{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-3cce67837bbf896a", "name": "Possibly dead Python function: reload_config", "shortDescription": {"text": "Possibly dead Python function: reload_config"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd25f400f5d42ea1", "name": "Possibly dead Python function: enable_server", "shortDescription": {"text": "Possibly dead Python function: enable_server"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-09f428254bbdd24e", "name": "Possibly dead Python function: disable_server", "shortDescription": {"text": "Possibly dead Python function: disable_server"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c7f39162d085a020", "name": "Possibly dead Python function: release_all", "shortDescription": {"text": "Possibly dead Python function: release_all"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ec5adaf2186d7bf0", "name": "Possibly dead Python function: merge_artifacts", "shortDescription": {"text": "Possibly dead Python function: merge_artifacts"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fbcfa902f7d217af", "name": "Possibly dead Python function: merge_viewed_images", "shortDescription": {"text": "Possibly dead Python function: merge_viewed_images"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bbf5a50cca7c2c7d", "name": "Possibly dead Python function: update_context", "shortDescription": {"text": "Possibly dead Python function: update_context"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3c3a1e805be00a00", "name": "Possibly dead Python function: add_fact", "shortDescription": {"text": "Possibly dead Python function: add_fact"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bdb65aa91a87595a", "name": "Possibly dead Python function: process_conversation", "shortDescription": {"text": "Possibly dead Python function: process_conversation"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ca380a6d6c4bc9af", "name": "Possibly dead Python function: make_lead_agent", "shortDescription": {"text": "Possibly dead Python function: make_lead_agent"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-161ec3989a920632", "name": "Possibly dead Python function: invoke_agent", "shortDescription": {"text": "Possibly dead Python function: invoke_agent"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-550c20218f6270cc", "name": "Stray `console.log` in TS/JS \u2014 desktop/preload.js:26", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 desktop/preload.js:26"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2db691d78fa6afe1", "name": "Stray `console.log` in TS/JS \u2014 desktop/main.js:184", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 desktop/main.js:184"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f66ad88286ca30a", "name": "Dockerfile runs as root: backend/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: backend/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8cd20d539467d2c5", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-583132eb75854084", "name": "Insecure pattern 'direct_innerhtml_assignment' in test_page.html:49", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in test_page.html:49"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d05afc7e44d47015", "name": "Insecure pattern 'node_child_process' in desktop/main.js:3", "shortDescription": {"text": "Insecure pattern 'node_child_process' in desktop/main.js:3"}, "fullDescription": {"text": "Found a known-risky pattern (node_child_process). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e7e8b326ecbd1888", "name": "Insecure pattern 'subprocess_shell_true' in backend/src/sandbox/sandbox.py:72", "shortDescription": {"text": "Insecure pattern 'subprocess_shell_true' in backend/src/sandbox/sandbox.py:72"}, "fullDescription": {"text": "Found a known-risky pattern (subprocess_shell_true). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7444e066e2b079c1", "name": "package.json defines install-time lifecycle scripts", "shortDescription": {"text": "package.json defines install-time lifecycle scripts"}, "fullDescription": {"text": "preinstall/install/postinstall/prepare scripts execute during dependency installation. Review them carefully for network calls, obfuscation, shell execution, or credential access."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "3 tests / 20 src (ratio 0.15)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0e8a76eb13fd3249", "name": "Node manifest has dependencies but no lockfile: frontend/package.json", "shortDescription": {"text": "Node manifest has dependencies but no lockfile: frontend/package.json"}, "fullDescription": {"text": "`package.json` declares dependencies, but no same-directory npm/pnpm/yarn/bun lockfile was found. Generated projects without lockfiles are less reproducible and harder to secure-scan precisely."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 33 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: ci, lockfile. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing ci, lockfile. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2679282aa1c484b5", "name": "Agent authority lacks a verifier contract: AGENTS.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ac12cc3bf39127aa", "name": "Agent authority lacks a verifier contract: skills/public/code-generation/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/public/code-generation/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6a6353acb3769a2a", "name": "Agent authority lacks a verifier contract: skills/public/diagram-generation/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/public/diagram-generation/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-74b502c910e54b16", "name": "Agent authority lacks a verifier contract: skills/public/3d-modeling/SKILL.md", "shortDescription": {"text": "Agent authority lacks a verifier contract: skills/public/3d-modeling/SKILL.md"}, "fullDescription": {"text": "This agent instruction grants code or shell authority but does not state the verification gate that decides promotion. The recurring safe pattern is: LLM proposes; deterministic tests/build/security checks verify; only verified code promotes."