{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-8a68af9ae2ed3413", "name": "Possibly dead Python function: family_backdrop", "shortDescription": {"text": "Possibly dead Python function: family_backdrop"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b386b1abc143537", "name": "Possibly dead Python function: family_events", "shortDescription": {"text": "Possibly dead Python function: family_events"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ced742a1d0c357ab", "name": "Possibly dead Python function: family_recap", "shortDescription": {"text": "Possibly dead Python function: family_recap"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-efa12ecb9fac2ba1", "name": "Possibly dead Python function: family_workshop", "shortDescription": {"text": "Possibly dead Python function: family_workshop"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-139a8e1ea1f08682", "name": "Possibly dead Python function: family_pip", "shortDescription": {"text": "Possibly dead Python function: family_pip"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3986c6967973692a", "name": "Possibly dead Python function: family_goods", "shortDescription": {"text": "Possibly dead Python function: family_goods"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0fabb40d28aebc37", "name": "Possibly dead Python function: family_places", "shortDescription": {"text": "Possibly dead Python function: family_places"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-80ed73bf02a745dc", "name": "Possibly dead Python function: family_brand", "shortDescription": {"text": "Possibly dead Python function: family_brand"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6623b800ac2c2200", "name": "Possibly dead Python function: family_events", "shortDescription": {"text": "Possibly dead Python function: family_events"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-17d0adaba626174c", "name": "Possibly dead Python function: family_trophies", "shortDescription": {"text": "Possibly dead Python function: family_trophies"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a09e73f23b21aa35", "name": "Possibly dead Python function: family_cosmetics", "shortDescription": {"text": "Possibly dead Python function: family_cosmetics"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fbf1e9e85f409aac", "name": "Possibly dead Python function: family_ui", "shortDescription": {"text": "Possibly dead Python function: family_ui"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-87ad3030de816d90", "name": "Possibly dead Python function: daily_market_close", "shortDescription": {"text": "Possibly dead Python function: daily_market_close"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a57f4311c3d9b788", "name": "Possibly dead Python function: email_sweep", "shortDescription": {"text": "Possibly dead Python function: email_sweep"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6a3386dbf0ed3824", "name": "Possibly dead Python function: fast_tick", "shortDescription": {"text": "Possibly dead Python function: fast_tick"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0e637d01ce71f69d", "name": "Possibly dead Python function: current_user", "shortDescription": {"text": "Possibly dead Python function: current_user"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e091d082e4bc506f", "name": "Possibly dead Python function: world_from_path", "shortDescription": {"text": "Possibly dead Python function: world_from_path"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0b05d1267cdfb6f4", "name": "Possibly dead Python function: current_player", "shortDescription": {"text": "Possibly dead Python function: current_player"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d3f990fd72916f96", "name": "Possibly dead Python function: require_instructor", "shortDescription": {"text": "Possibly dead Python function: require_instructor"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b717650afd357b36", "name": "Possibly dead Python function: require_admin", "shortDescription": {"text": "Possibly dead Python function: require_admin"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8114e75cfc8c3b2a", "name": "Possibly dead Python function: send_wrapper", "shortDescription": {"text": "Possibly dead Python function: send_wrapper"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-33cf4381b512733c", "name": "Possibly dead Python function: closes", "shortDescription": {"text": "Possibly dead Python function: closes"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-117b21f68d83a092", "name": "Possibly dead Python function: upgrade", "shortDescription": {"text": "Possibly dead Python function: upgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-254c52cc942259c4", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4cac5e69d890cb03", "name": "Possibly dead Python function: upgrade", "shortDescription": {"text": "Possibly dead Python function: upgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b90c3c32a9c1ae88", "name": "Possibly dead Python function: downgrade", "shortDescription": {"text": "Possibly dead Python function: downgrade"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-113c36953aececbf", "name": "Possibly dead Python function: festival_begins", "shortDescription": {"text": "Possibly dead Python function: festival_begins"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bc9cd1759841fbb6", "name": "Possibly dead Python function: festival_ends", "shortDescription": {"text": "Possibly dead Python function: festival_ends"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-60427b03771411b6", "name": "Dockerfile runs as root: frontend/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: frontend/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6f6b2022eed0806a", "name": "Docker base image is tag-pinned but not digest-pinned: node:22-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b048d166901fd868", "name": "Docker base image is tag-pinned but not digest-pinned: nginx:alpine", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: nginx:alpine"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f66ad88286ca30a", "name": "Dockerfile runs as root: backend/Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: backend/Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-8cd20d539467d2c5", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-25b4251a9af14df0", "name": "Insecure pattern 'local_storage_auth_token' in frontend/src/api.ts:18", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/src/api.ts:18"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6d0fb7ef903888be", "name": "Possible secret in backend/scripts/seed_midcourse.py", "shortDescription": {"text": "Possible secret in backend/scripts/seed_midcourse.py"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-f3a920a4080265d3", "name": "Possible secret in backend/scripts/qa_interactions.py", "shortDescription": {"text": "Possible secret in backend/scripts/qa_interactions.py"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-9e9a63d9c5bbf4eb", "name": "Insecure pattern 'local_storage_auth_token' in backend/scripts/qa_interactions.py:39", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in backend/scripts/qa_interactions.py:39"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-afcadbf516f7d35a", "name": "Possible secret in backend/scripts/qa_screenshots.py", "shortDescription": {"text": "Possible secret in backend/scripts/qa_screenshots.py"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-6023beb1f8d9d714", "name": "Insecure pattern 'local_storage_auth_token' in backend/scripts/qa_screenshots.py:43", "shortDescription": {"text": "Insecure pattern 'local_storage_auth_token' in backend/scripts/qa_screenshots.py:43"}, "fullDescription": {"text": "Found a known-risky pattern (local_storage_auth_token). