{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-99873815d71af90f", "name": "Possibly dead Python function: delete_device_profile", "shortDescription": {"text": "Possibly dead Python function: delete_device_profile"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-15e95ed2ad67bb37", "name": "Dockerfile runs as root: solar-brain-addon/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: solar-brain-addon/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-07b42db98124f85d", "name": "Legacy-named symbol `test_supervisor_still_wins_over_legacy` in solar-brain-addon/tests/test_backcompat.py:59", "shortDescription": {"text": "Legacy-named symbol `test_supervisor_still_wins_over_legacy` in solar-brain-addon/tests/test_backcompat.py:59"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-173356d5f9d696bc", "name": "Legacy-named symbol `model_copy` in solar-brain-addon/app/weather_client.py:61", "shortDescription": {"text": "Legacy-named symbol `model_copy` in solar-brain-addon/app/weather_client.py:61"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nsolar-brain-addon/app/ha_client.py:get_states, solar-brain-addon/app/ha_client.py:get_state\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e4ca0f7790ad91ba", "name": "FastAPI POST `api_save_mapping` without auth dependency \u2014 solar-brain-addon/app/main.py:213", "shortDescription": {"text": "FastAPI POST `api_save_mapping` without auth dependency \u2014 solar-brain-addon/app/main.py:213"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7f5e9113807aed96", "name": "FastAPI POST `api_save_device_profiles` without auth dependency \u2014 solar-brain-addon/app/main.py:286", "shortDescription": {"text": "FastAPI POST `api_save_device_profiles` without auth dependency \u2014 solar-brain-addon/app/main.py:286"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-39e301ce947d61b9", "name": "Unused endpoint: GET /api/debug/runtime", "shortDescription": {"text": "Unused endpoint: GET /api/debug/runtime"}, "fullDescription": {"text": "`solar-brain-addon/app/main.py` declares `GET /api/debug/runtime` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`solar-brain-addon/app/main.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-97d78f0130981cac", "name": "Unused endpoint: GET /settings/entities", "shortDescription": {"text": "Unused endpoint: GET /settings/entities"}, "fullDescription": {"text": "`solar-brain-addon/app/main.py` declares `GET /settings/entities` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-360acbe70a5d5329", "name": "Unused endpoint: GET /savings", "shortDescription": {"text": "Unused endpoint: GET /savings"}, "fullDescription": {"text": "`solar-brain-addon/app/main.py` declares `GET /savings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e8ebe817d16c5e42", "name": "Unused endpoint: GET /devices", "shortDescription": {"text": "Unused endpoint: GET /devices"}, "fullDescription": {"text": "`solar-brain-addon/app/main.py` declares `GET /devices` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0af282f0af1e25b1", "name": "Unused endpoint: GET /settings/devices", "shortDescription": {"text": "Unused endpoint: GET /settings/devices"}, "fullDescription": {"text": "`solar-brain-addon/app/main.py` declares `GET /settings/devices` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee1136e8b8865aeb", "name": "Unused endpoint: GET /api/entities/discover", "shortDescription": {"text": "Unused endpoint: GET /api/entities/discover"}, "fullDescription": {"text": "`solar-brain-addon/app/main.py` declares `GET /api/entities/discover` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9e1b5035b775813d", "name": "Unused endpoint: GET /api/entities/mapping", "shortDescription": {"text": "Unused endpoint: GET /api/entities/mapping"}, "fullDescription": {"text": "`solar-brain-addon/app/main.py` declares `GET /api/entities/mapping` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0ff615e7b0bc6916", "name": "Unused endpoint: POST /api/entities/mapping", "shortDescription": {"text": "Unused endpoint: POST /api/entities/mapping"}, "fullDescription": {"text": "`solar-brain-addon/app/main.py` declares `POST /api/entities/mapping` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-89ced72cd7c013e1", "name": "Unused endpoint: GET /api/home/recommendation", "shortDescription": {"text": "Unused endpoint: GET /api/home/recommendation"}, "fullDescription": {"text": "`solar-brain-addon/app/main.py` declares `GET /api/home/recommendation` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-403df697f1175854", "name": "Unused endpoint: GET /api/devices/profiles", "shortDescription": {"text": "Unused endpoint: GET /api/devices/profiles"}, "fullDescription": {"text": "`solar-brain-addon/app/main.py` declares `GET /api/devices/profiles` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4872a2edb74541f0", "name": "Unused endpoint: POST /api/devices/profiles", "shortDescription": {"text": "Unused endpoint: