{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-e3e9805e3c426b5d", "name": "Stray `console.log` in TS/JS \u2014 apps/api/scripts/migrate-sub-account-system.ts:36", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/scripts/migrate-sub-account-system.ts:36"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0920641eda3a12b2", "name": "Stray `console.log` in TS/JS \u2014 apps/api/scripts/mock-merchant-flow.ts:221", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/scripts/mock-merchant-flow.ts:221"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-129fa48544cc13b7", "name": "Stray `console.log` in TS/JS \u2014 apps/api/scripts/probe-returns.ts:28", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/scripts/probe-returns.ts:28"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-04a00b8261a67e26", "name": "Stray `console.log` in TS/JS \u2014 apps/api/scripts/gen-stock-test-import.ts:29", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/scripts/gen-stock-test-import.ts:29"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0f3b457451afd25b", "name": "Stray `console.log` in TS/JS \u2014 apps/api/src/index.ts:15", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/index.ts:15"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3db15611cecf5e58", "name": "Stray `console.log` in TS/JS \u2014 apps/api/src/platform/shopee/shopee.adapter.ts:657", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/platform/shopee/shopee.adapter.ts:657"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8ddb8c7846b233fb", "name": "Stray `console.log` in TS/JS \u2014 apps/api/src/platform/tiktok/tiktok.adapter.ts:15", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/platform/tiktok/tiktok.adapter.ts:15"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0212d5357ca7e778", "name": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/restocking.worker.ts:6", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/restocking.worker.ts:6"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-331a441d46ac1a32", "name": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/sync-orders.worker.ts:31", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/sync-orders.worker.ts:31"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3e24f77cc4cf0300", "name": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/etl.worker.ts:19", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/etl.worker.ts:19"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-363603ff4a99dabf", "name": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/index.ts:13", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/index.ts:13"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3d4809dafb2207a4", "name": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/start.ts:13", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/start.ts:13"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-15e874dbe3460d78", "name": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/sync-products.worker.ts:33", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/sync-products.worker.ts:33"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-631181b619989602", "name": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/scheduler.ts:25", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/scheduler.ts:25"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4062c9053ee0fb35", "name": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/refresh-tokens.worker.ts:12", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/refresh-tokens.worker.ts:12"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-46b67e12b7e92d01", "name": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/sync-messages.worker.ts:4", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/sync-messages.worker.ts:4"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e4cf130ecdcbdce", "name": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/sync-returns.worker.ts:19", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/sync-returns.worker.ts:19"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3413052f0708b0d6", "name": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/sync-ads.worker.ts:6", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/sync-ads.worker.ts:6"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-923d7873b9aee0d2", "name": "Stray `console.log` in TS/JS \u2014 apps/api/src/modules/shops/shop.routes.ts:136", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/modules/shops/shop.routes.ts:136"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b67d2eaa53257bba", "name": "Stray `console.log` in TS/JS \u2014 apps/api/src/modules/webhooks/tiktok.webhook.ts:47", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/modules/webhooks/tiktok.webhook.ts:47"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4d7e2b6bb18ab806", "name": "Stray `console.log` in TS/JS \u2014 apps/api/src/modules/webhooks/shopee.webhook.ts:89", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/modules/webhooks/shopee.webhook.ts:89"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0b80fc0f22362eae", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/src/components/support/SupportWidget.tsx:576", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/src/components/support/SupportWidget.tsx:576"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b0b7a32681400205", "name": "Stray `console.log` in TS/JS \u2014 apps/web/src/modules/orders/OrdersPage.tsx:269", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/web/src/modules/orders/OrdersPage.tsx:269"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a1aadb99bccd640a", "name": "Stray `console.log` in TS/JS \u2014 apps/agent-worker/src/index.ts:35", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/agent-worker/src/index.ts:35"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0b492fb26fd71297", "name": "Stray `console.log` in TS/JS \u2014 apps/agent-worker/src/notify-listener.ts:66", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 apps/agent-worker/src/notify-listener.ts:66"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9075c66b9f9eb176", "name": "Stray `console.log` in TS/JS \u2014 packages/db/src/seed.ts:11", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 packages/db/src/seed.ts:11"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d9980d9104825b19", "name": "Dockerfile runs as root: apps/api/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: apps/api/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3d70dcd36b57a39a", "name": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5d9d7a217ad79c47", "name": "Insecure pattern 'dangerous_innerhtml' in apps/web/src/components/support/SupportWidget.tsx:576", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/src/components/support/SupportWidget.tsx:576"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0ab14b035691cf86", "name": "Possible secret in apps/web/src/locales/en.ts", "shortDescription": {"text": "Possible secret in apps/web/src/locales/en.ts"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-a7d5855cee3622a5", "name": "Insecure pattern 'node_child_process' in apps/agent-worker/src/claude-runner.ts:1", "shortDescription": {"text": "Insecure pattern 'node_child_process' in apps/agent-worker/src/claude-runner.ts:1"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8a761611c86a9926", "name": "Insecure pattern 'node_child_process' in apps/agent-worker/src/rpc/recent-errors.mjs:13", "shortDescription": {"text": "Insecure pattern 'node_child_process' in apps/agent-worker/src/rpc/recent-errors.mjs:13"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-918083d82e543cd6", "name": "Very large file: apps/web/src/modules/orders/OrdersPage.tsx (2261 lines)", "shortDescription": {"text": "Very large file: apps/web/src/modules/orders/OrdersPage.tsx (2261 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "1 test file(s) for 114 source file(s) (ratio 0.01). