Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

skengman853/b_admin

https://github.com/skengman853/b_admin · scanned 2026-06-16 00:14 UTC (2 months, 2 weeks ago)

112 raw signals (0 security + 112 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 2 weeks ago · v1 · 85 actionable findings from 1 signal source. 27 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
66.5
/100
Security checks
67
0 findings
System graph
67
100.0% cov · 85 findings
Critical
0
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 0 High 1 Medium 9 Low 73 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 85 Crowd 0 Layer: Software 6 Hardware 3 Frontend 1 Security 8 Cicd 1 Quality 16 Api 50
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 66.5/100 with 100.0% coverage. It contains 1460 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 112 findings — concentrated in api (50), software (27), quality (22). Risk profile is high: 0 critical, 1 high, 9 medium. Recommended next step: open the api layer findings first — that's where the highest-impact wins live.

Showing 83 of 85 actionable findings. 112 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high System graph security auth conf 1.00 FastAPI POST `gmail_webhook` without auth dependency — backend/app/api/webhooks.py:6
`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public.
backend/app/api/webhooks.py:6 securityAuth fastapi unauth mutation
medium System graph hardware Security conf 1.00 Dockerfile runs as root: backend/Dockerfile
No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.
Container
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in backend/app/static/month-audit.html:481
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
backend/app/static/month-audit.html:481 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in backend/app/static/reconciliation-review.html:1245
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
backend/app/static/reconciliation-review.html:1245 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in backend/app/static/statement-workbench.html:487
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
backend/app/static/statement-workbench.html:487 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in backend/app/static/supplier-documents.html:394
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
backend/app/static/supplier-documents.html:394 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in backend/app/static/transactions.html:292
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
backend/app/static/transactions.html:292 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'direct_innerhtml_assignment' in backend/app/static/vat-book.html:104
Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible.
backend/app/static/vat-book.html:104 Direct innerhtml assignment
medium System graph security security conf 1.00 Insecure pattern 'local_storage_auth_token' in backend/app/static/reconciliation-review.html:1802
Found a known-risky pattern (local_storage_auth_token). Review and replace if possible.
backend/app/static/reconciliation-review.html:1802 Local storage auth token
medium System graph cicd CI/CD security conf 1.00 No CI/CD pipelines detected
No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints.
CI/CD securityCoverage
low System graph quality Production readiness conf 1.00 Composite production-readiness gap
Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation.
Repo hardeningGenerated repo pattern
low System graph hardware Coverage conf 1.00 Containers defined but no K8s/orchestration manifest found
Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo.
Deployment
low System graph quality Debug conf 1.00 Debug logging residue appears in source files
Found 35 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup.
CleanupRepo hardeningGenerated repo pattern
low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: python:3.11-slim
Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.
backend/Dockerfile:1 containersPinned dependencies
low System graph quality Integrity conf 1.00 7 occurrences Near-duplicate function bodies in 2 places
Functions with the same first-5-line body hash: backend/app/api/invoices.py:get_invoice, backend/app/api/invoices.py:reject_invoice This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate.
7 occurrences
repo-level (7 hits)
duplicatesduplication
low System graph quality Integrity conf 1.00 Near-duplicate function bodies in 3 places
Functions with the same first-5-line body hash: backend/app/api/documents.py:get_document, backend/app/api/documents.py:get_document_file, backend/app/api/documents.py:split_document This is *the* AI-coder failure mode (4× more duplication in vibe-coded repos — see https://jw.hn/ai-code-hygiene). …
duplicatesduplication
low System graph quality License conf 1.00 No license file detected
No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake.