POST /api/devices/profiles"}, "fullDescription": {"text": "`solar-brain-addon/app/main.py` declares `POST /api/devices/profiles` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d30f4841f9488d47", "name": "Unused endpoint: GET /api/devices", "shortDescription": {"text": "Unused endpoint: GET /api/devices"}, "fullDescription": {"text": "`solar-brain-addon/app/main.py` declares `GET /api/devices` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c4d8670b767246cf", "name": "Unused endpoint: GET /api/telemetry/current", "shortDescription": {"text": "Unused endpoint: GET /api/telemetry/current"}, "fullDescription": {"text": "`solar-brain-addon/app/main.py` declares `GET /api/telemetry/current` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a3c34333373e035a", "name": "Unused endpoint: GET /api/savings/current", "shortDescription": {"text": "Unused endpoint: GET /api/savings/current"}, "fullDescription": {"text": "`solar-brain-addon/app/main.py` declares `GET /api/savings/current` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7de956bdf931a5a2", "name": "Unused endpoint: GET /api/savings/summary", "shortDescription": {"text": "Unused endpoint: GET /api/savings/summary"}, "fullDescription": {"text": "`solar-brain-addon/app/main.py` declares `GET /api/savings/summary` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-40aedc98f8ff6f3a", "name": "Unused endpoint: GET /api/savings/detail", "shortDescription": {"text": "Unused endpoint: GET /api/savings/detail"}, "fullDescription": {"text": "`solar-brain-addon/app/main.py` declares `GET /api/savings/detail` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-963710f42a2c8219", "name": "Unused endpoint: GET /api/status", "shortDescription": {"text": "Unused endpoint: GET /api/status"}, "fullDescription": {"text": "`solar-brain-addon/app/main.py` declares `GET /api/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7582ef5d4bb01c79", "name": "Unused endpoint: GET /api/recommendation", "shortDescription": {"text": "Unused endpoint: GET /api/recommendation"}, "fullDescription": {"text": "`solar-brain-addon/app/main.py` declares `GET /api/recommendation` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/23032"}, "properties": {"repository": "Xinyin-0913/solar-brain-addon", "repoUrl": "https://github.com/Xinyin-0913/solar-brain-addon", "branch": "main"}, "results": [{"ruleId": "scanner-99873815d71af90f", "level": "note", "message": {"text": "Possibly dead Python function: delete_device_profile"}, "properties": {"repobilityId": "283a31af757dbf08", "scanner": "scanner-primary", "fingerprint": "99873815d71af90f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "solar-brain-addon/app/database.py:253"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-15e95ed2ad67bb37", "level": "warning", "message": {"text": "Dockerfile runs as root: solar-brain-addon/Dockerfile"}, "properties": {"repobilityId": "0ce364b04c43bf5b", "scanner": "scanner-primary", "fingerprint": "15e95ed2ad67bb37", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "f6387c2b056bb2c3", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "97739dedc4a8c277", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "89086115a4757bb4", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "bbe4239858c74916", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "a6f19bf1042feb2b", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "121f83cb190338aa", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-07b42db98124f85d", "level": "note", "message": {"text": "Legacy-named symbol `test_supervisor_still_wins_over_legacy` in solar-brain-addon/tests/test_backcompat.py:59"}, "properties": {"repobilityId": "bfcc08e257d6f22d", "scanner": "scanner-primary", "fingerprint": "07b42db98124f85d", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-173356d5f9d696bc", "level": "note", "message": {"text": "Legacy-named symbol `model_copy` in solar-brain-addon/app/weather_client.py:61"}, "properties": {"repobilityId": "566b0146e1e492ed", "scanner": "scanner-primary", "fingerprint": "173356d5f9d696bc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "889cddc79216436c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-e4ca0f7790ad91ba", "level": "error", "message": {"text": "FastAPI POST `api_save_mapping` without auth dependency \u2014 solar-brain-addon/app/main.py:213"}, "properties": {"repobilityId": "4ff3bb97fbfd804c", "scanner": "scanner-primary", "fingerprint": "e4ca0f7790ad91ba", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "solar-brain-addon/app/main.py"}, "region": {"startLine": 213}}}]}, {"ruleId": "scanner-7f5e9113807aed96", "level": "error", "message": {"text": "FastAPI POST `api_save_device_profiles` without auth dependency \u2014 solar-brain-addon/app/main.py:286"}, "properties": {"repobilityId": "2fbb7db3e7a45ad5", "scanner": "scanner-primary", "fingerprint": "7f5e9113807aed96", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "solar-brain-addon/app/main.py"}, "region": {"startLine": 