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e725d2ab884fbd49", "name": "Multiple root agent instruction files without precedence", "shortDescription": {"text": "Multiple root agent instruction files without precedence"}, "fullDescription": {"text": "The repo has multiple top-level AI-coder instruction files. Without precedence rules, different agents may follow different policies."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d0b17c8c07a7421d", "name": "8 env vars used in code but missing from .env.example", "shortDescription": {"text": "8 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `PF_GITHUB_CLIENT_ID`, `PF_GOOGLE_CLIENT_ID`, `PF_GOOGLE_TOKEN_PROXY`, `PROTOFORGE_ALLOWED_ORIGINS`, `PROTOFORGE_DEV_MODE`, `PROTOFORGE_HOST`, `PROTOFORGE_PORT`, `SHELL`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/src/sandbox/sandbox.py:execute_command, backend/src/sandbox/sandbox.py:execute_command\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8498aa5a899b59e", "name": "FastAPI POST `paypal_webhook` without auth dependency \u2014 backend/src/gateway/app.py:275", "shortDescription": {"text": "FastAPI POST `paypal_webhook` without auth dependency \u2014 backend/src/gateway/app.py:275"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3fee642d49197e27", "name": "FastAPI POST `enable_dev_mode` without auth dependency \u2014 backend/src/gateway/app.py:316", "shortDescription": {"text": "FastAPI POST `enable_dev_mode` without auth dependency \u2014 backend/src/gateway/app.py:316"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1ee4c026b32010d5", "name": "FastAPI POST `plan` without auth dependency \u2014 backend/src/gateway/app.py:413", "shortDescription": {"text": "FastAPI POST `plan` without auth dependency \u2014 backend/src/gateway/app.py:413"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5e5fa179f3916718", "name": "FastAPI POST `edit_part` without auth dependency \u2014 backend/src/gateway/app.py:468", "shortDescription": {"text": "FastAPI POST `edit_part` without auth dependency \u2014 backend/src/gateway/app.py:468"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3150d7cd46fc9e7b", "name": "FastAPI POST `github_start` without auth dependency \u2014 backend/src/gateway/app.py:587", "shortDescription": {"text": "FastAPI POST `github_start` without auth dependency \u2014 backend/src/gateway/app.py:587"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3aa523725ed2c12a", "name": "FastAPI POST `github_poll` without auth dependency \u2014 backend/src/gateway/app.py:604", "shortDescription": {"text": "FastAPI POST `github_poll` without auth dependency \u2014 backend/src/gateway/app.py:604"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-29eb85b13880113b", "name": "FastAPI POST `share_compose` without auth dependency \u2014 backend/src/gateway/app.py:708", "shortDescription": {"text": "FastAPI POST `share_compose` without auth dependency \u2014 backend/src/gateway/app.py:708"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-68d6d1ea45d2f193", "name": "FastAPI POST `test_api` without auth dependency \u2014 backend/src/gateway/app.py:742", "shortDescription": {"text": "FastAPI POST `test_api` without auth dependency \u2014 backend/src/gateway/app.py:742"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-66d956f4173c72aa", "name": "FastAPI POST `auto_detect_model` without auth dependency \u2014 backend/src/gateway/app.py:780", "shortDescription": {"text": "FastAPI POST `auto_detect_model` without auth dependency \u2014 backend/src/gateway/app.py:780"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ffb09c6f3d3065a9", "name": "FastAPI PUT `update_skill` without auth dependency \u2014 backend/src/gateway/app.py:890", "shortDescription": {"text": "FastAPI PUT `update_skill` without auth dependency \u2014 backend/src/gateway/app.py:890"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c957cd07d5727d60", "name": "FastAPI PUT `update_mcp_config` without auth dependency \u2014 backend/src/gateway/app.py:912", "shortDescription": {"text": "FastAPI PUT `update_mcp_config` without auth dependency \u2014 backend/src/gateway/app.py:912"}, "fullDescription": {"text": "`@router.put` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0f77a8db4bba6de0", "name": "FastAPI POST `reload_memory` without auth dependency \u2014 backend/src/gateway/app.py:949", "shortDescription": {"text": "FastAPI POST `reload_memory` without auth dependency \u2014 backend/src/gateway/app.py:949"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5c3c6a8ddb726f73", "name": "FastAPI POST `test_api_key` without auth dependency \u2014 backend/src/gateway/app.py:956", "shortDescription": {"text": "FastAPI POST `test_api_key` without auth dependency \u2014 backend/src/gateway/app.py:956"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-aa0025b26503fa02", "name": "FastAPI POST `agent_discuss` without auth dependency \u2014 backend/src/gateway/app.py:999", "shortDescription": {"text": "FastAPI POST `agent_discuss` without auth dependency \u2014 backend/src/gateway/app.py:999"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-871f281a86966670", "name": "FastAPI POST `generate` without auth dependency \u2014 backend/src/gateway/app.py:1059", "shortDescription": {"text": "FastAPI POST `generate` without auth dependency \u2014 backend/src/gateway/app.py:1059"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5178b7697b9e69f7", "name": "FastAPI POST `upload_files` without auth dependency \u2014 backend/src/gateway/app.py:1208", "shortDescription": {"text": "FastAPI POST `upload_files` without auth dependency \u2014 backend/src/gateway/app.py:1208"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-f46028d75888e8bf", "name": "Dangling fetch: POST http://localhost:8001/api/auto-detect (frontend/src/app/page.tsx:26)", "shortDescription": {"text": "Dangling fetch: POST http://localhost:8001/api/auto-detect (frontend/src/app/page.tsx:26)"}, "fullDescription": {"text": "`frontend/src/app/page.tsx:26` calls `POST