

Runtime configService clientGenerated repo pattern

medium System graph quality Tests conf 1.00 Very low test-to-source ratio

9 test file(s) for 1159 source file(s) (ratio 0.01). Consider adding integration or unit tests for critical paths.

Coverage

low System graph quality Integrity conf 1.00 10 env vars used in code but missing from .env.example

Drift between code and config docs. The first few: `CI`, `CONTAINER`, `KUBERNETES_SERVICE_HOST`, `LOG_AGGREGATION_TOKEN`, `LOG_AGGREGATION_URL`, `NEXT_PUBLIC_MAINTENANCE_BYPASS_KEY`, `NEXT_PUBLIC_OTEL_COLLECTOR_URL`, `NEXT_RUNTIME` + 2 more. Add them (with a placeholder/comment) to .env.example so …

config drift

low System graph quality Debug conf 1.00 Debug logging residue appears in source files

Found 109 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.

CleanupRepo hardeningGenerated repo pattern

low System graph cicd CI/CD security conf 1.00 4 occurrences GitHub Action is tag-pinned rather than SHA-pinned

actions/setup-node@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

lines 26, 75, 145, 211

.github/workflows/ci.yml:26, 75, 145, 211 (4 hits)

CI/CD securitySupply chainGithub actions

low System graph cicd CI/CD security conf 1.00 package.json defines install-time lifecycle scripts

preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access.

package.json CI/CD securitySupply chainNpm

low System graph cicd CI/CD security conf 1.00 package.json defines install-time lifecycle scripts

preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access.

backend/package.json CI/CD securitySupply chainNpm

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — _expand_script_base.js:16

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

Fq console leak

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — _gen_seed.js:126

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

Fq console leak

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — _patch_cert.js:7

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

Fq console leak

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — backend/prisma/seeds/seed.ts:6

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

Fq console leak

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — backend/src/config/service-status.ts:171

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

Fq console leak

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — backend/src/config/telemetry.ts:16

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

Fq console leak

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — backend/src/instrument.ts:59

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

Fq console leak

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — backend/src/scripts/backfill-cloud-talent.ts:29

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

Fq console leak

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — backend/src/scripts/create-talent-tenant.ts:28

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

Fq console leak

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — backend/src/scripts/reindex-all.ts:14

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

Fq console leak

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — backend/src/scripts/seed-dev.ts:40

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

Fq console leak

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — backend/src/scripts/seed-super-admin.ts:20

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

Fq console leak

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — backend/src/scripts/verify-cloud-talent.ts:19

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

Fq console leak

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — backend/test-db.js:5

Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable. Why: Hygiene — easy to leak debug output. Rule id: fq.console-leak

Fq console leak

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/config/otp

`backend/src/app.ts` declares `GET /api/config/otp` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: GET /api/config/security

`backend/src/app.ts` declares `GET /api/config/security` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/csp-report

`backend/src/app.ts` declares `POST /api/csp-report` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: POST /api/v1/webhooks/razorpay

`backend/src/app.ts` declares `POST /api/v1/webhooks/razorpay` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /admin

`backend/src/app.ts` declares `USE /admin` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /analytics

`backend/src/app.ts` declares `USE /analytics` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /api

`backend/src/app.ts` declares `USE /api` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /api-docs

`backend/src/app.ts` declares `USE /api-docs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /auth

`backend/src/app.ts` declares `USE /auth` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /billing

`backend/src/app.ts` declares `USE /billing` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /billing/coupons

`backend/src/app.ts` declares `USE /billing/coupons` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /billing/invoices

`backend/src/app.ts` declares `USE /billing/invoices` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /billing/orders

`backend/src/app.ts` declares `USE /billing/orders` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /billing/quotes

`backend/src/app.ts` declares `USE /billing/quotes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /billing/subscriptions

`backend/src/app.ts` declares `USE /billing/subscriptions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /billing/upgrade

`backend/src/app.ts` declares `USE /billing/upgrade` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /candidate-lists

`backend/src/app.ts` declares `USE /candidate-lists` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /candidates

`backend/src/app.ts` declares `USE /candidates` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /contact

`backend/src/app.ts` declares `USE /contact` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /devices

`backend/src/app.ts` declares `USE /devices` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /drafts

`backend/src/app.ts` declares `USE /drafts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /employer/team

`backend/src/app.ts` declares `USE /employer/team` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /employers

`backend/src/app.ts` declares `USE /employers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /feature-flags

`backend/src/app.ts` declares `USE /feature-flags` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /internal/alertmanager

`backend/src/app.ts` declares `USE /internal/alertmanager` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /jobs

`backend/src/app.ts` declares `USE /jobs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /notifications

`backend/src/app.ts` declares `USE /notifications` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /plans

`backend/src/app.ts` declares `USE /plans` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /public

`backend/src/app.ts` declares `USE /public` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /recommendations

`backend/src/app.ts` declares `USE /recommendations` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /reports

`backend/src/app.ts` declares `USE /reports` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /saved-candidates

`backend/src/app.ts` declares `USE /saved-candidates` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /saved-searches

`backend/src/app.ts` declares `USE /saved-searches` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /search

`backend/src/app.ts` declares `USE /search` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /sessions

`backend/src/app.ts` declares `USE /sessions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /super-admin

`backend/src/app.ts` declares `USE /super-admin` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /super-admin/billing

`backend/src/app.ts` declares `USE /super-admin/billing` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /super-admin/coupons

`backend/src/app.ts` declares `USE /super-admin/coupons` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /super-admin/entitlements

`backend/src/app.ts` declares `USE /super-admin/entitlements` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /super-admin/invoices

`backend/src/app.ts` declares `USE /super-admin/invoices` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /super-admin/plans

`backend/src/app.ts` declares `USE /super-admin/plans` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /super-admin/quotes

`backend/src/app.ts` declares `USE /super-admin/quotes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /super-admin/teams

`backend/src/app.ts` declares `USE /super-admin/teams` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /super-admin/vendors

`backend/src/app.ts` declares `USE /super-admin/vendors` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /tickets

`backend/src/app.ts` declares `USE /tickets` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /vendor

`backend/src/app.ts` declares `USE /vendor` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /vendors

`backend/src/app.ts` declares `USE /vendors` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /verifications

`backend/src/app.ts` declares `USE /verifications` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /webauthn

`backend/src/app.ts` declares `USE /webauthn` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph api Wiring conf 1.00 Unused endpoint: USE /webhooks

`backend/src/app.ts` declares `USE /webhooks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.

Unused endpoint

low System graph quality Complexity conf 1.00 Very large file: backend/src/services/auth.service.ts (1671 lines)