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "9 tests / 71 src (ratio 0.13)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 36 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8d6192eb05620cbe", "name": "Legacy-named symbol `unflag_old` in backend/scripts/reset_demo.py:28", "shortDescription": {"text": "Legacy-named symbol `unflag_old` in backend/scripts/reset_demo.py:28"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb7c57ca929ab6bf", "name": "Legacy-named symbol `crier_copy` in backend/app/models.py:335", "shortDescription": {"text": "Legacy-named symbol `crier_copy` in backend/app/models.py:335"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-703e1bf6654cfb8a", "name": "Legacy-named symbol `crier_copy` in backend/app/api/instructor.py:107", "shortDescription": {"text": "Legacy-named symbol `crier_copy` in backend/app/api/instructor.py:107"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-798b2fcc723ad369", "name": "Legacy-named symbol `crier_copy` in backend/app/pedagogy/playbook.py:111", "shortDescription": {"text": "Legacy-named symbol `crier_copy` in backend/app/pedagogy/playbook.py:111"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a28bb8ce66e9625a", "name": "Legacy-named symbol `crier_copy` in backend/app/services/interventions.py:62", "shortDescription": {"text": "Legacy-named symbol `crier_copy` in backend/app/services/interventions.py:62"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-588bc645ba278a23", "name": "Commented-code block (5 lines) in backend/app/services/market.py:92", "shortDescription": {"text": "Commented-code block (5 lines) in backend/app/services/market.py:92"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-29facd251c069c9b", "name": "Stub function `on_day_close` (body is just `pass`/`return`) \u2014 backend/app/engine/agents.py:38", "shortDescription": {"text": "Stub function `on_day_close` (body is just `pass`/`return`) \u2014 backend/app/engine/agents.py:38"}, "fullDescription": {"text": "Likely an AI scaffold that was never filled in. Remove or implement."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-81131b8791b16da4", "name": "Legacy-named symbol `crier_copy` in backend/alembic/versions/ff93cfaaa47b_initial.py:138", "shortDescription": {"text": "Legacy-named symbol `crier_copy` in backend/alembic/versions/ff93cfaaa47b_initial.py:138"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-319e66a630e14977", "name": "2 env vars used in code but missing from .env.example", "shortDescription": {"text": "2 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `AGORA_DATABASE_URL`, `VITE_API_URL`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/app/api/instructor.py:digest_settings_get, backend/app/api/instructor.py:digest_settings\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/app/engine/agents.py:act, backend/app/engine/agents.py:act, backend/app/engine/agents.py:act\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a0fc97abd73ad238", "name": "FastAPI POST `chat` without auth dependency \u2014 backend/app/api/tutor.py:19", "shortDescription": {"text": "FastAPI POST `chat` without auth dependency \u2014 backend/app/api/tutor.py:19"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a62823b88c211e53", "name": "FastAPI POST `answer_check` without auth dependency \u2014 backend/app/api/tutor.py:51", "shortDescription": {"text": "FastAPI POST `answer_check` without auth dependency \u2014 backend/app/api/tutor.py:51"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-57079f5a533c2d94", "name": "FastAPI POST `join` without auth dependency \u2014 backend/app/api/student.py:44", "shortDescription": {"text": "FastAPI POST `join` without auth dependency \u2014 backend/app/api/student.py:44"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e10daf89a004ac87", "name": "FastAPI POST `gather` without auth dependency \u2014 backend/app/api/student.py:138", "shortDescription": {"text": "FastAPI POST `gather` without auth dependency \u2014 backend/app/api/student.py:138"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e1f89b0af45cab25", "name": "FastAPI POST `craft` without auth dependency \u2014 backend/app/api/student.py:149", "shortDescription": {"text": "FastAPI POST `craft` without auth dependency \u2014 backend/app/api/student.py:149"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1382bd08ef40d6b6", "name": "FastAPI POST `build` without auth dependency \u2014 backend/app/api/student.py:159", "shortDescription": {"text": "FastAPI POST `build` without auth dependency \u2014 backend/app/api/student.py:159"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ee6a14690cb1d691", "name": "FastAPI POST `upgrade` without auth dependency \u2014 backend/app/api/student.py:165", "shortDescription": {"text": "FastAPI POST `upgrade` without auth dependency \u2014 backend/app/api/student.py:165"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3846ef9128fc14d8", "name": "FastAPI POST `hire` without auth dependency \u2014 backend/app/api/student.py:175", "shortDescription": {"text": "FastAPI POST `hire` without auth dependency \u2014 backend/app/api/student.py:175"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dd92fdf46d18b104", "name": "FastAPI POST `scrubber` without auth dependency \u2014 backend/app/api/student.py:182", "shortDescription": {"text": "FastAPI POST `scrubber` without auth dependency \u2014 backend/app/api/student.py:182"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-9b22f435bbd3f231", "name": "FastAPI POST `set_listing` without auth dependency \u2014 backend/app/api/student.py:196", "shortDescription": {"text": "FastAPI POST `set_listing` without auth dependency \u2014 backend/app/api/student.py:196"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3df2dc20913ac844", "name": "FastAPI POST `fresh_start` without auth dependency \u2014 backend/app/api/student.py:232", "shortDescription": {"text": "FastAPI POST `fresh_start` without auth dependency \u2014 backend/app/api/student.py:232"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-cbe18edf4a068f22", "name": "FastAPI POST `create_compact` without auth dependency \u2014 backend/app/api/student.py:283", "shortDescription": {"text": "FastAPI POST `create_compact` without auth dependency \u2014 backend/app/api/student.py:283"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8402ca7493098f76", "name": "FastAPI POST `join_compact` without auth dependency \u2014 backend/app/api/student.py:290", "shortDescription": {"text": "FastAPI POST `join_compact` without auth dependency \u2014 backend/app/api/student.py:290"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c3e38e855ea81ba4", "name": "FastAPI POST `leave_compact` without auth dependency \u2014 backend/app/api/student.py:297", "shortDescription": {"text": "FastAPI POST `leave_compact` without auth dependency \u2014 backend/app/api/student.py:297"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-dbd960814e19842d", "name": "FastAPI POST `bid_license` without auth dependency \u2014 backend/app/api/student.py:309", "shortDescription": {"text": "FastAPI POST `bid_license` without auth dependency \u2014 backend/app/api/student.py:309"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a72e47ce06a881a1", "name": "FastAPI POST `magic_request` without auth dependency \u2014 backend/app/api/auth.py:43", "shortDescription": {"text": "FastAPI POST `magic_request` without auth dependency \u2014 backend/app/api/auth.py:43"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-268a235cc4368307", "name": "FastAPI POST `magic_redeem` without auth dependency \u2014 backend/app/api/auth.py:66", "shortDescription": {"text": "FastAPI POST `magic_redeem` without auth dependency \u2014 backend/app/api/auth.py:66"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-864b9208ee904f65", "name": "FastAPI POST `demo_student` without auth dependency \u2014 backend/app/api/demo.py:43", "shortDescription": {"text": "FastAPI POST `demo_student` without auth dependency \u2014 backend/app/api/demo.py:43"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-179e4429f0e5b707", "name": "FastAPI POST `demo_instructor` without auth dependency \u2014 backend/app/api/demo.py:66", "shortDescription": {"text": "FastAPI POST `demo_instructor` without auth dependency \u2014 backend/app/api/demo.py:66"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7b733038f92c4fde", "name": "FastAPI POST `guess` without auth dependency \u2014 backend/app/api/fun.py:21", "shortDescription": {"text": "FastAPI POST `guess` without auth dependency \u2014 backend/app/api/fun.py:21"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-656f836619b33f29", "name": "FastAPI POST `cast` without auth dependency \u2014 backend/app/api/fun.py:26", "shortDescription": {"text": "FastAPI POST `cast` without auth dependency \u2014 backend/app/api/fun.py:26"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a2d36b287490d821", "name": "FastAPI POST `merchant_submit` without auth dependency \u2014 backend/app/api/fun.py:40", "shortDescription": {"text": "FastAPI POST `merchant_submit` without auth dependency \u2014 