http://localhost:8001/api/auto-detect` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/localhost:8001/api/auto-detect`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a08a476c0b443177", "name": "Dangling fetch: POST http://localhost:8001/api/test (frontend/src/app/page.tsx:64)", "shortDescription": {"text": "Dangling fetch: POST http://localhost:8001/api/test (frontend/src/app/page.tsx:64)"}, "fullDescription": {"text": "`frontend/src/app/page.tsx:64` calls `POST http://localhost:8001/api/test` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/localhost:8001/api/test`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cd2c7ae452e709ae", "name": "Dangling fetch: POST http://localhost:8001/api/generate (frontend/src/app/page.tsx:105)", "shortDescription": {"text": "Dangling fetch: POST http://localhost:8001/api/generate (frontend/src/app/page.tsx:105)"}, "fullDescription": {"text": "`frontend/src/app/page.tsx:105` calls `POST http://localhost:8001/api/generate` but no backend route matches that path. This is a runtime 404 waiting to happen.\n\nTool: fetch\nNormalized path used for matching: `/http:/localhost:8001/api/generate`\nIf this points at an external API, prefix it with `https://` so the matcher skips it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b875e59eb7995957", "name": "Unused endpoint: GET /api/license/status", "shortDescription": {"text": "Unused endpoint: GET /api/license/status"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `GET /api/license/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-17805c102de7651c", "name": "Unused endpoint: POST /api/paypal/webhook", "shortDescription": {"text": "Unused endpoint: POST /api/paypal/webhook"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `POST /api/paypal/webhook` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11ff4dca02201970", "name": "Unused endpoint: GET /api/dev/status", "shortDescription": {"text": "Unused endpoint: GET /api/dev/status"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `GET /api/dev/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-42632db1c90b02c7", "name": "Unused endpoint: POST /api/dev/enable", "shortDescription": {"text": "Unused endpoint: POST /api/dev/enable"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `POST /api/dev/enable` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-20998b34e812e3c5", "name": "Unused endpoint: GET /favicon.png", "shortDescription": {"text": "Unused endpoint: GET /favicon.png"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `GET /favicon.png` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bce8115208f614c2", "name": "Unused endpoint: POST /api/plan", "shortDescription": {"text": "Unused endpoint: POST /api/plan"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `POST /api/plan` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-90d4f09e7684af11", "name": "Unused endpoint: POST /api/edit-part", "shortDescription": {"text": "Unused endpoint: POST /api/edit-part"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `POST /api/edit-part` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-55e6f47e305c8c41", "name": "Unused endpoint: POST /api/oauth/github/start", "shortDescription": {"text": "Unused endpoint: POST /api/oauth/github/start"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `POST /api/oauth/github/start` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f4a212aab54b55cc", "name": "Unused endpoint: POST /api/oauth/github/poll", "shortDescription": {"text": "Unused endpoint: POST /api/oauth/github/poll"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `POST /api/oauth/github/poll` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0849a54ee1b20e78", "name": "Unused endpoint: GET /api/oauth/google/start", "shortDescription": {"text": "Unused endpoint: GET /api/oauth/google/start"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `GET /api/oauth/google/start` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eb03a5115c2d8a71", "name": "Unused endpoint: GET /oauth/google/callback", "shortDescription": {"text": "Unused endpoint: GET /oauth/google/callback"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `GET /oauth/google/callback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a5c9736c1be2c9fd", "name": "Unused endpoint: GET /api/oauth/google/result", "shortDescription": {"text": "Unused endpoint: GET /api/oauth/google/result"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `GET /api/oauth/google/result` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bf359ce2b3cee98a", "name": "Unused endpoint: POST /api/share/compose", "shortDescription": {"text": "Unused endpoint: POST /api/share/compose"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `POST /api/share/compose` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-696b458c3bb071dd", "name": "Unused endpoint: POST /api/test", "shortDescription": {"text": "Unused endpoint: POST /api/test"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `POST /api/test` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6974362a44c38829", "name": "Unused endpoint: POST /api/auto-detect", "shortDescription": {"text": "Unused endpoint: POST /api/auto-detect"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `POST /api/auto-detect` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d5d0d48c53eebbe2", "name": "Unused endpoint: GET /api/models", "shortDescription": {"text": "Unused endpoint: GET /api/models"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `GET /api/models` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f2ff6fd0910afd49", "name": "Unused endpoint: GET /api/models/{name}", "shortDescription": {"text": "Unused endpoint: GET /api/models/{name}"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `GET /api/models/{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2cbc08e97a8f0293", "name": "Unused endpoint: GET /api/skills", "shortDescription": {"text": "Unused endpoint: GET /api/skills"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `GET /api/skills` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-db8a7d424f29b993", "name": "Unused endpoint: PUT /api/skills/{name}", "shortDescription": {"text": "Unused