Repo hardeningGenerated repo pattern
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `document_extraction_v1` in backend/app/services/document_extraction.py:29
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `document_extraction_v1` in backend/tests/test_document_extraction_runs.py:126
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `hard_copy` in backend/app/schemas.py:936
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `hard_copy` in backend/app/services/transaction_rules.py:41
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `list_objects_v2` in backend/scripts/upload_backup_to_r2.py:44
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph quality Integrity conf 1.00 Old/deprecated-named symbol `reconciliation_matcher_v1` in backend/app/services/reconciliation_suggestions.py:29
Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version.
old markerDead code
low System graph software Dead code conf 1.00 Possibly dead Python function: build_transaction_reconciliation_item_from_db
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
backend/app/services/transaction_reconciliation.py:758
low System graph software Dead code conf 1.00 Possibly dead Python function: do_run_migrations
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
backend/alembic/env.py:33
low System graph software Dead code conf 1.00 11 occurrences Possibly dead Python function: downgrade
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
11 files, 11 locations
backend/alembic/versions/1c2b3f4d5e6f_add_invoice_document_projection_fields.py:36
backend/alembic/versions/2f6d6d6c43c1_add_document_extraction_fields.py:33
backend/alembic/versions/4d7e8f9a0b1c_add_transactions_tables.py:100
backend/alembic/versions/5f8a1c2d3e4b_add_transaction_source_type.py:38
backend/alembic/versions/7b9e8d1f4c2a_add_document_split_fields.py:45
backend/alembic/versions/824e6a858fd9_initial.py:76
backend/alembic/versions/b1c2d3e4f5a6_add_ai_extraction_fields_to_documents.py:27
backend/alembic/versions/b2c3d4e5f6a7_add_statement_control_totals.py:32
low System graph software Dead code conf 1.00 Possibly dead Python function: find_matching_statement_settlements
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
backend/app/services/document_ledger.py:266
low System graph software Dead code conf 1.00 Possibly dead Python function: flatten_ledger_entries
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
backend/app/services/document_ledger.py:183
low System graph software Dead code conf 1.00 12 occurrences Possibly dead Python function: upgrade
No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler.
12 files, 12 locations
backend/alembic/versions/1c2b3f4d5e6f_add_invoice_document_projection_fields.py:20
backend/alembic/versions/2f6d6d6c43c1_add_document_extraction_fields.py:20
backend/alembic/versions/4d7e8f9a0b1c_add_transactions_tables.py:20
backend/alembic/versions/5f8a1c2d3e4b_add_transaction_source_type.py:20
backend/alembic/versions/7b9e8d1f4c2a_add_document_split_fields.py:20
backend/alembic/versions/824e6a858fd9_initial.py:18
backend/alembic/versions/8c7d9e2f5a1b_add_transaction_review_fields.py:21
backend/alembic/versions/b1c2d3e4f5a6_add_ai_extraction_fields_to_documents.py:19
low System graph quality Provenance conf 1.00 Shallow git history limits provenance confidence
The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence.
Git historyGenerated repo pattern
low System graph api Wiring conf 1.00 Unused endpoint: DELETE /disconnect
`backend/app/api/gmail.py` declares `DELETE /disconnect` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /
`backend/app/api/invoices.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /auth-url
`backend/app/api/gmail.py` declares `GET /auth-url` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /callback
`backend/app/api/gmail.py` declares `GET /callback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /document-inventory
`backend/app/api/dashboard.py` declares `GET /document-inventory` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /me
`backend/app/api/auth.py` declares `GET /me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /month-audit
`backend/app/api/review_ui.py` declares `GET /month-audit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /ready
`backend/app/main.py` declares `GET /ready` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /reconciliation-report
`backend/app/api/transactions.py` declares `GET /reconciliation-report` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /review
`backend/app/api/review_ui.py` declares `GET /review` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /review-queue
`backend/app/api/transactions.py` declares `GET /review-queue` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /rules
`backend/app/api/transactions.py` declares `GET /rules` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /statement-workbench
`backend/app/api/dashboard.py` declares `GET /statement-workbench` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /storage-summary
`backend/app/api/dashboard.py` declares `GET /storage-summary` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /summary
`backend/app/api/dashboard.py` declares `GET /summary` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /supplier-documents
`backend/app/api/review_ui.py` declares `GET /supplier-documents` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /suppliers