286}}}]}, {"ruleId": "scanner-39e301ce947d61b9", "level": "note", "message": {"text": "Unused endpoint: GET /api/debug/runtime"}, "properties": {"repobilityId": "f5e55d8e1eb8ee48", "scanner": "scanner-primary", "fingerprint": "39e301ce947d61b9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "9619ed0363e9c892", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-97d78f0130981cac", "level": "note", "message": {"text": "Unused endpoint: GET /settings/entities"}, "properties": {"repobilityId": "5b66d31b1ed08a64", "scanner": "scanner-primary", "fingerprint": "97d78f0130981cac", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-360acbe70a5d5329", "level": "note", "message": {"text": "Unused endpoint: GET /savings"}, "properties": {"repobilityId": "e40e7921e2aa95f4", "scanner": "scanner-primary", "fingerprint": "360acbe70a5d5329", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e8ebe817d16c5e42", "level": "note", "message": {"text": "Unused endpoint: GET /devices"}, "properties": {"repobilityId": "932a5aa9a94e5383", "scanner": "scanner-primary", "fingerprint": "e8ebe817d16c5e42", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0af282f0af1e25b1", "level": "note", "message": {"text": "Unused endpoint: GET /settings/devices"}, "properties": {"repobilityId": "d57222a578ab80a9", "scanner": "scanner-primary", "fingerprint": "0af282f0af1e25b1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ee1136e8b8865aeb", "level": "note", "message": {"text": "Unused endpoint: GET /api/entities/discover"}, "properties": {"repobilityId": "9ebc839311034d4f", "scanner": "scanner-primary", "fingerprint": "ee1136e8b8865aeb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9e1b5035b775813d", "level": "note", "message": {"text": "Unused endpoint: GET /api/entities/mapping"}, "properties": {"repobilityId": "f2d4c67205523e3a", "scanner": "scanner-primary", "fingerprint": "9e1b5035b775813d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0ff615e7b0bc6916", "level": "note", "message": {"text": "Unused endpoint: POST /api/entities/mapping"}, "properties": {"repobilityId": "cb4859c5ddd08a24", "scanner": "scanner-primary", "fingerprint": "0ff615e7b0bc6916", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-89ced72cd7c013e1", "level": "note", "message": {"text": "Unused endpoint: GET /api/home/recommendation"}, "properties": {"repobilityId": "141602963a65da96", "scanner": "scanner-primary", "fingerprint": "89ced72cd7c013e1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-403df697f1175854", "level": "note", "message": {"text": "Unused endpoint: GET /api/devices/profiles"}, "properties": {"repobilityId": "b2eaa8cb1e5ebdc9", "scanner": "scanner-primary", "fingerprint": "403df697f1175854", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4872a2edb74541f0", "level": "note", "message": {"text": "Unused endpoint: POST /api/devices/profiles"}, "properties": {"repobilityId": "25d8bdfdac590b56", "scanner": "scanner-primary", "fingerprint": "4872a2edb74541f0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d30f4841f9488d47", "level": "note", "message": {"text": "Unused endpoint: GET /api/devices"}, "properties": {"repobilityId": "c2d589c7b1b37a13", "scanner": "scanner-primary", "fingerprint": "d30f4841f9488d47", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c4d8670b767246cf", "level": "note", "message": {"text": "Unused endpoint: GET /api/telemetry/current"}, "properties": {"repobilityId": "0c6c05be82fe3873", "scanner": "scanner-primary", "fingerprint": "c4d8670b767246cf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a3c34333373e035a", "level": "note", "message": {"text": "Unused endpoint: GET /api/savings/current"}, "properties": {"repobilityId": "f82b487e0f65b37e", "scanner": "scanner-primary", "fingerprint": "a3c34333373e035a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7de956bdf931a5a2", "level": "note", "message": {"text": "Unused endpoint: GET /api/savings/summary"}, "properties": {"repobilityId": "83c882e45eccf662", "scanner": "scanner-primary", "fingerprint": "7de956bdf931a5a2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-40aedc98f8ff6f3a", "level": "note", "message": {"text": "Unused endpoint: GET /api/savings/detail"}, "properties": {"repobilityId": "28f1f8f7c16e785e", "scanner": "scanner-primary", "fingerprint": "40aedc98f8ff6f3a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-963710f42a2c8219", "level": "note", "message": {"text": "Unused endpoint: GET /api/status"}, "properties": {"repobilityId": "3c1e7ffa3e74c91b", "scanner": "scanner-primary", "fingerprint": "963710f42a2c8219", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7582ef5d4bb01c79", "level": "note", "message": {"text": "Unused endpoint: GET /api/recommendation"}, "properties": {"repobilityId": "16c91d075466133e", "scanner": "scanner-primary", "fingerprint": "7582ef5d4bb01c79", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}