endpoint: PUT /api/skills/{name}"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `PUT /api/skills/{name}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a50c26d93aaaf143", "name": "Unused endpoint: GET /api/mcp/config", "shortDescription": {"text": "Unused endpoint: GET /api/mcp/config"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `GET /api/mcp/config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9452427447635e80", "name": "Unused endpoint: PUT /api/mcp/config", "shortDescription": {"text": "Unused endpoint: PUT /api/mcp/config"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `PUT /api/mcp/config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a74464b0f1216462", "name": "Unused endpoint: GET /api/memory", "shortDescription": {"text": "Unused endpoint: GET /api/memory"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `GET /api/memory` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e74804e53025cb0d", "name": "Unused endpoint: GET /api/memory/status", "shortDescription": {"text": "Unused endpoint: GET /api/memory/status"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `GET /api/memory/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-725e8e91c3053158", "name": "Unused endpoint: POST /api/memory/reload", "shortDescription": {"text": "Unused endpoint: POST /api/memory/reload"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `POST /api/memory/reload` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f0e0d0a81d0e4087", "name": "Unused endpoint: POST /api/test-key", "shortDescription": {"text": "Unused endpoint: POST /api/test-key"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `POST /api/test-key` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af76cb14779b51bc", "name": "Unused endpoint: POST /api/agent-discuss", "shortDescription": {"text": "Unused endpoint: POST /api/agent-discuss"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `POST /api/agent-discuss` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-093467ddc6e6a64d", "name": "Unused endpoint: POST /api/generate", "shortDescription": {"text": "Unused endpoint: POST /api/generate"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `POST /api/generate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0f1028e8251610c0", "name": "Unused endpoint: GET /api/preview/{project_id}", "shortDescription": {"text": "Unused endpoint: GET /api/preview/{project_id}"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `GET /api/preview/{project_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a19aab83b8462852", "name": "Unused endpoint: GET /api/project/{project_id}/{file_path:path}", "shortDescription": {"text": "Unused endpoint: GET /api/project/{project_id}/{file_path:path}"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `GET /api/project/{project_id}/{file_path:path}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-74316b7cbdd6e628", "name": "Unused endpoint: GET /api/download/{project_id}", "shortDescription": {"text": "Unused endpoint: GET /api/download/{project_id}"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `GET /api/download/{project_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c7abb3e874aaa6a4", "name": "Unused endpoint: POST /api/threads/{thread_id}/uploads", "shortDescription": {"text": "Unused endpoint: POST /api/threads/{thread_id}/uploads"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `POST /api/threads/{thread_id}/uploads` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0a005975aa9fa53e", "name": "Unused endpoint: GET /api/threads/{thread_id}/uploads/list", "shortDescription": {"text": "Unused endpoint: GET /api/threads/{thread_id}/uploads/list"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `GET /api/threads/{thread_id}/uploads/list` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-699ff8bf2e3c9954", "name": "Unused endpoint: GET /api/threads/{thread_id}/artifacts/{path:path}", "shortDescription": {"text": "Unused endpoint: GET /api/threads/{thread_id}/artifacts/{path:path}"}, "fullDescription": {"text": "`backend/src/gateway/app.py` declares `GET /api/threads/{thread_id}/artifacts/{path:path}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19915"}, "properties": {"repository": "snarsnat/protoforge-v2", "repoUrl": "https://github.com/snarsnat/protoforge-v2", "branch": "main"}, "results": [{"ruleId": "scanner-3cce67837bbf896a", "level": "note", "message": {"text": "Possibly dead Python function: reload_config"}, "properties": {"repobilityId": "c45461f481d39dd4", "scanner": "scanner-primary", "fingerprint": "3cce67837bbf896a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/config/__init__.py:160"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fd25f400f5d42ea1", "level": "note", "message": {"text": "Possibly dead Python function: enable_server"}, "properties": {"repobilityId": "464caada9e8c6e10", "scanner": "scanner-primary", "fingerprint": "fd25f400f5d42ea1", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/mcp/__init__.py:72"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-09f428254bbdd24e", "level": "note", "message": {"text": "Possibly dead Python function: disable_server"}, "properties": {"repobilityId": "144ea273de0afb01", "scanner": "scanner-primary", "fingerprint": "09f428254bbdd24e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/mcp/__init__.py:77"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-c7f39162d085a020", "level": "note", "message": {"text": "Possibly dead Python function: release_all"}, "properties": {"repobilityId": "a7283101fb68228c", "scanner": "scanner-primary", "fingerprint": "c7f39162d085a020", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/sandbox/sandbox.py:153"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ec5adaf2186d7bf0", "level": "note", "message": {"text": "Possibly dead Python function: merge_artifacts"}, "properties": {"repobilityId": "92d0808c31da6bcd", "scanner": "scanner-primary", "fingerprint": "ec5adaf2186d7bf0", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/agents/thread_state.py:69"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fbcfa902f7d217af", "level": "note", "message": {"text": "Possibly