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b06b8d86f24c77f9", "name": "Node manifest has dependencies but no lockfile: apps/api/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/api/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4a9eb7dc7c6e3880", "name": "Node manifest has dependencies but no lockfile: apps/web/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/web/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-55dfb3cf01f307f5", "name": "Node manifest has dependencies but no lockfile: apps/agent-worker/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: apps/agent-worker/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2699d5f16ae11282", "name": "Node manifest has dependencies but no lockfile: packages/shared/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/shared/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7b16ae2bd0fca524", "name": "Node manifest has dependencies but no lockfile: packages/db/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: packages/db/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 122 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 61 placeholder/mock markers across 20 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, tests, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci, tests, lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-d35e6c700908a3c4", "name": "Commented-code block (5 lines) in apps/api/scripts/gen-stock-test-import.ts:1", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/scripts/gen-stock-test-import.ts:1"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-db4a217b15098e92", "name": "Legacy-named symbol `stock_info_v2` in apps/api/src/platform/shopee/shopee.adapter.ts:269", "shortDescription": {"text": "Legacy-named symbol `stock_info_v2` in apps/api/src/platform/shopee/shopee.adapter.ts:269"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49a7f0b9fdfa2dd6", "name": "Commented-code block (6 lines) in apps/api/src/platform/shopee/shopee.adapter.ts:461", "shortDescription": {"text": "Commented-code block (6 lines) in apps/api/src/platform/shopee/shopee.adapter.ts:461"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-9169cf50fe3e9ce7", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/platform/shopee/shopee.adapter.ts:55", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/platform/shopee/shopee.adapter.ts:55"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6b62896ae11c3a27", "name": "Commented-code block (5 lines) in apps/api/src/platform/tiktok/tiktok.adapter.ts:936", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/src/platform/tiktok/tiktok.adapter.ts:936"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-89c58804a10f4772", "name": "Commented-code block (6 lines) in apps/api/src/workers/sync-orders.worker.ts:180", "shortDescription": {"text": "Commented-code block (6 lines) in apps/api/src/workers/sync-orders.worker.ts:180"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-ed46cde0f54e1308", "name": "Commented-code block (6 lines) in apps/api/src/modules/inventory/inventory.routes.ts:181", "shortDescription": {"text": "Commented-code block (6 lines) in apps/api/src/modules/inventory/inventory.routes.ts:181"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-82008673d6149562", "name": "Commented-code block (5 lines) in apps/api/src/modules/inventory/inventory.service.ts:430", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/src/modules/inventory/inventory.service.ts:430"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8f6d7c420505005e", "name": "Commented-code block (6 lines) in apps/api/src/modules/orders/order.routes.ts:606", "shortDescription": {"text": "Commented-code block (6 lines) in apps/api/src/modules/orders/order.routes.ts:606"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-fd8c55a9f28dd041", "name": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/modules/orders/order.routes.ts:860", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/modules/orders/order.routes.ts:860"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ee196705716462ae", "name": "Commented-code block (6 lines) in apps/api/src/modules/returns/returns.routes.ts:48", "shortDescription": {"text": "Commented-code block (6 lines) in apps/api/src/modules/returns/returns.routes.ts:48"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f0b5ea7ec94a18b2", "name": "Commented-code block (6 lines) in apps/api/src/modules/support/support.routes.ts:35", "shortDescription": {"text": "Commented-code block (6 lines) in apps/api/src/modules/support/support.routes.ts:35"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6714dc6c054bc9b3", "name": "Commented-code block (5 lines) in apps/api/src/modules/webhooks/shopee.webhook.ts:6", "shortDescription": {"text": "Commented-code block (5 lines) in apps/api/src/modules/webhooks/shopee.webhook.ts:6"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-774b36d3a6c70e06", "name": "Commented-code block (8 lines) in apps/web/src/modules/orders/OrdersPage.tsx:50", "shortDescription": {"text": "Commented-code block (8 lines) in apps/web/src/modules/orders/OrdersPage.tsx:50"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-add81eb1c2857090", "name": "Commented-code block (5 lines) in apps/web/src/modules/admin/AuditPage.tsx:36", "shortDescription": {"text": "Commented-code block (5 lines) in apps/web/src/modules/admin/AuditPage.tsx:36"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b64c60806a6ae481", "name": "Commented-code block (5 lines) in apps/agent-worker/src/manual-generator.ts:66", "shortDescription": {"text": "Commented-code block (5 lines) in apps/agent-worker/src/manual-generator.ts:66"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-275a92112b134bb2", "name": "Commented-code block (8 lines) in apps/agent-worker/src/index.ts:18", "shortDescription": {"text": "Commented-code block (8 lines) in apps/agent-worker/src/index.ts:18"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-317e6ab10ff43961", "name": "Commented-code block (6 lines) in apps/agent-worker/src/claude-runner.ts:83", "shortDescription": {"text": "Commented-code block (6 lines) in apps/agent-worker/src/claude-runner.ts:83"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-cc0f9d8e41b33b0e", "name": "11 env vars used in code but missing from .env.example", "shortDescription": {"text": "11 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `AGENT_INVESTIGATOR_TIMEOUT_MS`, `AGENT_MAX_ATTEMPTS`, `AGENT_MODEL`, `AGENT_POLL_INTERVAL_MS`, `AGENT_SANDBOX_DIR`, `AGENT_TIMEOUT_MS`, `CLAUDE_BIN`, `PORT` + 3 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-38ab5517ad3aff02", "name": "Dangling fetch: POST /api/v1/auth/refresh (apps/web/src/lib/api.ts:29)", "shortDescription": {"text": "Dangling fetch: POST /api/v1/auth/refresh (apps/web/src/lib/api.ts:29)"}, "fullDescription": {"text": "`apps/web/src/lib/api.ts:29` calls `POST /api/v1/auth/refresh` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: axios\nNormalized path used for matching: `/v1/auth/refresh`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5149a5a7fc1f238c", "name": "Unused