backend/app/api/fun.py:40"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-274556e324fc23f4", "name": "FastAPI POST `buy` without auth dependency \u2014 backend/app/api/fun.py:54", "shortDescription": {"text": "FastAPI POST `buy` without auth dependency \u2014 backend/app/api/fun.py:54"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-173d64fc1907a284", "name": "FastAPI POST `place_order` without auth dependency \u2014 backend/app/api/market.py:23", "shortDescription": {"text": "FastAPI POST `place_order` without auth dependency \u2014 backend/app/api/market.py:23"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-37287256ffd261aa", "name": "FastAPI DELETE `cancel_order` without auth dependency \u2014 backend/app/api/market.py:33", "shortDescription": {"text": "FastAPI DELETE `cancel_order` without auth dependency \u2014 backend/app/api/market.py:33"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-8d40df2b543fc6ab", "name": "FastAPI POST `create_world` without auth dependency \u2014 backend/app/api/instructor.py:38", "shortDescription": {"text": "FastAPI POST `create_world` without auth dependency \u2014 backend/app/api/instructor.py:38"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3e6cb3f6258f3614", "name": "FastAPI POST `preview` without auth dependency \u2014 backend/app/api/instructor.py:136", "shortDescription": {"text": "FastAPI POST `preview` without auth dependency \u2014 backend/app/api/instructor.py:136"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-766f2a3f1dd17842", "name": "FastAPI POST `execute` without auth dependency \u2014 backend/app/api/instructor.py:141", "shortDescription": {"text": "FastAPI POST `execute` without auth dependency \u2014 backend/app/api/instructor.py:141"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c81e72b2d99196b4", "name": "FastAPI POST `advance` without auth dependency \u2014 backend/app/api/instructor.py:159", "shortDescription": {"text": "FastAPI POST `advance` without auth dependency \u2014 backend/app/api/instructor.py:159"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-aaaa5e96bba1acb1", "name": "FastAPI POST `set_state` without auth dependency \u2014 backend/app/api/instructor.py:170", "shortDescription": {"text": "FastAPI POST `set_state` without auth dependency \u2014 backend/app/api/instructor.py:170"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-2cbeaad18fb9d19c", "name": "FastAPI POST `close_day` without auth dependency \u2014 backend/app/api/instructor.py:177", "shortDescription": {"text": "FastAPI POST `close_day` without auth dependency \u2014 backend/app/api/instructor.py:177"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-1a6124ae013fa6c9", "name": "FastAPI POST `grade_weights` without auth dependency \u2014 backend/app/api/instructor.py:215", "shortDescription": {"text": "FastAPI POST `grade_weights` without auth dependency \u2014 backend/app/api/instructor.py:215"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-47b9ff33841f47d6", "name": "FastAPI POST `digest_send` without auth dependency \u2014 backend/app/api/instructor.py:251", "shortDescription": {"text": "FastAPI POST `digest_send` without auth dependency \u2014 backend/app/api/instructor.py:251"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d3cf232b64129e13", "name": "FastAPI POST `digest_settings` without auth dependency \u2014 backend/app/api/instructor.py:278", "shortDescription": {"text": "FastAPI POST `digest_settings` without auth dependency \u2014 backend/app/api/instructor.py:278"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0331592dbde0cc6d", "name": "Unused endpoint: POST /worlds/{world_id}/tutor/chat", "shortDescription": {"text": "Unused endpoint: POST /worlds/{world_id}/tutor/chat"}, "fullDescription": {"text": "`backend/app/api/tutor.py` declares `POST /worlds/{world_id}/tutor/chat` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9754f2ce20960988", "name": "Unused endpoint: GET /worlds/{world_id}/tutor/history", "shortDescription": {"text": "Unused endpoint: GET /worlds/{world_id}/tutor/history"}, "fullDescription": {"text": "`backend/app/api/tutor.py` declares `GET /worlds/{world_id}/tutor/history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8b189e3f407b0c12", "name": "Unused endpoint: GET /worlds/{world_id}/tutor/check", "shortDescription": {"text": "Unused endpoint: GET /worlds/{world_id}/tutor/check"}, "fullDescription": {"text": "`backend/app/api/tutor.py` declares `GET /worlds/{world_id}/tutor/check` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e6e8244d824cdf16", "name": "Unused endpoint: POST /worlds/{world_id}/tutor/check", "shortDescription": {"text": "Unused endpoint: POST /worlds/{world_id}/tutor/check"}, "fullDescription": {"text": "`backend/app/api/tutor.py` declares `POST /worlds/{world_id}/tutor/check` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-98c26fe8d55760fd", "name": "Unused endpoint: GET /worlds/{world_id}/tutor/mastery", "shortDescription": {"text": "Unused endpoint: GET /worlds/{world_id}/tutor/mastery"}, "fullDescription": {"text": "`backend/app/api/tutor.py` declares `GET /worlds/{world_id}/tutor/mastery` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-633d0a653ebbf1bf", "name": "Unused endpoint: POST /join", "shortDescription": {"text": "Unused endpoint: POST /join"}, "fullDescription": {"text": "`backend/app/api/student.py` declares `POST /join` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a3f35227ac645505", "name": "Unused endpoint: GET /worlds/{world_id}/state", "shortDescription": {"text": "Unused endpoint: GET /worlds/{world_id}/state"}, "fullDescription": {"text": "`backend/app/api/student.py` declares `GET /worlds/{world_id}/state` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b84fccbcddcc4eb3", "name": "Unused endpoint: POST /worlds/{world_id}/gather", "shortDescription": {"text": "Unused endpoint: POST /worlds/{world_id}/gather"}, "fullDescription": {"text": "`backend/app/api/student.py` declares `POST /worlds/{world_id}/gather` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-63592331015e3b3b", "name": "Unused endpoint: POST /worlds/{world_id}/craft", "shortDescription": {"text": "Unused endpoint: POST /worlds/{world_id}/craft"}, "fullDescription": {"text": "`backend/app/api/student.py` declares `POST /worlds/{world_id}/craft` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c87df92fcb66d90a", "name": "Unused endpoint: POST /worlds/{world_id}/facilities", "shortDescription": {"text": "Unused endpoint: POST /worlds/{world_id}/facilities"}, "fullDescription": {"text": "`backend/app/api/student.py` declares `POST /worlds/{world_id}/facilities` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-88646486f3b88d94", "name": "Unused endpoint: POST /worlds/{world_id}/facilities/{facility_id}/upgrade", "shortDescription": {"text": "Unused endpoint: POST /worlds/{world_id}/facilities/{facility_id}/upgrade"}, "fullDescription": {"text": "`backend/app/api/student.py` declares `POST /worlds/{world_id}/facilities/{facility_id}/upgrade` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-80c7d5043b9ed42d", "name": "Unused endpoint: POST /worlds/{world_id}/facilities/{facility_id}/workers", "shortDescription": {"text": "Unused endpoint: POST /worlds/{world_id}/facilities/{facility_id}/workers"}, "fullDescription": {"text": "`backend/app/api/student.py` declares `POST /worlds/{world_id}/facilities/{facility_id}/workers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-17c900b2de373e20", "name": "Unused endpoint: POST /worlds/{world_id}/facilities/{facility_id}/scrubber", "shortDescription": {"text": "Unused endpoint: POST /worlds/{world_id}/facilities/{facility_id}/scrubber"}, "fullDescription": {"text": "`backend/app/api/student.py` declares `POST /worlds/{world_id}/facilities/{facility_id}/scrubber` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a7d20293dab7627", "name": "Unused endpoint: POST /worlds/{world_id}/shop", "shortDescription": {"text": "Unused endpoint: POST /worlds/{world_id}/shop"}, "fullDescription": {"text": "`backend/app/api/student.py` declares `POST /worlds/{world_id}/shop` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0ee7027808b9b7bc", "name": "Unused endpoint: GET /worlds/{world_id}/shop", "shortDescription": {"text": "Unused endpoint: GET /worlds/{world_id}/shop"}, "fullDescription": {"text": "`backend/app/api/student.py` declares `GET /worlds/{world_id}/shop` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e4002dd863010dc", "name": "Unused endpoint: POST /worlds/{world_id}/fresh-start", "shortDescription": {"text": "Unused endpoint: POST /worlds/{world_id}/fresh-start"}, "fullDescription": {"text": "`backend/app/api/student.py` declares `POST /worlds/{world_id}/fresh-start` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-563aa6a59a91df29", "name": "Unused endpoint: GET /worlds/{world_id}/crier", "shortDescription": {"text": "Unused endpoint: GET /worlds/{world_id}/crier"}, "fullDescription": {"text": "`backend/app/api/student.py` declares `GET /worlds/{world_id}/crier` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-db3faa0339ffd0ce", "name": "Unused endpoint: GET /worlds/{world_id}/leaderboards", "shortDescription": {"text": "Unused endpoint: GET /worlds/{world_id}/leaderboards"}, "fullDescription": {"text": "`backend/app/api/student.py` declares `GET /worlds/{world_id}/leaderboards` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c3b8165c9bb252cc", "name": "Unused endpoint: GET /worlds/{world_id}/compacts", "shortDescription": {"text": "Unused endpoint: GET /worlds/{world_id}/compacts"}, "fullDescription": {"text": "`backend/app/api/student.py` declares `GET /worlds/{world_id}/compacts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7cf5c0ec40ef9753", "name": "Unused endpoint: POST /worlds/{world_id}/compacts", "shortDescription": {"text": "Unused endpoint: POST /worlds/{world_id}/compacts"}, "fullDescription": {"text": "`backend/app/api/student.py` declares `POST /worlds/{world_id}/compacts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5542bac2910592da", "name": "Unused endpoint: POST /worlds/{world_id}/compacts/{compact_id}/join", "shortDescription": {"text": "Unused endpoint: POST /worlds/{world_id}/compacts/{compact_id}/join"}, "fullDescription": {"text": "`backend/app/api/student.py` declares `POST /worlds/{world_id}/compacts/{compact_id}/join` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a8de36646d75b65a", "name": "Unused endpoint: POST /worlds/{world_id}/compacts/{compact_id}/leave", "shortDescription": {"text": "Unused endpoint: POST /worlds/{world_id}/compacts/{compact_id}/leave"}, "fullDescription": {"text": "`backend/app/api/student.py` declares `POST /worlds/{world_id}/compacts/{compact_id}/leave` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6074c7022681ef52", "name": "Unused endpoint: POST /worlds/{world_id}/license-bids", "shortDescription": {"text": "Unused endpoint: POST /worlds/{world_id}/license-bids"}, "fullDescription": {"text": "`backend/app/api/student.py` declares `POST /worlds/{world_id}/license-bids` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e433a6d34bc1d5d0", "name": "Unused endpoint: GET /worlds/{world_id}/license-auctions", "shortDescription": {"text": "Unused endpoint: GET /worlds/{world_id}/license-auctions"}, "fullDescription": {"text": "`backend/app/api/student.py` declares `GET /worlds/{world_id}/license-auctions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-839b456f3083153d", "name": "Unused endpoint: GET /worlds/{world_id}/recap", "shortDescription": {"text": "Unused endpoint: GET /worlds/{world_id}/recap"}, "fullDescription": {"text": "`backend/app/api/student.py` declares `GET /worlds/{world_id}/recap` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-304b6f2b403d93f7", "name": "Unused endpoint: POST /register", "shortDescription": {"text": "Unused endpoint: POST /register"}, "fullDescription": {"text": "`backend/app/api/auth.py` declares `POST /register` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-618721b912bad1c2", "name": "Unused endpoint: POST /login", "shortDescription": {"text": "Unused endpoint: POST /login"}, "fullDescription": {"text": "`backend/app/api/auth.py` declares `POST /login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d92c71d9acccce68", "name": "Unused endpoint: POST /magic/request", "shortDescription": {"text": "Unused endpoint: POST /magic/request"}, "fullDescription": {"text": "`backend/app/api/auth.py` declares `POST /magic/request` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-602db5f103fa952e", "name": "Unused endpoint: POST /magic/redeem", "shortDescription": {"text": "Unused endpoint: POST /magic/redeem"}, "fullDescription": {"text": "`backend/app/api/auth.py` declares `POST /magic/redeem` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fd1dc91abf32142d", "name": "Unused endpoint: GET /me", "shortDescription": {"text": "Unused endpoint: GET /me"}, "fullDescription": {"text": "`backend/app/api/auth.py` declares `GET /me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b484de5627287407", "name": "Unused endpoint: POST /student", "shortDescription": {"text": "Unused endpoint: POST /student"}, "fullDescription": {"text": "`backend/app/api/demo.py` declares `POST /student` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-05a73222757e136f", "name": "Unused endpoint: POST /instructor", "shortDescription": {"text": "Unused endpoint: POST /instructor"}, "fullDescription": {"text": "`backend/app/api/demo.py` declares `POST /instructor` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ac2f552bf9d967ce", "name": "Unused endpoint: GET /overview", "shortDescription": {"text": "Unused endpoint: GET /overview"}, "fullDescription": {"text": "`backend/app/api/admin.py` declares `GET /overview` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d7fa8929da9cbe3f", "name": "Unused endpoint: GET /balance", "shortDescription": {"text": "Unused endpoint: GET /balance"}, "fullDescription": {"text": "`backend/app/api/admin.py` declares `GET /balance` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e0cab2960e7dbc4c", "name": "Unused endpoint: GET /worlds/{world_id}/puzzle", "shortDescription": {"text": "Unused endpoint: GET /worlds/{world_id}/puzzle"}, "fullDescription": {"text": "`backend/app/api/fun.py` declares `GET /worlds/{world_id}/puzzle` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4ee0d69b7399b1ac", "name": "Unused endpoint: POST /worlds/{world_id}/puzzle/guess", "shortDescription": {"text": "Unused endpoint: POST /worlds/{world_id}/puzzle/guess"}, "fullDescription": {"text": "`backend/app/api/fun.py` declares `POST /worlds/{world_id}/puzzle/guess` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2555cdbf4701e692", "name": "Unused endpoint: POST /worlds/{world_id}/fishing/cast", "shortDescription": {"text": "Unused endpoint: POST /worlds/{world_id}/fishing/cast"}, "fullDescription": {"text": "`backend/app/api/fun.py` declares `POST /worlds/{world_id}/fishing/cast` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-382d0bc19d1a4f9d", "name": "Unused endpoint: GET /worlds/{world_id}/merchant", "shortDescription": {"text": "Unused endpoint: GET /worlds/{world_id}/merchant"}, "fullDescription": {"text": "`backend/app/api/fun.py` declares `GET /worlds/{world_id}/merchant` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fb30d6aefda3ecf2", "name": "Unused endpoint: POST /worlds/{world_id}/merchant/submit", "shortDescription": {"text": "Unused endpoint: POST /worlds/{world_id}/merchant/submit"}, "fullDescription": {"text": "`backend/app/api/fun.py` declares `POST /worlds/{world_id}/merchant/submit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4ca190efd2427443", "name": "Unused endpoint: GET /worlds/{world_id}/boutique", "shortDescription": {"text": "Unused endpoint: GET /worlds/{world_id}/boutique"}, "fullDescription": {"text": "`backend/app/api/fun.py` declares `GET /worlds/{world_id}/boutique` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4652224903e49dc6", "name": "Unused endpoint: POST /worlds/{world_id}/boutique/buy", "shortDescription": {"text": "Unused endpoint: POST /worlds/{world_id}/boutique/buy"}, "fullDescription": {"text": "`backend/app/api/fun.py` declares `POST /worlds/{world_id}/boutique/buy` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-889eec3e61d2d420", "name": "Unused endpoint: POST /worlds/{world_id}/orders", "shortDescription": {"text": "Unused endpoint: POST /worlds/{world_id}/orders"}, "fullDescription": {"text": "`backend/app/api/market.py` declares `POST /worlds/{world_id}/orders` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d7a2b670eb6566f0", "name": "Unused endpoint: DELETE /worlds/{world_id}/orders/{order_id}", "shortDescription": {"text": "Unused endpoint: DELETE /worlds/{world_id}/orders/{order_id}"}, "fullDescription": {"text": "`backend/app/api/market.py` declares `DELETE /worlds/{world_id}/orders/{order_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af1c8438a0448805", "name": "Unused endpoint: GET /worlds/{world_id}/markets/{good_id}/book", "shortDescription": {"text": "Unused endpoint: GET /worlds/{world_id}/markets/{good_id}/book"}, "fullDescription": {"text": "`backend/app/api/market.py` declares `GET /worlds/{world_id}/markets/{good_id}/book` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f5467aeca9c45a70", "name": "Unused endpoint: GET /worlds/{world_id}/markets/{good_id}/history", "shortDescription": {"text": "Unused endpoint: GET /worlds/{world_id}/markets/{good_id}/history"}, "fullDescription": {"text": "`backend/app/api/market.py` declares `GET /worlds/{world_id}/markets/{good_id}/history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7b0721caa0bd773a", "name": "Unused endpoint: GET /worlds/{world_id}/markets/{good_id}/tape", "shortDescription": {"text": "Unused endpoint: GET /worlds/{world_id}/markets/{good_id}/tape"}, "fullDescription": {"text": "`backend/app/api/market.py` declares `GET /worlds/{world_id}/markets/{good_id}/tape` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f1c6082f939b28d8", "name": "Unused endpoint: POST /instructor/worlds", "shortDescription": {"text": "Unused endpoint: POST /instructor/worlds"}, "fullDescription": {"text": "`backend/app/api/instructor.py` declares `POST /instructor/worlds` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4ccf446c3366a5fe", "name": "Unused endpoint: GET /worlds/{world_id}/instructor/dashboard", "shortDescription": {"text": "Unused endpoint: GET /worlds/{world_id}/instructor/dashboard"}, "fullDescription": {"text": "`backend/app/api/instructor.py` declares `GET /worlds/{world_id}/instructor/dashboard` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-351715375132eeea", "name": "Unused endpoint: GET /worlds/{world_id}/instructor/feed", "shortDescription": {"text": "Unused endpoint: GET /worlds/{world_id}/instructor/feed"}, "fullDescription": {"text": "`backend/app/api/instructor.py` declares `GET /worlds/{world_id}/instructor/feed` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f36d5f14b25b9e89", "name": "Unused endpoint: GET /worlds/{world_id}/instructor/interventions", "shortDescription": {"text": "Unused endpoint: GET /worlds/{world_id}/instructor/interventions"}, "fullDescription": {"text": "`backend/app/api/instructor.py` declares `GET /worlds/{world_id}/instructor/interventions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/21949"}, "properties": {"repository": "uptownnickbrown/agora", "repoUrl": "https://github.com/uptownnickbrown/agora", "branch": "main"}, "results": [{"ruleId": "scanner-8a68af9ae2ed3413", "level": "note", "message": {"text": "Possibly dead Python function: family_backdrop"}, "properties": {"repobilityId": "43857cdabbca02f7", "scanner": "scanner-primary", "fingerprint": "8a68af9ae2ed3413", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/generate_assets2.py:29"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3b386b1abc143537", "level": "note", "message": {"text": "Possibly dead Python function: family_events"}, "properties": {"repobilityId": "3bab05ecf6862b67", "scanner": "scanner-primary", "fingerprint": "3b386b1abc143537", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/generate_assets2.py:45"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-ced742a1d0c357ab", "level": "note", "message": {"text": "Possibly dead Python function: family_recap"}, "properties": {"repobilityId": "2a23056423b05d8a", "scanner": "scanner-primary", "fingerprint": "ced742a1d0c357ab", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/generate_assets2.py:63"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-efa12ecb9fac2ba1", "level": "note", "message": {"text": "Possibly dead Python function: family_workshop"}, "properties": {"repobilityId": "56b156b37f9705c3", "scanner": "scanner-primary", "fingerprint": "efa12ecb9fac2ba1", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/generate_assets2.py:71"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-139a8e1ea1f08682", "level": "note", "message": {"text": "Possibly dead Python function: family_pip"}, "properties": {"repobilityId": "b2a4bf0696450793", "scanner": "scanner-primary", "fingerprint": "139a8e1ea1f08682", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/generate_assets.py:48"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-3986c6967973692a", "level": "note", "message": {"text": "Possibly dead Python function: family_goods"}, "properties": {"repobilityId": "237817d2937a07bd", "scanner": "scanner-primary", "fingerprint": "3986c6967973692a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/generate_assets.py:130"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0fabb40d28aebc37", "level": "note", "message": {"text": "Possibly dead Python function: family_places"}, "properties": {"repobilityId": "2686c655cb2cb19c", "scanner": "scanner-primary", "fingerprint": "0fabb40d28aebc37", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/generate_assets.py:166"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-80ed73bf02a745dc", "level": "note", "message": {"text": "Possibly dead Python function: family_brand"}, "properties": {"repobilityId": "b21e093d45f504e0", "scanner": "scanner-primary", "fingerprint": "80ed73bf02a745dc", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/generate_assets.py:180"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6623b800ac2c2200", "level": "note", "message": {"text": "Possibly dead Python function: family_events"}, "properties": {"repobilityId": "3bab05ecf6862b67", "scanner": "scanner-primary", "fingerprint": "6623b800ac2c2200", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/generate_assets.py:255"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-17d0adaba626174c", "level": "note", "message": {"text": "Possibly dead Python function: family_trophies"}, "properties": {"repobilityId": "d269b41da0a902c7", "scanner": "scanner-primary", "fingerprint": "17d0adaba626174c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/generate_assets.py:269"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a09e73f23b21aa35", "level": "note", "message": {"text": "Possibly dead Python function: family_cosmetics"}, "properties": {"repobilityId": "d1cc70a9c51f31b0", "scanner": "scanner-primary", "fingerprint": "a09e73f23b21aa35", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/generate_assets.py:318"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-fbf1e9e85f409aac", "level": "note", "message": {"text": "Possibly dead Python function: family_ui"}, "properties": {"repobilityId": "f3523b9352f3666e", "scanner": "scanner-primary", "fingerprint": "fbf1e9e85f409aac", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "scripts/generate_assets.py:331"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-87ad3030de816d90", "level": "note", "message": {"text": "Possibly dead Python function: daily_market_close"}, "properties": {"repobilityId": "6b4b2d360d7d9292", "scanner": "scanner-primary", "fingerprint": "87ad3030de816d90", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/worker.py:41"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a57f4311c3d9b788", "level": "note", "message": {"text": "Possibly dead Python function: email_sweep"}, "properties": {"repobilityId": "8567fcf884c67203", "scanner": "scanner-primary", "fingerprint": "a57f4311c3d9b788", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/worker.py:69"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6a3386dbf0ed3824", "level": "note", "message": {"text": "Possibly dead Python function: fast_tick"}, "properties": {"repobilityId": "b2458cc51e3b7b64", "scanner": "scanner-primary", "fingerprint": "6a3386dbf0ed3824", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/worker.py:77"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0e637d01ce71f69d", "level": "note", "message": {"text": "Possibly dead Python function: current_user"}, "properties": {"repobilityId": "271089411e6e6afb", "scanner": "scanner-primary", "fingerprint": "0e637d01ce71f69d", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/deps.py:50"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e091d082e4bc506f", "level": "note", "message": {"text": "Possibly dead Python function: world_from_path"}, "properties": {"repobilityId": "7dbbedf484925b7a", "scanner": "scanner-primary", "fingerprint": "e091d082e4bc506f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/deps.py:62"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-0b05d1267cdfb6f4", "level": "note", "message": {"text": "Possibly