{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-7ce5454f7770024b", "name": "TODO/FIXME marker in shipping code \u2014 server.js:565", "shortDescription": {"text": "TODO/FIXME marker in shipping code \u2014 server.js:565"}, "fullDescription": {"text": "Track in /reviews or /issues, not as a code comment that rots.\n\nWhy: Drift control \u2014 shouldn't be the same as Quality TODO scanner.\nRule id: fq.todo-marker"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-46b506d9d03a8e65", "name": "Stray `console.log` in TS/JS \u2014 server.js:94", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 server.js:94"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-792398356ab9fd21", "name": "Possible secret in server.js", "shortDescription": {"text": "Possible secret in server.js"}, "fullDescription": {"text": "Detected pattern matching private_key. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-f500c017b098d8c3", "name": "Insecure pattern 'private_key_in_repo' in server.js:7", "shortDescription": {"text": "Insecure pattern 'private_key_in_repo' in server.js:7"}, "fullDescription": {"text": "Found a known-risky pattern (private_key_in_repo). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-17c37f81ba23d8d1", "name": "Very large file: server.js (1474 lines)", "shortDescription": {"text": "Very large file: server.js (1474 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-faccb9061e9b52a0", "name": "No README detected", "shortDescription": {"text": "No README detected"}, "fullDescription": {"text": "No README file was found. Generated repos without README context are hard to operate, validate, or safely hand off."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 27 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, operator-readme. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-91408899374476a2", "name": "Commented-code block (6 lines) in server.js:33", "shortDescription": {"text": "Commented-code block (6 lines) in server.js:33"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-319e66a630e14977", "name": "2 env vars used in code but missing from .env.example", "shortDescription": {"text": "2 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `FIREBASE_STORAGE_BUCKET`, `VITE_FIREBASE_STORAGE_BUCKET`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-67a441a5ad9f0164", "name": "Dangling fetch: POST https://api.openai.com/v1/chat/completions (AlixAIProfile.js:173)", "shortDescription": {"text": "Dangling fetch: POST https://api.openai.com/v1/chat/completions (AlixAIProfile.js:173)"}, "fullDescription": {"text": "`AlixAIProfile.js:173` calls `POST https://api.openai.com/v1/chat/completions` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: axios\nNormalized path used for matching: `/https:/api.openai.com/v1/chat/completions`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1dfcc9529630142e", "name": "Unused endpoint: POST /webhooks/stripe", "shortDescription": {"text": "Unused endpoint: POST /webhooks/stripe"}, "fullDescription": {"text": "`server.js` declares `POST /webhooks/stripe` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`server.js` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb8cdd3f4d307d6c", "name": "Unused endpoint: POST /send-code", "shortDescription": {"text": "Unused endpoint: POST /send-code"}, "fullDescription": {"text": "`server.js` declares `POST /send-code` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0b0ea8f73a6e2796", "name": "Unused endpoint: POST /verify-code", "shortDescription": {"text": "Unused endpoint: POST /verify-code"}, "fullDescription": {"text": "`server.js` declares `POST /verify-code` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-463318b9dc980cff", "name": "Unused endpoint: POST /create-magic-link", "shortDescription": {"text": "Unused endpoint: POST /create-magic-link"}, "fullDescription": {"text": "`server.js` declares `POST /create-magic-link` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea08a2b5c1d0fddf", "name": "Unused endpoint: POST /verify-token", "shortDescription": {"text": "Unused endpoint: POST /verify-token"}, "fullDescription": {"text": "`server.js` declares `POST /verify-token` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a08ca03dee98e505", "name": "Unused endpoint: POST /notify-team-campaign", "shortDescription": {"text": "Unused endpoint: POST /notify-team-campaign"}, "fullDescription": {"text": "`server.js` declares `POST /notify-team-campaign` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86f4172afb1b0ad5", "name": "Unused endpoint: POST /create-checkout-session", "shortDescription": {"text": "Unused endpoint: POST /create-checkout-session"}, "fullDescription": {"text": "`server.js` declares `POST /create-checkout-session` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4cd81a5d4f663b33", "name": "Unused endpoint: OPTIONS /api/stripe/*", "shortDescription": {"text": "Unused endpoint: OPTIONS /api/stripe/*"}, "fullDescription": {"text": "`server.js` declares `OPTIONS /api/stripe/*` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7ae07eb1980966d9", "name": "Unused endpoint: POST /api/stripe/create-checkout-session", "shortDescription": {"text": "Unused endpoint: POST /api/stripe/create-checkout-session"}, "fullDescription": {"text": "`server.js` declares `POST /api/stripe/create-checkout-session` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-937a1de090c175c0", "name": "Unused endpoint: POST /api/stripe/charge-balance", "shortDescription": {"text": "Unused endpoint: POST /api/stripe/charge-balance"}, "fullDescription": {"text": "`server.js` declares `POST /api/stripe/charge-balance` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-071a1f1c72d180bb", "name": "Unused endpoint: POST /api/stripe/refund-deposit", "shortDescription": {"text": "Unused endpoint: POST /api/stripe/refund-deposit"}, "fullDescription": {"text": "`server.js` declares `POST /api/stripe/refund-deposit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-16108f8e0b851f51", "name": "Unused endpoint: POST /alix", "shortDescription": {"text": "Unused endpoint: POST /alix"}, "fullDescription": {"text": "`server.js` declares `POST /alix` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0ed79d969312bc81", "name": "Unused endpoint: POST /crons/trigger-standup", "shortDescription": {"text": "Unused endpoint: POST /crons/trigger-standup"}, "fullDescription": {"text": "`server.js` declares `POST /crons/trigger-standup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee2ef358af721518", "name": "Unused endpoint: POST /crons/trigger-work-schedule", "shortDescription": {"text": "Unused endpoint: POST /crons/trigger-work-schedule"}, "fullDescription": {"text": "`server.js` declares `POST /crons/trigger-work-schedule` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0a3e57f8f9011d", "name": "Unused endpoint: POST /crons/trigger-pulse", "shortDescription": {"text": "Unused endpoint: POST /crons/trigger-pulse"}, "fullDescription": {"text": "`server.js` declares `POST /crons/trigger-pulse` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86248ace4a450e2f", "name": "Unused endpoint: POST /notify/dm", "shortDescription": {"text": "Unused endpoint: POST /notify/dm"}, "fullDescription": {"text": "`server.js` declares `POST /notify/dm` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b3d8fcd4cbee995a", "name": "Unused endpoint: POST /upload-logo-from-url", "shortDescription": {"text": "Unused endpoint: POST /upload-logo-from-url"}, "fullDescription": {"text": "`server.js` declares `POST /upload-logo-from-url` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bb48f1f158f32c26", "name": "Unused endpoint: POST /upload-strip-image", "shortDescription": {"text": "Unused endpoint: POST /upload-strip-image"}, "fullDescription": {"text": "`server.js` declares `POST /upload-strip-image` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/28230"}, "properties": {"repository": "nick-aply/teamfeed-server", "repoUrl": "https://github.com/nick-aply/teamfeed-server", "branch": "main"}, "results": [{"ruleId": "scanner-7ce5454f7770024b", "level": "none", "message": {"text": "TODO/FIXME marker in shipping code \u2014 server.js:565"}, "properties": {"repobilityId": "44640b9f14a23bd6", "scanner": "scanner-primary", "fingerprint": "7ce5454f7770024b", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["frontend-quality", "fq.todo-marker"]}}, {"ruleId": "scanner-46b506d9d03a8e65", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 server.js:94"}, "properties": {"repobilityId": "a9deebb5fdc93edc", "scanner": "scanner-primary", "fingerprint": "46b506d9d03a8e65", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-792398356ab9fd21", "level": "error", "message": {"text": "Possible secret in server.js"}, "properties": {"repobilityId": "8cf3467e972bc091", "scanner": "scanner-primary", "fingerprint": "792398356ab9fd21", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.js"}, "region": {"startLine": 6}}}]}, {"ruleId": "scanner-f500c017b098d8c3", "level": "error", "message": {"text": "Insecure pattern 'private_key_in_repo' in server.js:7"}, "properties": {"repobilityId": "12a86e50516d5ee1", "scanner": "scanner-primary", "fingerprint": "f500c017b098d8c3", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["owasp", "private_key_in_repo"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.js"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-17c37f81ba23d8d1", "level": "note", "message": {"text": "Very large file: server.js (1474 lines)"}, "properties": {"repobilityId": "1479ba50e708c5c1", "scanner": "scanner-primary", "fingerprint": "17c37f81ba23d8d1", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "dfa915f3b964a64e", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-faccb9061e9b52a0", "level": "note", "message": {"text": "No README detected"}, "properties": {"repobilityId": "d3139551e71f21c1", "scanner": "scanner-primary", "fingerprint": "faccb9061e9b52a0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["docs", "readme", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "cc63772164e94a91", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "7f58e849b8760d6b", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "2f8648adeab84d86", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-91408899374476a2", "level": "none", "message": {"text": "Commented-code block (6 lines) in server.js:33"}, "properties": {"repobilityId": "d89a7459307c9594", "scanner": "scanner-primary", "fingerprint": "91408899374476a2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-319e66a630e14977", "level": "none", "message": {"text": "2 