endpoint: GET /stock", "shortDescription": {"text": "Unused endpoint: GET /stock"}, "fullDescription": {"text": "`apps/api/src/modules/inventory/inventory.routes.ts` declares `GET /stock` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-021dce2f4ebbdf3e", "name": "Unused endpoint: GET /stock/:warehouseSkuId", "shortDescription": {"text": "Unused endpoint: GET /stock/:warehouseSkuId"}, "fullDescription": {"text": "`apps/api/src/modules/inventory/inventory.routes.ts` declares `GET /stock/:warehouseSkuId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-43269e4e79c2e69e", "name": "Unused endpoint: GET /events", "shortDescription": {"text": "Unused endpoint: GET /events"}, "fullDescription": {"text": "`apps/api/src/modules/inventory/inventory.routes.ts` declares `GET /events` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-afc064028ae39ea9", "name": "Unused endpoint: GET /history", "shortDescription": {"text": "Unused endpoint: GET /history"}, "fullDescription": {"text": "`apps/api/src/modules/inventory/inventory.routes.ts` declares `GET /history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e686634beeea0bb8", "name": "Unused endpoint: GET /export", "shortDescription": {"text": "Unused endpoint: GET /export"}, "fullDescription": {"text": "`apps/api/src/modules/inventory/inventory.routes.ts` declares `GET /export` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f2735d8fd432529b", "name": "Unused endpoint: GET /import-template", "shortDescription": {"text": "Unused endpoint: GET /import-template"}, "fullDescription": {"text": "`apps/api/src/modules/inventory/inventory.routes.ts` declares `GET /import-template` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-55a555d267c47b13", "name": "Unused endpoint: POST /import/preview", "shortDescription": {"text": "Unused endpoint: POST /import/preview"}, "fullDescription": {"text": "`apps/api/src/modules/inventory/inventory.routes.ts` declares `POST /import/preview` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f59a5e88944ea3bd", "name": "Unused endpoint: POST /import/apply", "shortDescription": {"text": "Unused endpoint: POST /import/apply"}, "fullDescription": {"text": "`apps/api/src/modules/inventory/inventory.routes.ts` declares `POST /import/apply` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-54f395ebcfcd47ee", "name": "Unused endpoint: POST /import-legacy-removed", "shortDescription": {"text": "Unused endpoint: POST /import-legacy-removed"}, "fullDescription": {"text": "`apps/api/src/modules/inventory/inventory.routes.ts` declares `POST /import-legacy-removed` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fcb1b5473a4a7217", "name": "Unused endpoint: POST /adjust", "shortDescription": {"text": "Unused endpoint: POST /adjust"}, "fullDescription": {"text": "`apps/api/src/modules/inventory/inventory.routes.ts` declares `POST /adjust` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a009b1a56794f45", "name": "Unused endpoint: POST /", "shortDescription": {"text": "Unused endpoint: POST /"}, "fullDescription": {"text": "`apps/api/src/modules/inventory/inbound-shipments.routes.ts` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`apps/api/src/modules/inventory/inbound-shipments.routes.ts` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ca5756175765b49d", "name": "Unused endpoint: GET /:id", "shortDescription": {"text": "Unused endpoint: GET /:id"}, "fullDescription": {"text": "`apps/api/src/modules/inventory/inbound-shipments.routes.ts` declares `GET /:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ab772fa6de3748f1", "name": "Unused endpoint: POST /:id/confirm", "shortDescription": {"text": "Unused endpoint: POST /:id/confirm"}, "fullDescription": {"text": "`apps/api/src/modules/inventory/inbound-shipments.routes.ts` declares `POST /:id/confirm` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-42f2999bb43a2c8d", "name": "Unused endpoint: POST /:id/reject", "shortDescription": {"text": "Unused endpoint: POST /:id/reject"}, "fullDescription": {"text": "`apps/api/src/modules/inventory/inbound-shipments.routes.ts` declares `POST /:id/reject` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-85a2ef63eed77279", "name": "Unused endpoint: POST /:id/read", "shortDescription": {"text": "Unused endpoint: POST /:id/read"}, "fullDescription": {"text": "`apps/api/src/modules/notifications/notifications.routes.ts` declares `POST /:id/read` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f8d576f6bf0f5660", "name": "Unused endpoint: POST /read-all", "shortDescription": {"text": "Unused endpoint: POST /read-all"}, "fullDescription": {"text": "`apps/api/src/modules/notifications/notifications.routes.ts` declares `POST /read-all` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af6608de4c7fbf85", "name": "Unused endpoint: POST /manual", "shortDescription": {"text": "Unused endpoint: POST /manual"}, "fullDescription": {"text": "`apps/api/src/modules/orders/order.routes.ts` declares `POST /manual` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5e44d1e7d1d7afd6", "name": "Unused endpoint: POST /:id/manual-ship", "shortDescription": {"text": "Unused endpoint: POST /:id/manual-ship"}, "fullDescription": {"text": "`apps/api/src/modules/orders/order.routes.ts` declares `POST /:id/manual-ship` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a61c112b611f4bb", "name": "Unused endpoint: DELETE /:id", "shortDescription": {"text": "Unused endpoint: DELETE /:id"}, "fullDescription": {"text": "`apps/api/src/modules/orders/order.routes.ts` declares `DELETE /:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-739a007527be659d", "name": "Unused endpoint: GET /:id/images/:imageId", "shortDescription": {"text": "Unused endpoint: GET /:id/images/:imageId"}, "fullDescription": {"text": "`apps/api/src/modules/orders/order.routes.ts` declares `GET /:id/images/:imageId` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f39249a345a19765", "name": "Unused endpoint: PATCH /:id/status", "shortDescription": {"text": "Unused endpoint: PATCH /:id/status"}, "fullDescription": {"text": "`apps/api/src/modules/orders/order.routes.ts` declares `PATCH /:id/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-35ba7c5848dce371", "name": "Unused endpoint: POST /:id/merchant-confirm", "shortDescription": {"text": "Unused endpoint: POST /:id/merchant-confirm"}, "fullDescription": {"text": "`apps/api/src/modules/orders/order.routes.ts` declares `POST /:id/merchant-confirm` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5850cadf98988144", "name": "Unused endpoint: POST /:id/merchant-cancel", "shortDescription": {"text": "Unused endpoint: POST /:id/merchant-cancel"}, "fullDescription": {"text": "`apps/api/src/modules/orders/order.routes.ts` declares `POST /:id/merchant-cancel` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-93f10e2930bfbd5e", "name": "Unused endpoint: POST /:id/items/:itemId/replace-sku", "shortDescription": {"text": "Unused endpoint: POST /:id/items/:itemId/replace-sku"}, "fullDescription": {"text": "`apps/api/src/modules/orders/order.routes.ts` declares `POST /:id/items/:itemId/replace-sku` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c2ecad0833a799d7", "name": "Unused endpoint: GET /:id/shipping-label", "shortDescription": {"text": "Unused endpoint: GET /:id/shipping-label"}, "fullDescription": {"text": "`apps/api/src/modules/orders/order.routes.ts` declares `GET /:id/shipping-label` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f48aadb3a1518b0c", "name": "Unused endpoint: GET /label-proxy", "shortDescription": {"text": "Unused