dead Python function: merge_viewed_images"}, "properties": {"repobilityId": "f33f1e5e889f1605", "scanner": "scanner-primary", "fingerprint": "fbcfa902f7d217af", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/agents/thread_state.py:80"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bbf5a50cca7c2c7d", "level": "note", "message": {"text": "Possibly dead Python function: update_context"}, "properties": {"repobilityId": "07e870c6dfef012f", "scanner": "scanner-primary", "fingerprint": "bbf5a50cca7c2c7d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/agents/memory/updater.py:64"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3c3a1e805be00a00", "level": "note", "message": {"text": "Possibly dead Python function: add_fact"}, "properties": {"repobilityId": "83b866853a3ce35d", "scanner": "scanner-primary", "fingerprint": "3c3a1e805be00a00", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/agents/memory/updater.py:70"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bdb65aa91a87595a", "level": "note", "message": {"text": "Possibly dead Python function: process_conversation"}, "properties": {"repobilityId": "d029bdf4aebad8dd", "scanner": "scanner-primary", "fingerprint": "bdb65aa91a87595a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/agents/memory/updater.py:156"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ca380a6d6c4bc9af", "level": "note", "message": {"text": "Possibly dead Python function: make_lead_agent"}, "properties": {"repobilityId": "c54b648dbc92e44e", "scanner": "scanner-primary", "fingerprint": "ca380a6d6c4bc9af", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/agents/lead_agent/agent.py:75"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-161ec3989a920632", "level": "note", "message": {"text": "Possibly dead Python function: invoke_agent"}, "properties": {"repobilityId": "1ba44df86c472686", "scanner": "scanner-primary", "fingerprint": "161ec3989a920632", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/agents/lead_agent/agent.py:119"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-550c20218f6270cc", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 desktop/preload.js:26"}, "properties": {"repobilityId": "6f9fc971e1923098", "scanner": "scanner-primary", "fingerprint": "550c20218f6270cc", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-2db691d78fa6afe1", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 desktop/main.js:184"}, "properties": {"repobilityId": "f8879926f4748cce", "scanner": "scanner-primary", "fingerprint": "2db691d78fa6afe1", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1f66ad88286ca30a", "level": "warning", "message": {"text": "Dockerfile runs as root: backend/Dockerfile"}, "properties": {"repobilityId": "7afd2b0e8a8c9eeb", "scanner": "scanner-primary", "fingerprint": "1f66ad88286ca30a", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-8cd20d539467d2c5", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "06b87ac9439092d6", "scanner": "scanner-primary", "fingerprint": "8cd20d539467d2c5", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-583132eb75854084", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in test_page.html:49"}, "properties": {"repobilityId": "f8491643c89f241a", "scanner": "scanner-primary", "fingerprint": "583132eb75854084", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "test_page.html"}, "region": {"startLine": 49}}}]}, {"ruleId": "scanner-d05afc7e44d47015", "level": "warning", "message": {"text": "Insecure pattern 'node_child_process' in desktop/main.js:3"}, "properties": {"repobilityId": "87b9463cace58d3c", "scanner": "scanner-primary", "fingerprint": "d05afc7e44d47015", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "node_child_process"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "desktop/main.js"}, "region": {"startLine": 3}}}]}, {"ruleId": "scanner-e7e8b326ecbd1888", "level": "warning", "message": {"text": "Insecure pattern 'subprocess_shell_true' in backend/src/sandbox/sandbox.py:72"}, "properties": {"repobilityId": "321d887207999aab", "scanner": "scanner-primary", "fingerprint": "e7e8b326ecbd1888", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "subprocess_shell_true"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/sandbox/sandbox.py"}, "region": {"startLine": 72}}}]}, {"ruleId": "scanner-7444e066e2b079c1", "level": "note", "message": {"text": "package.json defines install-time lifecycle scripts"}, "properties": {"repobilityId": "a347c699922c0927", "scanner": "scanner-primary", "fingerprint": "7444e066e2b079c1", "layer": "cicd", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "npm", "install-scripts"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "desktop/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-0e8a76eb13fd3249", "level": "note", "message": {"text": "Node manifest has dependencies but no lockfile: frontend/package.json"}, "properties": {"repobilityId": "d8c65da5b68ee95b", "scanner": "scanner-primary", "fingerprint": "0e8a76eb13fd3249", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["dependency", "lockfile", "reproducibility", "generated-repo-pattern"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/package.json"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "457c418ca9be1450", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "3e535c6d40e0b265", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "dfeb634b5ee6a85b", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "2f925a18532ff08c", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "6e1fe7a07c834e5c", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-2679282aa1c484b5", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: AGENTS.md"}, "properties": {"repobilityId": "27d579812e6be614", "scanner": "scanner-primary", "fingerprint": "2679282aa1c484b5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "agents_md"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "AGENTS.