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "d838d1fc5d8231c9", "scanner": "scanner-primary", "fingerprint": "319e66a630e14977", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-67a441a5ad9f0164", "level": "error", "message": {"text": "Dangling fetch: POST https://api.openai.com/v1/chat/completions (AlixAIProfile.js:173)"}, "properties": {"repobilityId": "b3134c79dc92eec6", "scanner": "scanner-primary", "fingerprint": "67a441a5ad9f0164", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "axios"]}}, {"ruleId": "scanner-1dfcc9529630142e", "level": "note", "message": {"text": "Unused endpoint: POST /webhooks/stripe"}, "properties": {"repobilityId": "60eba82d1949a4b9", "scanner": "scanner-primary", "fingerprint": "1dfcc9529630142e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "9b883326e67da4e4", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cb8cdd3f4d307d6c", "level": "note", "message": {"text": "Unused endpoint: POST /send-code"}, "properties": {"repobilityId": "f0418a73a9b10dba", "scanner": "scanner-primary", "fingerprint": "cb8cdd3f4d307d6c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0b0ea8f73a6e2796", "level": "note", "message": {"text": "Unused endpoint: POST /verify-code"}, "properties": {"repobilityId": "24450eab7c4b662c", "scanner": "scanner-primary", "fingerprint": "0b0ea8f73a6e2796", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-463318b9dc980cff", "level": "note", "message": {"text": "Unused endpoint: POST /create-magic-link"}, "properties": {"repobilityId": "5a747d7f067b370a", "scanner": "scanner-primary", "fingerprint": "463318b9dc980cff", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ea08a2b5c1d0fddf", "level": "note", "message": {"text": "Unused endpoint: POST /verify-token"}, "properties": {"repobilityId": "586522524540bf60", "scanner": "scanner-primary", "fingerprint": "ea08a2b5c1d0fddf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a08ca03dee98e505", "level": "note", "message": {"text": "Unused endpoint: POST /notify-team-campaign"}, "properties": {"repobilityId": "eaeb928a3c5a6edf", "scanner": "scanner-primary", "fingerprint": "a08ca03dee98e505", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-86f4172afb1b0ad5", "level": "note", "message": {"text": "Unused endpoint: POST /create-checkout-session"}, "properties": {"repobilityId": "17ece608eada033d", "scanner": "scanner-primary", "fingerprint": "86f4172afb1b0ad5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4cd81a5d4f663b33", "level": "note", "message": {"text": "Unused endpoint: OPTIONS /api/stripe/*"}, "properties": {"repobilityId": "dd2ba00a0f43df28", "scanner": "scanner-primary", "fingerprint": "4cd81a5d4f663b33", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7ae07eb1980966d9", "level": "note", "message": {"text": "Unused endpoint: POST /api/stripe/create-checkout-session"}, "properties": {"repobilityId": "3a817df356bcd889", "scanner": "scanner-primary", "fingerprint": "7ae07eb1980966d9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-937a1de090c175c0", "level": "note", "message": {"text": "Unused endpoint: POST /api/stripe/charge-balance"}, "properties": {"repobilityId": "b86ab33e72218f81", "scanner": "scanner-primary", "fingerprint": "937a1de090c175c0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-071a1f1c72d180bb", "level": "note", "message": {"text": "Unused endpoint: POST /api/stripe/refund-deposit"}, "properties": {"repobilityId": "8a54a758282ddcbd", "scanner": "scanner-primary", "fingerprint": "071a1f1c72d180bb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-16108f8e0b851f51", "level": "note", "message": {"text": "Unused endpoint: POST /alix"}, "properties": {"repobilityId": "8aabae4232b438ca", "scanner": "scanner-primary", "fingerprint": "16108f8e0b851f51", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0ed79d969312bc81", "level": "note", "message": {"text": "Unused endpoint: POST /crons/trigger-standup"}, "properties": {"repobilityId": "25badaaa2ded3c79", "scanner": "scanner-primary", "fingerprint": "0ed79d969312bc81", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ee2ef358af721518", "level": "note", "message": {"text": "Unused endpoint: POST /crons/trigger-work-schedule"}, "properties": {"repobilityId": "3a916f7d6a7f8309", "scanner": "scanner-primary", "fingerprint": "ee2ef358af721518", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2d0a3e57f8f9011d", "level": "note", "message": {"text": "Unused endpoint: POST /crons/trigger-pulse"}, "properties": {"repobilityId": "ca23198cb284fc6c", "scanner": "scanner-primary", "fingerprint": "2d0a3e57f8f9011d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-86248ace4a450e2f", "level": "note", "message": {"text": "Unused endpoint: POST /notify/dm"}, "properties": {"repobilityId": "82e1859ef7ede893", "scanner": "scanner-primary", "fingerprint": "86248ace4a450e2f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b3d8fcd4cbee995a", "level": "note", "message": {"text": "Unused endpoint: POST /upload-logo-from-url"}, "properties": {"repobilityId": "932493eb4f618602", "scanner": "scanner-primary", "fingerprint": "b3d8fcd4cbee995a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bb48f1f158f32c26", "level": "note", "message": {"text": "Unused endpoint: POST /upload-strip-image"}, "properties": {"repobilityId": "e3af44f8e3addd0b", "scanner": "scanner-primary", "fingerprint": "bb48f1f158f32c26", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}