endpoint: GET /label-proxy"}, "fullDescription": {"text": "`apps/api/src/modules/orders/order.routes.ts` declares `GET /label-proxy` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7ce45f1f861883b0", "name": "Unused endpoint: POST /:id/run-rules", "shortDescription": {"text": "Unused endpoint: POST /:id/run-rules"}, "fullDescription": {"text": "`apps/api/src/modules/orders/order.routes.ts` declares `POST /:id/run-rules` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8d5b2b188d08ca82", "name": "Unused endpoint: PUT /:id", "shortDescription": {"text": "Unused endpoint: PUT /:id"}, "fullDescription": {"text": "`apps/api/src/modules/orders/rules.routes.ts` declares `PUT /:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-731c57f59aaca553", "name": "Unused endpoint: POST /test", "shortDescription": {"text": "Unused endpoint: POST /test"}, "fullDescription": {"text": "`apps/api/src/modules/orders/rules.routes.ts` declares `POST /test` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-87706754c816eab0", "name": "Unused endpoint: GET /shipments", "shortDescription": {"text": "Unused endpoint: GET /shipments"}, "fullDescription": {"text": "`apps/api/src/modules/logistics/logistics.routes.ts` declares `GET /shipments` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5669e9e5a31a4f25", "name": "Unused endpoint: POST /shipments", "shortDescription": {"text": "Unused endpoint: POST /shipments"}, "fullDescription": {"text": "`apps/api/src/modules/logistics/logistics.routes.ts` declares `POST /shipments` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bfd277ad277622d0", "name": "Unused endpoint: PATCH /shipments/:id", "shortDescription": {"text": "Unused endpoint: PATCH /shipments/:id"}, "fullDescription": {"text": "`apps/api/src/modules/logistics/logistics.routes.ts` declares `PATCH /shipments/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5d5060ac0de24d74", "name": "Unused endpoint: DELETE /shipments/:id", "shortDescription": {"text": "Unused endpoint: DELETE /shipments/:id"}, "fullDescription": {"text": "`apps/api/src/modules/logistics/logistics.routes.ts` declares `DELETE /shipments/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-304b6f2b403d93f7", "name": "Unused endpoint: POST /register", "shortDescription": {"text": "Unused endpoint: POST /register"}, "fullDescription": {"text": "`apps/api/src/modules/auth/auth.routes.ts` declares `POST /register` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-618721b912bad1c2", "name": "Unused endpoint: POST /login", "shortDescription": {"text": "Unused endpoint: POST /login"}, "fullDescription": {"text": "`apps/api/src/modules/auth/auth.routes.ts` declares `POST /login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7ce17d6b092a81ca", "name": "Unused endpoint: POST /refresh", "shortDescription": {"text": "Unused endpoint: POST /refresh"}, "fullDescription": {"text": "`apps/api/src/modules/auth/auth.routes.ts` declares `POST /refresh` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd1dc91abf32142d", "name": "Unused endpoint: GET /me", "shortDescription": {"text": "Unused endpoint: GET /me"}, "fullDescription": {"text": "`apps/api/src/modules/auth/auth.routes.ts` declares `GET /me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f267cc6244ff132b", "name": "Unused endpoint: GET /campaigns", "shortDescription": {"text": "Unused endpoint: GET /campaigns"}, "fullDescription": {"text": "`apps/api/src/modules/ads/ads.routes.ts` declares `GET /campaigns` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fa413208496243a5", "name": "Unused endpoint: POST /sync", "shortDescription": {"text": "Unused endpoint: POST /sync"}, "fullDescription": {"text": "`apps/api/src/modules/ads/ads.routes.ts` declares `POST /sync` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a2de4317039c9a7f", "name": "Unused endpoint: GET /threads", "shortDescription": {"text": "Unused endpoint: GET /threads"}, "fullDescription": {"text": "`apps/api/src/modules/cs/cs.routes.ts` declares `GET /threads` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c0386ebe5c0051fd", "name": "Unused endpoint: GET /threads/:threadId/messages", "shortDescription": {"text": "Unused endpoint: GET /threads/:threadId/messages"}, "fullDescription": {"text": "`apps/api/src/modules/cs/cs.routes.ts` declares `GET /threads/:threadId/messages` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-60912dbcd4e737f4", "name": "Unused endpoint: POST /threads/:threadId/read", "shortDescription": {"text": "Unused endpoint: POST /threads/:threadId/read"}, "fullDescription": {"text": "`apps/api/src/modules/cs/cs.routes.ts` declares `POST /threads/:threadId/read` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-55544f72a51d3252", "name": "Unused endpoint: POST /threads/:threadId/tags", "shortDescription": {"text": "Unused endpoint: POST /threads/:threadId/tags"}, "fullDescription": {"text": "`apps/api/src/modules/cs/cs.routes.ts` declares `POST /threads/:threadId/tags` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6c6a4e49014d9748", "name": "Unused endpoint: GET /shopee/callback", "shortDescription": {"text": "Unused endpoint: GET /shopee/callback"}, "fullDescription": {"text": "`apps/api/src/modules/shops/shop.routes.ts` declares `GET /shopee/callback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c9998a715f56e2a", "name": "Unused endpoint: GET /tiktok/callback", "shortDescription": {"text": "Unused endpoint: GET /tiktok/callback"}, "fullDescription": {"text": "`apps/api/src/modules/shops/shop.routes.ts` declares `GET /tiktok/callback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0303d4dc49606103", "name": "Unused endpoint: GET /tiktok/connect", "shortDescription": {"text": "Unused endpoint: GET /tiktok/connect"}, "fullDescription": {"text": "`apps/api/src/modules/shops/shop.routes.ts` declares `GET /tiktok/connect` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9a920fb75ef8a5af", "name": "Unused endpoint: GET /tiktok/app", "shortDescription": {"text": "Unused endpoint: GET /tiktok/app"}, "fullDescription": {"text": "`apps/api/src/modules/shops/shop.routes.ts` declares `GET /tiktok/app` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-98c9c7a4645d94b5", "name": "Unused endpoint: PUT /tiktok/app", "shortDescription": {"text": "Unused endpoint: PUT /tiktok/app"}, "fullDescription": {"text": "`apps/api/src/modules/shops/shop.routes.ts` declares `PUT /tiktok/app` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-530d1221b55fff5c", "name": "Unused endpoint: GET /shopee/connect", "shortDescription": {"text": "Unused endpoint: GET /shopee/connect"}, "fullDescription": {"text": "`apps/api/src/modules/shops/shop.routes.ts` declares `GET /shopee/connect` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19345"}, "properties": {"repository": "shadowruntimeio/e-commerce-suite", "repoUrl": "https://github.com/shadowruntimeio/e-commerce-suite", "branch": "main"}, "results": [{"ruleId": "scanner-e3e9805e3c426b5d", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/scripts/migrate-sub-account-system.ts:36"}, "properties": {"repobilityId": "c0878f7dd28272c1", "scanner": "scanner-primary", "fingerprint": "e3e9805e3c426b5d", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0920641eda3a12b2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/scripts/mock-merchant-flow.ts:221"}, "properties": {"repobilityId": "40b71da6dbc83669", "scanner": "scanner-primary", "fingerprint": "0920641eda3a12b2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-129fa48544cc13b7", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/scripts/probe-returns.ts:28"}, "properties": {"repobilityId": "f030f70d91e1d49b", "scanner": "scanner-primary", "fingerprint": "129fa48544cc13b7", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-04a00b8261a67e26", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/scripts/gen-stock-test-import.ts:29"}, "properties": {"repobilityId": "02d56dd60ee95ec5", "scanner": "scanner-primary", "fingerprint": "04a00b8261a67e26", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0f3b457451afd25b", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/index.ts:15"}, "properties": {"repobilityId": "a178156af585d748", "scanner": "scanner-primary", "fingerprint": "0f3b457451afd25b", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3db15611cecf5e58", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/platform/shopee/shopee.adapter.ts:657"}, "properties": {"repobilityId": "efdc7de8c85a757e", "scanner": "scanner-primary", "fingerprint": "3db15611cecf5e58", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-8ddb8c7846b233fb", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/platform/tiktok/tiktok.adapter.ts:15"}, "properties": {"repobilityId": "53a43a216045eef2", "scanner": "scanner-primary", "fingerprint": "8ddb8c7846b233fb", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0212d5357ca7e778", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/restocking.worker.ts:6"}, "properties": {"repobilityId": "b1639038e706ecd6", "scanner": "scanner-primary", "fingerprint": "0212d5357ca7e778", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-331a441d46ac1a32", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/sync-orders.worker.ts:31"}, "properties": {"repobilityId": "e72dce4e05408ea2", "scanner": "scanner-primary", "fingerprint": "331a441d46ac1a32", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3e24f77cc4cf0300", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/etl.worker.ts:19"}, "properties": {"repobilityId": "4331233bcc2abdbe", "scanner": "scanner-primary", "fingerprint": "3e24f77cc4cf0300", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-363603ff4a99dabf", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/index.ts:13"}, "properties": {"repobilityId": "807d33bb20c07f82", "scanner": "scanner-primary", "fingerprint": "363603ff4a99dabf", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3d4809dafb2207a4", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/start.ts:13"}, "properties": {"repobilityId": "dc8541155e9053bc", "scanner": "scanner-primary", "fingerprint": "3d4809dafb2207a4", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-15e874dbe3460d78", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/sync-products.worker.ts:33"}, "properties": {"repobilityId": "2ba487b9a5ac2fbd", "scanner": "scanner-primary", "fingerprint": "15e874dbe3460d78", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-631181b619989602", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/scheduler.ts:25"}, "properties": {"repobilityId": "b6e6afa71ebc32ed", "scanner": "scanner-primary", "fingerprint": "631181b619989602", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-4062c9053ee0fb35", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/refresh-tokens.worker.ts:12"}, "properties": {"repobilityId": "e060197dc7f8cabf", "scanner": "scanner-primary", "fingerprint": "4062c9053ee0fb35", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-46b67e12b7e92d01", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/sync-messages.worker.ts:4"}, "properties": {"repobilityId": "6738970594046b4c", "scanner": "scanner-primary", "fingerprint": "46b67e12b7e92d01", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1e4cf130ecdcbdce", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/sync-returns.worker.ts:19"}, "properties": {"repobilityId": "c81b23c3108cfe54", "scanner": "scanner-primary", "fingerprint": "1e4cf130ecdcbdce", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-3413052f0708b0d6", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/workers/sync-ads.worker.ts:6"}, "properties": {"repobilityId": "b35dc151b74b2b75", "scanner": "scanner-primary", "fingerprint": "3413052f0708b0d6", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-923d7873b9aee0d2", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/modules/shops/shop.routes.ts:136"}, "properties": {"repobilityId": "d871cba291de1c6f", "scanner": "scanner-primary", "fingerprint": "923d7873b9aee0d2", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-b67d2eaa53257bba", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/modules/webhooks/tiktok.webhook.ts:47"}, "properties": {"repobilityId": "d728cde69ad752f8", "scanner": "scanner-primary", "fingerprint": "b67d2eaa53257bba", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-4d7e2b6bb18ab806", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/api/src/modules/webhooks/shopee.webhook.ts:89"}, "properties": {"repobilityId": "7f18352f586ab01f", "scanner": "scanner-primary", "fingerprint": "4d7e2b6bb18ab806", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0b80fc0f22362eae", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 apps/web/src/components/support/SupportWidget.tsx:576"}, "properties": {"repobilityId": "05b80b9307fca521", "scanner": "scanner-primary", "fingerprint": "0b80fc0f22362eae", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-b0b7a32681400205", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/web/src/modules/orders/OrdersPage.tsx:269"}, "properties": {"repobilityId": "446b29db27c223bb", "scanner": "scanner-primary", "fingerprint": "b0b7a32681400205", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a1aadb99bccd640a", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/agent-worker/src/index.ts:35"}, "properties": {"repobilityId": "fc1f68fe18734819", "scanner": "scanner-primary", "fingerprint": "a1aadb99bccd640a", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0b492fb26fd71297", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 apps/agent-worker/src/notify-listener.ts:66"}, "properties": {"repobilityId": "e8a82ab30d2182b7", "scanner": "scanner-primary", "fingerprint": "0b492fb26fd71297", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-9075c66b9f9eb176", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 packages/db/src/seed.ts:11"}, "properties": {"repobilityId": "23cafb689c64510c", "scanner": "scanner-primary", "fingerprint": "9075c66b9f9eb176", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-d9980d9104825b19", "level": "warning", "message": {"text": "Dockerfile runs as root: apps/api/Dockerfile"}, "properties": {"repobilityId": "e591b11d8a0c1fe7", "scanner": "scanner-primary", "fingerprint": "d9980d9104825b19", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-3d70dcd36b57a39a", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:20-alpine"}, "properties": {"repobilityId": "71f0b8ed23d852bf", "scanner": "scanner-primary", "fingerprint": "3d70dcd36b57a39a", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-5d9d7a217ad79c47", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in apps/web/src/components/support/SupportWidget.tsx:576"}, "properties": {"repobilityId": "42fab98d6f6acd13", "scanner": "scanner-primary", "fingerprint": "5d9d7a217ad79c47", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/src/components/support/SupportWidget.tsx"}, "region": {"startLine": 576}}}]}, {"ruleId": "scanner-0ab14b035691cf86", "level": "error", "message": {"text": "Possible secret in