dead Python function: current_player"}, "properties": {"repobilityId": "8a2ff476e1c2a165", "scanner": "scanner-primary", "fingerprint": "0b05d1267cdfb6f4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/deps.py:72"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d3f990fd72916f96", "level": "note", "message": {"text": "Possibly dead Python function: require_instructor"}, "properties": {"repobilityId": "adb6f1a469ca7d58", "scanner": "scanner-primary", "fingerprint": "d3f990fd72916f96", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/deps.py:92"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b717650afd357b36", "level": "note", "message": {"text": "Possibly dead Python function: require_admin"}, "properties": {"repobilityId": "3c06db2e25566bf7", "scanner": "scanner-primary", "fingerprint": "b717650afd357b36", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/deps.py:103"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8114e75cfc8c3b2a", "level": "note", "message": {"text": "Possibly dead Python function: send_wrapper"}, "properties": {"repobilityId": "f34ba48c1fd7571b", "scanner": "scanner-primary", "fingerprint": "8114e75cfc8c3b2a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/main.py:41"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-33cf4381b512733c", "level": "note", "message": {"text": "Possibly dead Python function: closes"}, "properties": {"repobilityId": "1abc90749aecec22", "scanner": "scanner-primary", "fingerprint": "33cf4381b512733c", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/engine/world.py:73"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-117b21f68d83a092", "level": "note", "message": {"text": "Possibly dead Python function: upgrade"}, "properties": {"repobilityId": "cf0b8e5e6e2f8bc4", "scanner": "scanner-primary", "fingerprint": "117b21f68d83a092", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/8e21d4c0a9b1_email_log.py:17"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-254c52cc942259c4", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "254c52cc942259c4", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/8e21d4c0a9b1_email_log.py:35"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4cac5e69d890cb03", "level": "note", "message": {"text": "Possibly dead Python function: upgrade"}, "properties": {"repobilityId": "cf0b8e5e6e2f8bc4", "scanner": "scanner-primary", "fingerprint": "4cac5e69d890cb03", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/ff93cfaaa47b_initial.py:17"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b90c3c32a9c1ae88", "level": "note", "message": {"text": "Possibly dead Python function: downgrade"}, "properties": {"repobilityId": "c03debbf11efa0c5", "scanner": "scanner-primary", "fingerprint": "b90c3c32a9c1ae88", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/alembic/versions/ff93cfaaa47b_initial.py:532"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-113c36953aececbf", "level": "note", "message": {"text": "Possibly dead Python function: festival_begins"}, "properties": {"repobilityId": "6cf62273ea342e50", "scanner": "scanner-primary", "fingerprint": "113c36953aececbf", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/sim/scenarios.py:90"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-bc9cd1759841fbb6", "level": "note", "message": {"text": "Possibly dead Python function: festival_ends"}, "properties": {"repobilityId": "13adb0305df87c32", "scanner": "scanner-primary", "fingerprint": "bc9cd1759841fbb6", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/sim/scenarios.py:95"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-60427b03771411b6", "level": "warning", "message": {"text": "Dockerfile runs as root: frontend/Dockerfile"}, "properties": {"repobilityId": "735c01d8531dfd2c", "scanner": "scanner-primary", "fingerprint": "60427b03771411b6", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-6f6b2022eed0806a", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-slim"}, "properties": {"repobilityId": "16d79e2e1ae9cf40", "scanner": "scanner-primary", "fingerprint": "6f6b2022eed0806a", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-b048d166901fd868", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: nginx:alpine"}, "properties": {"repobilityId": "130be8ec7e657904", "scanner": "scanner-primary", "fingerprint": "b048d166901fd868", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/Dockerfile"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-1f66ad88286ca30a", "level": "warning", "message": {"text": "Dockerfile runs as root: backend/Dockerfile"}, "properties": {"repobilityId": "7afd2b0e8a8c9eeb", "scanner": "scanner-primary", "fingerprint": "1f66ad88286ca30a", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-8cd20d539467d2c5", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "06b87ac9439092d6", "scanner": "scanner-primary", "fingerprint": "8cd20d539467d2c5", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-25b4251a9af14df0", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in frontend/src/api.ts:18"}, "properties": {"repobilityId": "6e88159a0f57b9c8", "scanner": "scanner-primary", "fingerprint": "25b4251a9af14df0", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/src/api.ts"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-6d0fb7ef903888be", "level": "error", "message": {"text": "Possible secret in backend/scripts/seed_midcourse.py"}, "properties": {"repobilityId": "464986ec75c57507", "scanner": "scanner-primary", "fingerprint": "6d0fb7ef903888be", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/scripts/seed_midcourse.py"}, "region": {"startLine": 62}}}]}, {"ruleId": "scanner-f3a920a4080265d3", "level": "error", "message": {"text": "Possible secret in backend/scripts/qa_interactions.py"}, "properties": {"repobilityId": "d7c6059ea3548595", "scanner": "scanner-primary", "fingerprint": "f3a920a4080265d3", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/scripts/qa_interactions.py"}, "region": {"startLine": 18}}}]}, {"ruleId": "scanner-9e9a63d9c5bbf4eb", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in backend/scripts/qa_interactions.py:39"}, "properties": {"repobilityId": "f9ae9a74922221e2", "scanner": "scanner-primary", "fingerprint": "9e9a63d9c5bbf4eb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/scripts/qa_interactions.py"}, "region": {"startLine": 39}}}]}, {"ruleId": "scanner-afcadbf516f7d35a", "level": "error", "message": {"text": "Possible secret in backend/scripts/qa_screenshots.py"}, "properties": {"repobilityId": "50844824c6f138da", "scanner": "scanner-primary", "fingerprint": "afcadbf516f7d35a", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/scripts/qa_screenshots.py"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-6023beb1f8d9d714", "level": "warning", "message": {"text": "Insecure pattern 'local_storage_auth_token' in backend/scripts/qa_screenshots.py:43"}, "properties": {"repobilityId": "8c6473515dfc61c1", "scanner": "scanner-primary", "fingerprint": "6023beb1f8d9d714", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "local_storage_auth_token"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/scripts/qa_screenshots.py"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "ac97c39d82bdf113", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "04a558de3c6c380b", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "4ce94eac62b7d240", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "e3ed6c3d2cb5829d", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "0f16f70bb0ae71aa", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "ffa4016128345f78", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8d6192eb05620cbe", "level": "note", "message": {"text": "Legacy-named symbol `unflag_old` in backend/scripts/reset_demo.py:28"}, "properties": {"repobilityId": "21b141e0a1c36396", "scanner": "scanner-primary", "fingerprint": "8d6192eb05620cbe", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-cb7c57ca929ab6bf", "level": "note", "message": {"text": "Legacy-named symbol `crier_copy` in backend/app/models.py:335"}, "properties": {"repobilityId": "ad71ae1b851929b2", "scanner": "scanner-primary", "fingerprint": "cb7c57ca929ab6bf", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-703e1bf6654cfb8a", "level": "note", "message": {"text": "Legacy-named symbol `crier_copy` in backend/app/api/instructor.py:107"}, "properties": {"repobilityId": "5b3af2bda51b35cc", "scanner": "scanner-primary", "fingerprint": "703e1bf6654cfb8a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-798b2fcc723ad369", "level": "note", "message": {"text": "Legacy-named