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ac12cc3bf39127aa", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/public/code-generation/SKILL.md"}, "properties": {"repobilityId": "66ef6839539cc12a", "scanner": "scanner-primary", "fingerprint": "ac12cc3bf39127aa", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/public/code-generation/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6a6353acb3769a2a", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/public/diagram-generation/SKILL.md"}, "properties": {"repobilityId": "ef8b7940f041e74f", "scanner": "scanner-primary", "fingerprint": "6a6353acb3769a2a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/public/diagram-generation/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-74b502c910e54b16", "level": "warning", "message": {"text": "Agent authority lacks a verifier contract: skills/public/3d-modeling/SKILL.md"}, "properties": {"repobilityId": "58a88fac940086f5", "scanner": "scanner-primary", "fingerprint": "74b502c910e54b16", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "verification", "skill_file"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "skills/public/3d-modeling/SKILL.md"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e725d2ab884fbd49", "level": "note", "message": {"text": "Multiple root agent instruction files without precedence"}, "properties": {"repobilityId": "1953db6c89508d22", "scanner": "scanner-primary", "fingerprint": "e725d2ab884fbd49", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["agent-instructions", "governance"]}}, {"ruleId": "scanner-d0b17c8c07a7421d", "level": "note", "message": {"text": "8 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "17fe720e8247f9df", "scanner": "scanner-primary", "fingerprint": "d0b17c8c07a7421d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "a944758788e129ed", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "43a50e5d7fe7efec", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "d29dc167c23d9be6", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "0719820ed96deb36", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "bfbc15c88dca47f9", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "80d99cbfef7ef909", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-b8498aa5a899b59e", "level": "error", "message": {"text": "FastAPI POST `paypal_webhook` without auth dependency \u2014 backend/src/gateway/app.py:275"}, "properties": {"repobilityId": "9be314bf4a1eeaa1", "scanner": "scanner-primary", "fingerprint": "b8498aa5a899b59e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/gateway/app.py"}, "region": {"startLine": 275}}}]}, {"ruleId": "scanner-3fee642d49197e27", "level": "error", "message": {"text": "FastAPI POST `enable_dev_mode` without auth dependency \u2014 backend/src/gateway/app.py:316"}, "properties": {"repobilityId": "5b5e0bf5863b9831", "scanner": "scanner-primary", "fingerprint": "3fee642d49197e27", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/gateway/app.py"}, "region": {"startLine": 316}}}]}, {"ruleId": "scanner-1ee4c026b32010d5", "level": "error", "message": {"text": "FastAPI POST `plan` without auth dependency \u2014 backend/src/gateway/app.py:413"}, "properties": {"repobilityId": "d4d125f021c6f062", "scanner": "scanner-primary", "fingerprint": "1ee4c026b32010d5", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/gateway/app.py"}, "region": {"startLine": 413}}}]}, {"ruleId": "scanner-5e5fa179f3916718", "level": "error", "message": {"text": "FastAPI POST `edit_part` without auth dependency \u2014 backend/src/gateway/app.py:468"}, "properties": {"repobilityId": "5b892b7c59eb2390", "scanner": "scanner-primary", "fingerprint": "5e5fa179f3916718", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/gateway/app.py"}, "region": {"startLine": 468}}}]}, {"ruleId": "scanner-3150d7cd46fc9e7b", "level": "error", "message": {"text": "FastAPI POST `github_start` without auth dependency \u2014 backend/src/gateway/app.py:587"}, "properties": {"repobilityId": "f4a2945c1a127ef5", "scanner": "scanner-primary", "fingerprint": "3150d7cd46fc9e7b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/gateway/app.py"}, "region": {"startLine": 587}}}]}, {"ruleId": "scanner-3aa523725ed2c12a", "level": "error", "message": {"text": "FastAPI POST `github_poll` without auth dependency \u2014 backend/src/gateway/app.py:604"}, "properties": {"repobilityId": "7dd9b97b3d621a17", "scanner": "scanner-primary", "fingerprint": "3aa523725ed2c12a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/gateway/app.py"}, "region": {"startLine": 604}}}]}, {"ruleId": "scanner-29eb85b13880113b", "level": "error", "message": {"text": "FastAPI POST `share_compose` without auth dependency \u2014 backend/src/gateway/app.py:708"}, "properties": {"repobilityId": "bfab09915ba28c76", "scanner": "scanner-primary", "fingerprint": "29eb85b13880113b", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/gateway/app.py"}, "region": {"startLine": 708}}}]}, {"ruleId": "scanner-68d6d1ea45d2f193", "level": "error", "message": {"text": "FastAPI POST `test_api` without auth dependency \u2014 backend/src/gateway/app.py:742"}, "properties": {"repobilityId": "908765baf83b5844", "scanner": "scanner-primary", "fingerprint": "68d6d1ea45d2f193", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/gateway/app.py"}, "region": {"startLine": 742}}}]}, {"ruleId": "scanner-66d956f4173c72aa", "level": "error", "message": {"text": "FastAPI POST `auto_detect_model` without auth dependency \u2014 backend/src/gateway/app.py:780"}, "properties": {"repobilityId": "c97b30b51324b872", "scanner": "scanner-primary", "fingerprint": "66d956f4173c72aa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/gateway/app.py"}, "region": {"startLine": 780}}}]}, {"ruleId": "scanner-ffb09c6f3d3065a9", "level": "error", "message": {"text": "FastAPI PUT `update_skill` without auth dependency \u2014 backend/src/gateway/app.py:890"}, "properties": {"repobilityId": "078f722d461288ab", "scanner": "scanner-primary", "fingerprint": "ffb09c6f3d3065a9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/gateway/app.py"}, "region": {"startLine": 890}}}]}, {"ruleId": "scanner-c957cd07d5727d60", "level": "error", "message": {"text": "FastAPI PUT `update_mcp_config` without auth dependency \u2014 