apps/web/src/locales/en.ts"}, "properties": {"repobilityId": "22cd212b717a0b45", "scanner": "scanner-primary", "fingerprint": "0ab14b035691cf86", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/src/locales/en.ts"}, "region": {"startLine": 92}}}]}, {"ruleId": "scanner-0ab14b035691cf86", "level": "error", "message": {"text": "Possible secret in apps/web/src/locales/en.ts"}, "properties": {"repobilityId": "22cd212b717a0b45", "scanner": "scanner-primary", "fingerprint": "0ab14b035691cf86", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/src/locales/en.ts"}, "region": {"startLine": 477}}}]}, {"ruleId": "scanner-a7d5855cee3622a5", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in apps/agent-worker/src/claude-runner.ts:1"}, "properties": {"repobilityId": "bd4feaa451bbeece", "scanner": "scanner-primary", "fingerprint": "a7d5855cee3622a5", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/agent-worker/src/claude-runner.ts"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8a761611c86a9926", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in apps/agent-worker/src/rpc/recent-errors.mjs:13"}, "properties": {"repobilityId": "155bcd4eab1be367", "scanner": "scanner-primary", "fingerprint": "8a761611c86a9926", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/agent-worker/src/rpc/recent-errors.mjs"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-918083d82e543cd6", "level": "note", "message": {"text": "Very large file: apps/web/src/modules/orders/OrdersPage.tsx (2261 lines)"}, "properties": {"repobilityId": "d5ec7b11e6a813ba", "scanner": "scanner-primary", "fingerprint": "918083d82e543cd6", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "f1251a257be46edc", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b06b8d86f24c77f9", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/api/package.json"}, "properties": {"repobilityId": "ce77cd34ed0306d4", "scanner": "scanner-primary", "fingerprint": "b06b8d86f24c77f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/api/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4a9eb7dc7c6e3880", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/web/package.json"}, "properties": {"repobilityId": "6c1704bf24cf19ac", "scanner": "scanner-primary", "fingerprint": "4a9eb7dc7c6e3880", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/web/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-55dfb3cf01f307f5", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: apps/agent-worker/package.json"}, "properties": {"repobilityId": "e6b4c241da11c550", "scanner": "scanner-primary", "fingerprint": "55dfb3cf01f307f5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "apps/agent-worker/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2699d5f16ae11282", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/shared/package.json"}, "properties": {"repobilityId": "37ac218a4ef9b430", "scanner": "scanner-primary", "fingerprint": "2699d5f16ae11282", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/shared/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7b16ae2bd0fca524", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: packages/db/package.json"}, "properties": {"repobilityId": "2bddd295d559a9b6", "scanner": "scanner-primary", "fingerprint": "7b16ae2bd0fca524", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "packages/db/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "d584e8d54c36f8ef", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "501c14265537c992", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "fd79e07a7e3ce3c8", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "4275cd2f7c8df5ab", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "bba1ef435a611b0f", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "d6c6202e081cbb08", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "05932fe361c80dd7", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-d35e6c700908a3c4", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/scripts/gen-stock-test-import.ts:1"}, "properties": {"repobilityId": "b4d12b94ed5ee3c5", "scanner": "scanner-primary", "fingerprint": "d35e6c700908a3c4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-db4a217b15098e92", "level": "note", "message": {"text": "Legacy-named symbol `stock_info_v2` in apps/api/src/platform/shopee/shopee.adapter.ts:269"}, "properties": {"repobilityId": "005490c6b283f69b", "scanner": "scanner-primary", "fingerprint": "db4a217b15098e92", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-49a7f0b9fdfa2dd6", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/api/src/platform/shopee/shopee.adapter.ts:461"}, "properties": {"repobilityId": "165d4843f0951cdd", "scanner": "scanner-primary", "fingerprint": "49a7f0b9fdfa2dd6", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-9169cf50fe3e9ce7", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/platform/shopee/shopee.adapter.ts:55"}, "properties": {"repobilityId": "2924f80c48703f46", "scanner": "scanner-primary", "fingerprint": "9169cf50fe3e9ce7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-6b62896ae11c3a27", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/src/platform/tiktok/tiktok.adapter.ts:936"}, "properties": {"repobilityId": "bf0c1b9145a9f0ea", "scanner": "scanner-primary", "fingerprint": "6b62896ae11c3a27", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-89c58804a10f4772", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/api/src/workers/sync-orders.worker.ts:180"}, "properties": {"repobilityId": "79283adc9f334d61", "scanner": "scanner-primary", "fingerprint": "89c58804a10f4772", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-ed46cde0f54e1308", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/api/src/modules/inventory/inventory.routes.ts:181"}, "properties": {"repobilityId": "8d4c80f5a9746c73", "scanner": "scanner-primary", "fingerprint": "ed46cde0f54e1308", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-82008673d6149562", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/src/modules/inventory/inventory.service.ts:430"}, "properties": {"repobilityId": "f8ad0667eacd727c", "scanner": "scanner-primary", "fingerprint": "82008673d6149562", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8f6d7c420505005e", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/api/src/modules/orders/order.routes.ts:606"}, "properties": {"repobilityId": "54dd137dc6277f72", "scanner": "scanner-primary", "fingerprint": "8f6d7c420505005e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-fd8c55a9f28dd041", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 apps/api/src/modules/orders/order.routes.ts:860"}, "properties": {"repobilityId": "4b095598643c8c3b", "scanner": "scanner-primary", "fingerprint": "fd8c55a9f28dd041", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ee196705716462ae", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/api/src/modules/returns/returns.routes.ts:48"}, "properties": {"repobilityId": "72ec32bc0f489120", "scanner": "scanner-primary", "fingerprint": "ee196705716462ae", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f0b5ea7ec94a18b2", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/api/src/modules/support/support.routes.ts:35"}, "properties": {"repobilityId": "a15b350d1bc43724", "scanner": "scanner-primary", "fingerprint": "f0b5ea7ec94a18b2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6714dc6c054bc9b3", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/api/src/modules/webhooks/shopee.webhook.ts:6"}, "properties": {"repobilityId": "8664faa95a7fe060", "scanner": "scanner-primary", "fingerprint": "6714dc6c054bc9b3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-774b36d3a6c70e06", "level": "none", "message": {"text": "Commented-code