`backend/app/api/dashboard.py` declares `GET /suppliers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /tools
`backend/app/api/review_ui.py` declares `GET /tools` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /transactions
`backend/app/api/review_ui.py` declares `GET /transactions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /vat-book
`backend/app/api/transactions.py` declares `GET /vat-book` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /vat-book/export
`backend/app/api/transactions.py` declares `GET /vat-book/export` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /vat-categories
`backend/app/api/transactions.py` declares `GET /vat-categories` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /{document_id}
`backend/app/api/documents.py` declares `GET /{document_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /{document_id}/file
`backend/app/api/documents.py` declares `GET /{document_id}/file` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /{invoice_id}
`backend/app/api/invoices.py` declares `GET /{invoice_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /{transaction_id}/detail
`backend/app/api/transactions.py` declares `GET /{transaction_id}/detail` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /{transaction_id}/history
`backend/app/api/transactions.py` declares `GET /{transaction_id}/history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: GET /{transaction_id}/links
`backend/app/api/transactions.py` declares `GET /{transaction_id}/links` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PATCH /links/{link_id}
`backend/app/api/transactions.py` declares `PATCH /links/{link_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PATCH /{document_id}
`backend/app/api/documents.py` declares `PATCH /{document_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PATCH /{invoice_id}
`backend/app/api/invoices.py` declares `PATCH /{invoice_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PATCH /{transaction_id}/category
`backend/app/api/transactions.py` declares `PATCH /{transaction_id}/category` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: PATCH /{transaction_id}/review
`backend/app/api/transactions.py` declares `PATCH /{transaction_id}/review` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /backfill-financial-state
`backend/app/api/documents.py` declares `POST /backfill-financial-state` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /extract
`backend/app/api/documents.py` declares `POST /extract` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /gmail
`backend/app/api/webhooks.py` declares `POST /gmail` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /import
`backend/app/api/transactions.py` declares `POST /import` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /import-local
`backend/app/api/documents.py` declares `POST /import-local` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /login
`backend/app/api/auth.py` declares `POST /login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /rebuild-matching
`backend/app/api/transactions.py` declares `POST /rebuild-matching` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /scan-recent
`backend/app/api/pipeline.py` declares `POST /scan-recent` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /signup
`backend/app/api/auth.py` declares `POST /signup` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /sync-drive
`backend/app/api/documents.py` declares `POST /sync-drive` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /sync-storage
`backend/app/api/documents.py` declares `POST /sync-storage` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /{document_id}/approve
`backend/app/api/documents.py` declares `POST /{document_id}/approve` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /{document_id}/split
`backend/app/api/documents.py` declares `POST /{document_id}/split` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /{invoice_id}/reject
`backend/app/api/invoices.py` declares `POST /{invoice_id}/reject` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /{transaction_id}/apply-rule
`backend/app/api/transactions.py` declares `POST /{transaction_id}/apply-rule` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /{transaction_id}/links
`backend/app/api/transactions.py` declares `POST /{transaction_id}/links` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph api Wiring conf 1.00 Unused endpoint: POST /{transaction_id}/rule
`backend/app/api/transactions.py` declares `POST /{transaction_id}/rule` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code — consider removing or documenting who consumes it.
Unused endpoint
low System graph quality Complexity conf 1.00 Very large file: backend/app/api/transactions.py (1904 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: backend/app/services/transaction_reconciliation.py (3369 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
low System graph quality Complexity conf 1.00 Very large file: backend/tests/test_transaction_reconciliation.py (2144 lines)
Files with >800 lines often hide complexity hotspots and discourage tests.
For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/18562ca5-9fa5-4652-9209-fe15dd098110/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/18562ca5-9fa5-4652-9209-fe15dd098110/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.