backend/src/gateway/app.py:912"}, "properties": {"repobilityId": "5e84825bdd611372", "scanner": "scanner-primary", "fingerprint": "c957cd07d5727d60", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/gateway/app.py"}, "region": {"startLine": 912}}}]}, {"ruleId": "scanner-0f77a8db4bba6de0", "level": "error", "message": {"text": "FastAPI POST `reload_memory` without auth dependency \u2014 backend/src/gateway/app.py:949"}, "properties": {"repobilityId": "d51d469e782b35df", "scanner": "scanner-primary", "fingerprint": "0f77a8db4bba6de0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/gateway/app.py"}, "region": {"startLine": 949}}}]}, {"ruleId": "scanner-5c3c6a8ddb726f73", "level": "error", "message": {"text": "FastAPI POST `test_api_key` without auth dependency \u2014 backend/src/gateway/app.py:956"}, "properties": {"repobilityId": "3e76c11d2adb4119", "scanner": "scanner-primary", "fingerprint": "5c3c6a8ddb726f73", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/gateway/app.py"}, "region": {"startLine": 956}}}]}, {"ruleId": "scanner-aa0025b26503fa02", "level": "error", "message": {"text": "FastAPI POST `agent_discuss` without auth dependency \u2014 backend/src/gateway/app.py:999"}, "properties": {"repobilityId": "3e0e6d7c737ae6dd", "scanner": "scanner-primary", "fingerprint": "aa0025b26503fa02", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/gateway/app.py"}, "region": {"startLine": 999}}}]}, {"ruleId": "scanner-871f281a86966670", "level": "error", "message": {"text": "FastAPI POST `generate` without auth dependency \u2014 backend/src/gateway/app.py:1059"}, "properties": {"repobilityId": "850baefb733fc32e", "scanner": "scanner-primary", "fingerprint": "871f281a86966670", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/gateway/app.py"}, "region": {"startLine": 1059}}}]}, {"ruleId": "scanner-5178b7697b9e69f7", "level": "error", "message": {"text": "FastAPI POST `upload_files` without auth dependency \u2014 backend/src/gateway/app.py:1208"}, "properties": {"repobilityId": "1824373d52349930", "scanner": "scanner-primary", "fingerprint": "5178b7697b9e69f7", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/src/gateway/app.py"}, "region": {"startLine": 1208}}}]}, {"ruleId": "scanner-f46028d75888e8bf", "level": "error", "message": {"text": "Dangling fetch: POST http://localhost:8001/api/auto-detect (frontend/src/app/page.tsx:26)"}, "properties": {"repobilityId": "6e6e028d91c30db1", "scanner": "scanner-primary", "fingerprint": "f46028d75888e8bf", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-a08a476c0b443177", "level": "error", "message": {"text": "Dangling fetch: POST http://localhost:8001/api/test (frontend/src/app/page.tsx:64)"}, "properties": {"repobilityId": "ee0df9869413dd15", "scanner": "scanner-primary", "fingerprint": "a08a476c0b443177", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-cd2c7ae452e709ae", "level": "error", "message": {"text": "Dangling fetch: POST http://localhost:8001/api/generate (frontend/src/app/page.tsx:105)"}, "properties": {"repobilityId": "ba4cfdc80717f35c", "scanner": "scanner-primary", "fingerprint": "cd2c7ae452e709ae", "layer": "api", "severity": "high", "confidence": 1.0, "tags": ["wiring", "dangling-fetch", "fetch"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "ad674004761d512b", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b875e59eb7995957", "level": "note", "message": {"text": "Unused endpoint: GET /api/license/status"}, "properties": {"repobilityId": "4932e5b41c9414d9", "scanner": "scanner-primary", "fingerprint": "b875e59eb7995957", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-17805c102de7651c", "level": "note", "message": {"text": "Unused endpoint: POST /api/paypal/webhook"}, "properties": {"repobilityId": "ba29a5883557b18c", "scanner": "scanner-primary", "fingerprint": "17805c102de7651c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-11ff4dca02201970", "level": "note", "message": {"text": "Unused endpoint: GET /api/dev/status"}, "properties": {"repobilityId": "0202a487031f27c4", "scanner": "scanner-primary", "fingerprint": "11ff4dca02201970", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-42632db1c90b02c7", "level": "note", "message": {"text": "Unused endpoint: POST /api/dev/enable"}, "properties": {"repobilityId": "b96c2f3a93fc839b", "scanner": "scanner-primary", "fingerprint": "42632db1c90b02c7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-20998b34e812e3c5", "level": "note", "message": {"text": "Unused endpoint: GET /favicon.png"}, "properties": {"repobilityId": "04a592f6cbdeb76e", "scanner": "scanner-primary", "fingerprint": "20998b34e812e3c5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bce8115208f614c2", "level": "note", "message": {"text": "Unused endpoint: POST /api/plan"}, "properties": {"repobilityId": "c0a40a05667c1c7e", "scanner": "scanner-primary", "fingerprint": "bce8115208f614c2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-90d4f09e7684af11", "level": "note", "message": {"text": "Unused endpoint: POST /api/edit-part"}, "properties": {"repobilityId": "586ef4f5580aeac7", "scanner": "scanner-primary", "fingerprint": "90d4f09e7684af11", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-55e6f47e305c8c41", "level": "note", "message": {"text": "Unused endpoint: POST /api/oauth/github/start"}, "properties": {"repobilityId": "2f8c849beb454e58", "scanner": "scanner-primary", "fingerprint": "55e6f47e305c8c41", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f4a212aab54b55cc", "level": "note", "message": {"text": "Unused endpoint: POST /api/oauth/github/poll"}, "properties": {"repobilityId": "fce74eccf195d95a", "scanner": "scanner-primary", "fingerprint": "f4a212aab54b55cc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0849a54ee1b20e78", "level": "note", "message": {"text": "Unused endpoint: GET /api/oauth/google/start"}, "properties": {"repobilityId": "9edd745f8e9f703f", "scanner": "scanner-primary", "fingerprint": "0849a54ee1b20e78", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-eb03a5115c2d8a71", "level": "note", "message": {"text": "Unused endpoint: GET /oauth/google/callback"}, "properties": {"repobilityId": "53860d48f2ed85cc", "scanner": "scanner-primary", "fingerprint": "eb03a5115c2d8a71", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a5c9736c1be2c9fd", "level": "note", "message": {"text": "Unused endpoint: GET /api/oauth/google/result"}, "properties": {"repobilityId": "9eb2dcac88c9cc41", "scanner": "scanner-primary", "fingerprint": "a5c9736c1be2c9fd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bf359ce2b3cee98a", "level": "note", "message": {"text": "Unused endpoint: POST /api/share/compose"}, "properties": {"repobilityId": "98d0146c20eaa154", "scanner": "scanner-primary", "fingerprint": "bf359ce2b3cee98a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-696b458c3bb071dd", "level": "note", "message": {"text": "Unused endpoint: POST /api/test"}, "properties": {"repobilityId": "55d423bb0b9a2735", "scanner": "scanner-primary", "fingerprint": "696b458c3bb071dd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6974362a44c38829", "level": "note", "message": {"text": "Unused endpoint: POST /api/auto-detect"}, "properties": {"repobilityId": "315c65891448641c", "scanner": "scanner-primary", "fingerprint": "6974362a44c38829", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d5d0d48c53eebbe2", "level": "note", "message": {"text": "Unused endpoint: GET /api/models"}, "properties": {"repobilityId": "61bca880f3c8a016", "scanner": "scanner-primary", "fingerprint": "d5d0d48c53eebbe2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f2ff6fd0910afd49", "level": "note", "message": {"text": "Unused endpoint: GET /api/models/{name}"}, "properties": {"repobilityId": "8d899db21fc73c29", "scanner": "scanner-primary", "fingerprint": "f2ff6fd0910afd49", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2cbc08e97a8f0293", "level": "note", "message": {"text": "Unused endpoint: GET /api/skills"}, "properties": {"repobilityId": "6bf28aaad4963953", "scanner": "scanner-primary", "fingerprint": "2cbc08e97a8f0293", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-db8a7d424f29b993", "level": "note", "message": {"text": "Unused endpoint: PUT /api/skills/{name}"}, "properties": {"repobilityId": "c0cbe6028ad20fc8", "scanner": "scanner-primary", "fingerprint": "db8a7d424f29b993", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a50c26d93aaaf143", "level": "note", "message": {"text": "Unused endpoint: GET /api/mcp/config"}, "properties": {"repobilityId": "0a227e13d414be22", "scanner": "scanner-primary", "fingerprint": "a50c26d93aaaf143", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9452427447635e80", "level": "note", "message": {"text": "Unused endpoint: PUT /api/mcp/config"}, "properties": {"repobilityId": "0074ddf562ebb467", "scanner": "scanner-primary", "fingerprint": "9452427447635e80", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a74464b0f1216462", "level": "note", "message": {"text": "Unused endpoint: GET /api/memory"}, "properties": {"repobilityId": "db1fe39cb1505fc5", "scanner": "scanner-primary", "fingerprint": "a74464b0f1216462", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e74804e53025cb0d", "level": "note", "message": {"text": "Unused endpoint: GET /api/memory/status"}, "properties": {"repobilityId": "24eb224d8abddb66", "scanner": "scanner-primary", "fingerprint": "e74804e53025cb0d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-725e8e91c3053158", "level": "note", "message": {"text": "Unused endpoint: POST /api/memory/reload"}, "properties": {"repobilityId": "6653d1f010dd2028", "scanner": "scanner-primary", "fingerprint": "725e8e91c3053158", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f0e0d0a81d0e4087", "level": "note", "message": {"text": "Unused endpoint: POST /api/test-key"}, "properties": {"repobilityId": "a208769c17831494", "scanner": "scanner-primary", "fingerprint": "f0e0d0a81d0e4087", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-af76cb14779b51bc", "level": "note", "message": {"text": "Unused endpoint: POST /api/agent-discuss"}, "properties": {"repobilityId": "5a67ef54f77c997b", "scanner": "scanner-primary", "fingerprint": "af76cb14779b51bc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-093467ddc6e6a64d", "level": "note", "message": {"text": "Unused endpoint: POST /api/generate"}, "properties": {"repobilityId": "75e0e51e98d8d359", "scanner": "scanner-primary", "fingerprint": "093467ddc6e6a64d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0f1028e8251610c0", "level": "note", "message": {"text": "Unused endpoint: GET /api/preview/{project_id}"}, "properties": {"repobilityId": "90c070e8d12ac69a", "scanner": "scanner-primary", "fingerprint": "0f1028e8251610c0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a19aab83b8462852", "level": "note", "message": {"text": "Unused endpoint: GET /api/project/{project_id}/{file_path:path}"}, "properties": {"repobilityId": "b1732332df92e2f7", "scanner": "scanner-primary", "fingerprint": "a19aab83b8462852", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-74316b7cbdd6e628", "level": "note", "message": {"text": "Unused endpoint: GET /api/download/{project_id}"}, "properties": {"repobilityId": "cd5c6513a46130ec", "scanner": "scanner-primary", "fingerprint": "74316b7cbdd6e628", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c7abb3e874aaa6a4", "level": "note", "message": {"text": "Unused endpoint: POST /api/threads/{thread_id}/uploads"}, "properties": {"repobilityId": "98f719070f9eb25c", "scanner": "scanner-primary", "fingerprint": "c7abb3e874aaa6a4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0a005975aa9fa53e", "level": "note", "message": {"text": "Unused endpoint: GET /api/threads/{thread_id}/uploads/list"}, "properties": {"repobilityId": "9ede0ce22357278e", "scanner": "scanner-primary", "fingerprint": "0a005975aa9fa53e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-699ff8bf2e3c9954", "level": "note", "message": {"text": "Unused endpoint: GET /api/threads/{thread_id}/artifacts/{path:path}"}, "properties": {"repobilityId": "49933ae6e9e2941a", "scanner": "scanner-primary", "fingerprint": "699ff8bf2e3c9954", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}