symbol `crier_copy` in backend/app/pedagogy/playbook.py:111"}, "properties": {"repobilityId": "cd0634b78c3da1b6", "scanner": "scanner-primary", "fingerprint": "798b2fcc723ad369", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-a28bb8ce66e9625a", "level": "note", "message": {"text": "Legacy-named symbol `crier_copy` in backend/app/services/interventions.py:62"}, "properties": {"repobilityId": "03f4c404ed5a8e33", "scanner": "scanner-primary", "fingerprint": "a28bb8ce66e9625a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-588bc645ba278a23", "level": "none", "message": {"text": "Commented-code block (5 lines) in backend/app/services/market.py:92"}, "properties": {"repobilityId": "96bfef694e5995a3", "scanner": "scanner-primary", "fingerprint": "588bc645ba278a23", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-29facd251c069c9b", "level": "note", "message": {"text": "Stub function `on_day_close` (body is just `pass`/`return`) \u2014 backend/app/engine/agents.py:38"}, "properties": {"repobilityId": "4896fcdf9df1628e", "scanner": "scanner-primary", "fingerprint": "29facd251c069c9b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "empty-handler", "dead-code"]}}, {"ruleId": "scanner-81131b8791b16da4", "level": "note", "message": {"text": "Legacy-named symbol `crier_copy` in backend/alembic/versions/ff93cfaaa47b_initial.py:138"}, "properties": {"repobilityId": "ccb284435f289bab", "scanner": "scanner-primary", "fingerprint": "81131b8791b16da4", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-319e66a630e14977", "level": "none", "message": {"text": "2 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "d838d1fc5d8231c9", "scanner": "scanner-primary", "fingerprint": "319e66a630e14977", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "f1b08986335a9c1f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "82baf4393cb5d5bd", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "a8cfe12c1c49116e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-a0fc97abd73ad238", "level": "error", "message": {"text": "FastAPI POST `chat` without auth dependency \u2014 backend/app/api/tutor.py:19"}, "properties": {"repobilityId": "ea7f0e11f15e63f9", "scanner": "scanner-primary", "fingerprint": "a0fc97abd73ad238", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/tutor.py"}, "region": {"startLine": 19}}}]}, {"ruleId": "scanner-a62823b88c211e53", "level": "error", "message": {"text": "FastAPI POST `answer_check` without auth dependency \u2014 backend/app/api/tutor.py:51"}, "properties": {"repobilityId": "3f5d0b258d2a2278", "scanner": "scanner-primary", "fingerprint": "a62823b88c211e53", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/tutor.py"}, "region": {"startLine": 51}}}]}, {"ruleId": "scanner-57079f5a533c2d94", "level": "error", "message": {"text": "FastAPI POST `join` without auth dependency \u2014 backend/app/api/student.py:44"}, "properties": {"repobilityId": "01297a9e5aac1d4b", "scanner": "scanner-primary", "fingerprint": "57079f5a533c2d94", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/student.py"}, "region": {"startLine": 44}}}]}, {"ruleId": "scanner-e10daf89a004ac87", "level": "error", "message": {"text": "FastAPI POST `gather` without auth dependency \u2014 backend/app/api/student.py:138"}, "properties": {"repobilityId": "eb59a1b94f6ff34a", "scanner": "scanner-primary", "fingerprint": "e10daf89a004ac87", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/student.py"}, "region": {"startLine": 138}}}]}, {"ruleId": "scanner-e1f89b0af45cab25", "level": "error", "message": {"text": "FastAPI POST `craft` without auth dependency \u2014 backend/app/api/student.py:149"}, "properties": {"repobilityId": "bc5cdf8955a1b956", "scanner": "scanner-primary", "fingerprint": "e1f89b0af45cab25", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/student.py"}, "region": {"startLine": 149}}}]}, {"ruleId": "scanner-1382bd08ef40d6b6", "level": "error", "message": {"text": "FastAPI POST `build` without auth dependency \u2014 backend/app/api/student.py:159"}, "properties": {"repobilityId": "83e503e6f83ea15b", "scanner": "scanner-primary", "fingerprint": "1382bd08ef40d6b6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/student.py"}, "region": {"startLine": 159}}}]}, {"ruleId": "scanner-ee6a14690cb1d691", "level": "error", "message": {"text": "FastAPI POST `upgrade` without auth dependency \u2014 backend/app/api/student.py:165"}, "properties": {"repobilityId": "834b15765a3056d1", "scanner": "scanner-primary", "fingerprint": "ee6a14690cb1d691", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/student.py"}, "region": {"startLine": 165}}}]}, {"ruleId": "scanner-3846ef9128fc14d8", "level": "error", "message": {"text": "FastAPI POST `hire` without auth dependency \u2014 backend/app/api/student.py:175"}, "properties": {"repobilityId": "c8c13af0904f8fba", "scanner": "scanner-primary", "fingerprint": "3846ef9128fc14d8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/student.py"}, "region": {"startLine": 175}}}]}, {"ruleId": "scanner-dd92fdf46d18b104", "level": "error", "message": {"text": "FastAPI POST `scrubber` without auth dependency \u2014 backend/app/api/student.py:182"}, "properties": {"repobilityId": "cf657a06dd393a83", "scanner": "scanner-primary", "fingerprint": "dd92fdf46d18b104", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/student.py"}, "region": {"startLine": 182}}}]}, {"ruleId": "scanner-9b22f435bbd3f231", "level": "error", "message": {"text": "FastAPI POST `set_listing` without auth dependency \u2014 backend/app/api/student.py:196"}, "properties": {"repobilityId": "003c133c674d51a5", "scanner": "scanner-primary", "fingerprint": "9b22f435bbd3f231", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/student.py"}, "region": {"startLine": 196}}}]}, {"ruleId": "scanner-3df2dc20913ac844", "level": "error", "message": {"text": "FastAPI POST `fresh_start` without auth dependency \u2014 backend/app/api/student.py:232"}, "properties": {"repobilityId": "18033c3be139e72f", "scanner": "scanner-primary", "fingerprint": "3df2dc20913ac844", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/student.py"}, "region": {"startLine": 232}}}]}, {"ruleId": "scanner-cbe18edf4a068f22", "level": "error", "message": {"text": "FastAPI POST `create_compact` without auth dependency \u2014 backend/app/api/student.py:283"}, "properties": {"repobilityId": "4e442c85a1846e5a", "scanner": "scanner-primary", "fingerprint": "cbe18edf4a068f22", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/student.py"}, "region": {"startLine": 283}}}]}, {"ruleId": "scanner-8402ca7493098f76", "level": "error", "message": {"text": "FastAPI POST `join_compact` without auth dependency \u2014 backend/app/api/student.py:290"}, "properties": {"repobilityId": "5a05bb87e101eff4", "scanner": "scanner-primary", "fingerprint": "8402ca7493098f76", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/student.py"}, "region": {"startLine": 290}}}]}, {"ruleId": "scanner-c3e38e855ea81ba4", "level": "error", "message": {"text": "FastAPI POST `leave_compact` without auth dependency \u2014 backend/app/api/student.py:297"}, "properties": {"repobilityId": "7b0afb3b83d25304", "scanner": "scanner-primary", "fingerprint": "c3e38e855ea81ba4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/student.py"}, "region": {"startLine": 297}}}]}, {"ruleId": "scanner-dbd960814e19842d", "level": "error", "message": {"text": "FastAPI POST `bid_license` without auth dependency \u2014 backend/app/api/student.py:309"}, "properties": {"repobilityId": "1622022c35024a15", "scanner": "scanner-primary", "fingerprint": "dbd960814e19842d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/student.py"}, "region": {"startLine": 309}}}]}, {"ruleId": "scanner-a72e47ce06a881a1", "level": "error", "message": {"text": "FastAPI POST `magic_request` without auth dependency \u2014 backend/app/api/auth.py:43"}, "properties": {"repobilityId": "b70a793d9999e035", "scanner": "scanner-primary", "fingerprint": "a72e47ce06a881a1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/auth.py"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-268a235cc4368307", "level": "error", "message": {"text": "FastAPI POST `magic_redeem` without auth dependency \u2014 backend/app/api/auth.py:66"}, "properties": {"repobilityId": "60182dabe88a7038", "scanner": "scanner-primary", "fingerprint": "268a235cc4368307", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/auth.py"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-864b9208ee904f65", "level": "error", "message": {"text": "FastAPI