block (8 lines) in apps/web/src/modules/orders/OrdersPage.tsx:50"}, "properties": {"repobilityId": "cce075b8d6619c93", "scanner": "scanner-primary", "fingerprint": "774b36d3a6c70e06", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-add81eb1c2857090", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/web/src/modules/admin/AuditPage.tsx:36"}, "properties": {"repobilityId": "5bc3d8e7e8bc2c46", "scanner": "scanner-primary", "fingerprint": "add81eb1c2857090", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b64c60806a6ae481", "level": "none", "message": {"text": "Commented-code block (5 lines) in apps/agent-worker/src/manual-generator.ts:66"}, "properties": {"repobilityId": "41f056932c633004", "scanner": "scanner-primary", "fingerprint": "b64c60806a6ae481", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-275a92112b134bb2", "level": "none", "message": {"text": "Commented-code block (8 lines) in apps/agent-worker/src/index.ts:18"}, "properties": {"repobilityId": "1ff8bd8195fb24b6", "scanner": "scanner-primary", "fingerprint": "275a92112b134bb2", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-317e6ab10ff43961", "level": "none", "message": {"text": "Commented-code block (6 lines) in apps/agent-worker/src/claude-runner.ts:83"}, "properties": {"repobilityId": "3b9ddc38326309b7", "scanner": "scanner-primary", "fingerprint": "317e6ab10ff43961", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-cc0f9d8e41b33b0e", "level": "note", "message": {"text": "11 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "c82cd8cd626c3599", "scanner": "scanner-primary", "fingerprint": "cc0f9d8e41b33b0e", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-38ab5517ad3aff02", "level": "error", "message": {"text": "Dangling fetch: POST /api/v1/auth/refresh (apps/web/src/lib/api.ts:29)"}, "properties": {"repobilityId": "942e121ce8ec1014", "scanner": "scanner-primary", "fingerprint": "38ab5517ad3aff02", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "axios"]}}, {"ruleId": "scanner-5149a5a7fc1f238c", "level": "note", "message": {"text": "Unused endpoint: GET /stock"}, "properties": {"repobilityId": "1deea3dcbc0c666e", "scanner": "scanner-primary", "fingerprint": "5149a5a7fc1f238c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-021dce2f4ebbdf3e", "level": "note", "message": {"text": "Unused endpoint: GET /stock/:warehouseSkuId"}, "properties": {"repobilityId": "bd649750095b4e46", "scanner": "scanner-primary", "fingerprint": "021dce2f4ebbdf3e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-43269e4e79c2e69e", "level": "note", "message": {"text": "Unused endpoint: GET /events"}, "properties": {"repobilityId": "5becb991294e47c2", "scanner": "scanner-primary", "fingerprint": "43269e4e79c2e69e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-afc064028ae39ea9", "level": "note", "message": {"text": "Unused endpoint: GET /history"}, "properties": {"repobilityId": "7eabdb4c1ba6ccfd", "scanner": "scanner-primary", "fingerprint": "afc064028ae39ea9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e686634beeea0bb8", "level": "note", "message": {"text": "Unused endpoint: GET /export"}, "properties": {"repobilityId": "219de12987a7fb79", "scanner": "scanner-primary", "fingerprint": "e686634beeea0bb8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f2735d8fd432529b", "level": "note", "message": {"text": "Unused endpoint: GET /import-template"}, "properties": {"repobilityId": "adb53256737c8086", "scanner": "scanner-primary", "fingerprint": "f2735d8fd432529b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-55a555d267c47b13", "level": "note", "message": {"text": "Unused endpoint: POST /import/preview"}, "properties": {"repobilityId": "926eb5324e86722c", "scanner": "scanner-primary", "fingerprint": "55a555d267c47b13", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f59a5e88944ea3bd", "level": "note", "message": {"text": "Unused endpoint: POST /import/apply"}, "properties": {"repobilityId": "f2e0345a261106b2", "scanner": "scanner-primary", "fingerprint": "f59a5e88944ea3bd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-54f395ebcfcd47ee", "level": "note", "message": {"text": "Unused endpoint: POST /import-legacy-removed"}, "properties": {"repobilityId": "a22933327561e430", "scanner": "scanner-primary", "fingerprint": "54f395ebcfcd47ee", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fcb1b5473a4a7217", "level": "note", "message": {"text": "Unused endpoint: POST /adjust"}, "properties": {"repobilityId": "dfdb6b77e02b1d8b", "scanner": "scanner-primary", "fingerprint": "fcb1b5473a4a7217", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a009b1a56794f45", "level": "note", "message": {"text": "Unused endpoint: POST /"}, "properties": {"repobilityId": "f8f8288021a6974c", "scanner": "scanner-primary", "fingerprint": "7a009b1a56794f45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "6696ba5f831a5f71", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ca5756175765b49d", "level": "note", "message": {"text": "Unused endpoint: GET /:id"}, "properties": {"repobilityId": "3e6f22c6ded68248", "scanner": "scanner-primary", "fingerprint": "ca5756175765b49d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ab772fa6de3748f1", "level": "note", "message": {"text": "Unused endpoint: POST /:id/confirm"}, "properties": {"repobilityId": "00db7f490adf0903", "scanner": "scanner-primary", "fingerprint": "ab772fa6de3748f1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-42f2999bb43a2c8d", "level": "note", "message": {"text": "Unused endpoint: POST /:id/reject"}, "properties": {"repobilityId": "2457e72a8c120dc0", "scanner": "scanner-primary", "fingerprint": "42f2999bb43a2c8d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-85a2ef63eed77279", "level": "note", "message": {"text": "Unused endpoint: POST /:id/read"}, "properties": {"repobilityId": "40c17fb2b06c64e2", "scanner": "scanner-primary", "fingerprint": "85a2ef63eed77279", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f8d576f6bf0f5660", "level": "note", "message": {"text": "Unused endpoint: POST /read-all"}, "properties": {"repobilityId": "4d1cc42485274439", "scanner": "scanner-primary", "fingerprint": "f8d576f6bf0f5660", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-af6608de4c7fbf85", "level": "note", "message": {"text": "Unused endpoint: POST /manual"}, "properties": {"repobilityId": "88c078f735d629cf", "scanner": "scanner-primary", "fingerprint": "af6608de4c7fbf85", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5e44d1e7d1d7afd6", "level": "note", "message": {"text": "Unused endpoint: POST /:id/manual-ship"}, "properties": {"repobilityId": "7787da4d528ea867", "scanner": "scanner-primary", "fingerprint": "5e44d1e7d1d7afd6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a61c112b611f4bb", "level": "note", "message": {"text": "Unused endpoint: DELETE /:id"}, "properties": {"repobilityId": "bd679e7406640e55", "scanner": "scanner-primary", "fingerprint": "7a61c112b611f4bb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-739a007527be659d", "level": "note", "message": {"text": "Unused endpoint: GET /:id/images/:imageId"}, "properties": {"repobilityId": "ff7eea00d6b36568", "scanner": "scanner-primary", "fingerprint": "739a007527be659d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f39249a345a19765", "level": "note", "message": {"text": "Unused endpoint: PATCH /:id/status"}, "properties": {"repobilityId": "5eba42426248a845", "scanner": "scanner-primary", "fingerprint": "f39249a345a19765", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-35ba7c5848dce371", "level": "note", "message": {"text": "Unused endpoint: POST /:id/merchant-confirm"}, "properties": {"repobilityId": "51cffcd4d1cfb9c8", "scanner": "scanner-primary", "fingerprint": "35ba7c5848dce371", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5850cadf98988144", "level": "note", "message": {"text": "Unused endpoint: POST /:id/merchant-cancel"}, "properties": {"repobilityId": "20c1f0d451307f04", "scanner": "scanner-primary", "fingerprint": "5850cadf98988144", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-93f10e2930bfbd5e", "level": "note", "message": {"text": "Unused endpoint: POST /:id/items/:itemId/replace-sku"}, "properties": {"repobilityId": "676e9c7d90eb6ee4", "scanner": "scanner-primary", "fingerprint": "93f10e2930bfbd5e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c2ecad0833a799d7", "level": "note", "message": {"text": "Unused endpoint: GET /:id/shipping-label"}, "properties": {"repobilityId": "0162cf75f24b92c2", "scanner": "scanner-primary", "fingerprint": "c2ecad0833a799d7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f48aadb3a1518b0c", "level": "note", "message": {"text": "Unused endpoint: GET /label-proxy"}, "properties": {"repobilityId": "239ee246b76f7b4f", "scanner": "scanner-primary", "fingerprint": "f48aadb3a1518b0c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7ce45f1f861883b0", "level": "note", "message": {"text": "Unused endpoint: POST /:id/run-rules"}, "properties": {"repobilityId": "4b30a55fa2186f09", "scanner": "scanner-primary", "fingerprint": "7ce45f1f861883b0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8d5b2b188d08ca82", "level": "note", "message": {"text": "Unused endpoint: PUT /:id"}, "properties": {"repobilityId": "65f0510f625d5c44", "scanner": "scanner-primary", "fingerprint": "8d5b2b188d08ca82", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-731c57f59aaca553", "level": "note", "message": {"text": "Unused endpoint: POST /test"}, "properties": {"repobilityId": "68fd70d411087bd0", "scanner": "scanner-primary", "fingerprint": "731c57f59aaca553", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-87706754c816eab0", "level": "note", "message": {"text": "Unused endpoint: GET /shipments"}, "properties": {"repobilityId": "b6fb4276a6fb4476", "scanner": "scanner-primary", "fingerprint": "87706754c816eab0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5669e9e5a31a4f25", "level": "note", "message": {"text": "Unused endpoint: POST /shipments"}, "properties": {"repobilityId": "c990f0336e40dba0", "scanner": "scanner-primary", "fingerprint": "5669e9e5a31a4f25", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bfd277ad277622d0", "level": "note", "message": {"text": "Unused endpoint: PATCH /shipments/:id"}, "properties": {"repobilityId": "a9f953bac9e75131", "scanner": "scanner-primary", "fingerprint": "bfd277ad277622d0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5d5060ac0de24d74", "level": "note", "message": {"text": "Unused endpoint: DELETE /shipments/:id"}, "properties": {"repobilityId": "3269c77b9563e14b", "scanner": "scanner-primary", "fingerprint": "5d5060ac0de24d74", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-304b6f2b403d93f7", "level": "note", "message": {"text": "Unused endpoint: POST /register"}, "properties": {"repobilityId": "c1627caec7eaeeda", "scanner": "scanner-primary", "fingerprint": "304b6f2b403d93f7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-618721b912bad1c2", "level": "note", "message": {"text": "Unused endpoint: POST /login"}, "properties": {"repobilityId": "7dd2e3575abd2eab", "scanner": "scanner-primary", "fingerprint": "618721b912bad1c2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7ce17d6b092a81ca", "level": "note", "message": {"text": "Unused endpoint: POST /refresh"}, "properties": {"repobilityId": "0b7f26ab1f598a8f", "scanner": "scanner-primary", "fingerprint": "7ce17d6b092a81ca", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd1dc91abf32142d", "level": "note", "message": {"text": "Unused endpoint: GET /me"}, "properties": {"repobilityId": "3d571794c2a514c5", "scanner": "scanner-primary", "fingerprint": "fd1dc91abf32142d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f267cc6244ff132b", "level": "note", "message": {"text": "Unused endpoint: GET /campaigns"}, "properties": {"repobilityId": "eaf2797bf342bbc7", "scanner": "scanner-primary", "fingerprint": "f267cc6244ff132b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fa413208496243a5", "level": "note", "message": {"text": "Unused endpoint: POST /sync"}, "properties": {"repobilityId": "06c01d564671cdbe", "scanner": "scanner-primary", "fingerprint": "fa413208496243a5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a2de4317039c9a7f", "level": "note", "message": {"text": "Unused endpoint: GET /threads"}, "properties": {"repobilityId": "34998484114e31f7", "scanner": "scanner-primary", "fingerprint": "a2de4317039c9a7f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c0386ebe5c0051fd", "level": "note", "message": {"text": "Unused endpoint: GET /threads/:threadId/messages"}, "properties": {"repobilityId": "30d30804e7e80548", "scanner": "scanner-primary", "fingerprint": "c0386ebe5c0051fd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-60912dbcd4e737f4", "level": "note", "message": {"text": "Unused endpoint: POST /threads/:threadId/read"}, "properties": {"repobilityId": "fb9d68b4fd7bfb9c", "scanner": "scanner-primary", "fingerprint": "60912dbcd4e737f4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-55544f72a51d3252", "level": "note", "message": {"text": "Unused endpoint: POST /threads/:threadId/tags"}, "properties": {"repobilityId": "daaed339bf0d2dfc", "scanner": "scanner-primary", "fingerprint": "55544f72a51d3252", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6c6a4e49014d9748", "level": "note", "message": {"text": "Unused endpoint: GET /shopee/callback"}, "properties": {"repobilityId": "cdecb1b469289a7b", "scanner": "scanner-primary", "fingerprint": "6c6a4e49014d9748", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5c9998a715f56e2a", "level": "note", "message": {"text": "Unused endpoint: GET /tiktok/callback"}, "properties": {"repobilityId": "a211066a61950a5e", "scanner": "scanner-primary", "fingerprint": "5c9998a715f56e2a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0303d4dc49606103", "level": "note", "message": {"text": "Unused endpoint: GET /tiktok/connect"}, "properties": {"repobilityId": "85da385443b252a6", "scanner": "scanner-primary", "fingerprint": "0303d4dc49606103", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9a920fb75ef8a5af", "level": "note", "message": {"text": "Unused endpoint: GET /tiktok/app"}, "properties": {"repobilityId": "83ee5922bc31b127", "scanner": "scanner-primary", "fingerprint": "9a920fb75ef8a5af", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-98c9c7a4645d94b5", "level": "note", "message": {"text": "Unused endpoint: PUT /tiktok/app"}, "properties": {"repobilityId": "02ce7945694d7e82", "scanner": "scanner-primary", "fingerprint": "98c9c7a4645d94b5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-530d1221b55fff5c", "level": "note", "message": {"text": "Unused endpoint: GET /shopee/connect"}, "properties": {"repobilityId": "cc55872c94f5ff86", "scanner": "scanner-primary", "fingerprint": "530d1221b55fff5c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}