POST `demo_student` without auth dependency \u2014 backend/app/api/demo.py:43"}, "properties": {"repobilityId": "4bf0e9df964ecc1a", "scanner": "scanner-primary", "fingerprint": "864b9208ee904f65", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/demo.py"}, "region": {"startLine": 43}}}]}, {"ruleId": "scanner-179e4429f0e5b707", "level": "error", "message": {"text": "FastAPI POST `demo_instructor` without auth dependency \u2014 backend/app/api/demo.py:66"}, "properties": {"repobilityId": "cdfb27cd916a5d36", "scanner": "scanner-primary", "fingerprint": "179e4429f0e5b707", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/demo.py"}, "region": {"startLine": 66}}}]}, {"ruleId": "scanner-7b733038f92c4fde", "level": "error", "message": {"text": "FastAPI POST `guess` without auth dependency \u2014 backend/app/api/fun.py:21"}, "properties": {"repobilityId": "fff2a4b3cc102e4b", "scanner": "scanner-primary", "fingerprint": "7b733038f92c4fde", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/fun.py"}, "region": {"startLine": 21}}}]}, {"ruleId": "scanner-656f836619b33f29", "level": "error", "message": {"text": "FastAPI POST `cast` without auth dependency \u2014 backend/app/api/fun.py:26"}, "properties": {"repobilityId": "1637d8c87df782f5", "scanner": "scanner-primary", "fingerprint": "656f836619b33f29", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/fun.py"}, "region": {"startLine": 26}}}]}, {"ruleId": "scanner-a2d36b287490d821", "level": "error", "message": {"text": "FastAPI POST `merchant_submit` without auth dependency \u2014 backend/app/api/fun.py:40"}, "properties": {"repobilityId": "5bb291c8190d01aa", "scanner": "scanner-primary", "fingerprint": "a2d36b287490d821", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/fun.py"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-274556e324fc23f4", "level": "error", "message": {"text": "FastAPI POST `buy` without auth dependency \u2014 backend/app/api/fun.py:54"}, "properties": {"repobilityId": "bff03f4a41dd4d31", "scanner": "scanner-primary", "fingerprint": "274556e324fc23f4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/fun.py"}, "region": {"startLine": 54}}}]}, {"ruleId": "scanner-173d64fc1907a284", "level": "error", "message": {"text": "FastAPI POST `place_order` without auth dependency \u2014 backend/app/api/market.py:23"}, "properties": {"repobilityId": "847793725ac401f6", "scanner": "scanner-primary", "fingerprint": "173d64fc1907a284", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/market.py"}, "region": {"startLine": 23}}}]}, {"ruleId": "scanner-37287256ffd261aa", "level": "error", "message": {"text": "FastAPI DELETE `cancel_order` without auth dependency \u2014 backend/app/api/market.py:33"}, "properties": {"repobilityId": "c3027e2c8e89d4d3", "scanner": "scanner-primary", "fingerprint": "37287256ffd261aa", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/market.py"}, "region": {"startLine": 33}}}]}, {"ruleId": "scanner-8d40df2b543fc6ab", "level": "error", "message": {"text": "FastAPI POST `create_world` without auth dependency \u2014 backend/app/api/instructor.py:38"}, "properties": {"repobilityId": "61f6307dcb2b7665", "scanner": "scanner-primary", "fingerprint": "8d40df2b543fc6ab", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/instructor.py"}, "region": {"startLine": 38}}}]}, {"ruleId": "scanner-3e6cb3f6258f3614", "level": "error", "message": {"text": "FastAPI POST `preview` without auth dependency \u2014 backend/app/api/instructor.py:136"}, "properties": {"repobilityId": "c6060330923dd6f7", "scanner": "scanner-primary", "fingerprint": "3e6cb3f6258f3614", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/instructor.py"}, "region": {"startLine": 136}}}]}, {"ruleId": "scanner-766f2a3f1dd17842", "level": "error", "message": {"text": "FastAPI POST `execute` without auth dependency \u2014 backend/app/api/instructor.py:141"}, "properties": {"repobilityId": "8891bcbd18e6eb40", "scanner": "scanner-primary", "fingerprint": "766f2a3f1dd17842", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/instructor.py"}, "region": {"startLine": 141}}}]}, {"ruleId": "scanner-c81e72b2d99196b4", "level": "error", "message": {"text": "FastAPI POST `advance` without auth dependency \u2014 backend/app/api/instructor.py:159"}, "properties": {"repobilityId": "e91cdb315303d6f5", "scanner": "scanner-primary", "fingerprint": "c81e72b2d99196b4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/instructor.py"}, "region": {"startLine": 159}}}]}, {"ruleId": "scanner-aaaa5e96bba1acb1", "level": "error", "message": {"text": "FastAPI POST `set_state` without auth dependency \u2014 backend/app/api/instructor.py:170"}, "properties": {"repobilityId": "1db81fc10f7ea738", "scanner": "scanner-primary", "fingerprint": "aaaa5e96bba1acb1", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/instructor.py"}, "region": {"startLine": 170}}}]}, {"ruleId": "scanner-2cbeaad18fb9d19c", "level": "error", "message": {"text": "FastAPI POST `close_day` without auth dependency \u2014 backend/app/api/instructor.py:177"}, "properties": {"repobilityId": "086e3bc063f1109b", "scanner": "scanner-primary", "fingerprint": "2cbeaad18fb9d19c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/instructor.py"}, "region": {"startLine": 177}}}]}, {"ruleId": "scanner-1a6124ae013fa6c9", "level": "error", "message": {"text": "FastAPI POST `grade_weights` without auth dependency \u2014 backend/app/api/instructor.py:215"}, "properties": {"repobilityId": "8da1fbfabc17a326", "scanner": "scanner-primary", "fingerprint": "1a6124ae013fa6c9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/instructor.py"}, "region": {"startLine": 215}}}]}, {"ruleId": "scanner-47b9ff33841f47d6", "level": "error", "message": {"text": "FastAPI POST `digest_send` without auth dependency \u2014 backend/app/api/instructor.py:251"}, "properties": {"repobilityId": "84a70c848998c5f6", "scanner": "scanner-primary", "fingerprint": "47b9ff33841f47d6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/instructor.py"}, "region": {"startLine": 251}}}]}, {"ruleId": "scanner-d3cf232b64129e13", "level": "error", "message": {"text": "FastAPI POST `digest_settings` without auth dependency \u2014 backend/app/api/instructor.py:278"}, "properties": {"repobilityId": "a5a96e61b1df7c6b", "scanner": "scanner-primary", "fingerprint": "d3cf232b64129e13", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/app/api/instructor.py"}, "region": {"startLine": 278}}}]}, {"ruleId": "scanner-0331592dbde0cc6d", "level": "note", "message": {"text": "Unused endpoint: POST /worlds/{world_id}/tutor/chat"}, "properties": {"repobilityId": "b0053c16b506fa49", "scanner": "scanner-primary", "fingerprint": "0331592dbde0cc6d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9754f2ce20960988", "level": "note", "message": {"text": "Unused endpoint: GET /worlds/{world_id}/tutor/history"}, "properties": {"repobilityId": "b79dd8bf278f5255", "scanner": "scanner-primary", "fingerprint": "9754f2ce20960988", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8b189e3f407b0c12", "level": "note", "message": {"text": "Unused endpoint: GET /worlds/{world_id}/tutor/check"}, "properties": {"repobilityId": "cb797eb8b78bc242", "scanner": "scanner-primary", "fingerprint": "8b189e3f407b0c12", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e6e8244d824cdf16", "level": "note", "message": {"text": "Unused endpoint: POST /worlds/{world_id}/tutor/check"}, "properties": {"repobilityId": "38f45f550b48b1e0", "scanner": "scanner-primary", "fingerprint": "e6e8244d824cdf16", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-98c26fe8d55760fd", "level": "note", "message": {"text": "Unused endpoint: GET /worlds/{world_id}/tutor/mastery"}, "properties": {"repobilityId": "650ffa4a4b13e114", "scanner": "scanner-primary", "fingerprint": "98c26fe8d55760fd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-633d0a653ebbf1bf", "level": "note", "message": {"text": "Unused endpoint: POST /join"}, "properties": {"repobilityId": "5e2242e5a3302ae0", "scanner": "scanner-primary", "fingerprint": "633d0a653ebbf1bf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a3f35227ac645505", "level": "note", "message": {"text": "Unused endpoint: GET /worlds/{world_id}/state"}, "properties": {"repobilityId": "2f857e08be9fac3a", "scanner": "scanner-primary", "fingerprint": "a3f35227ac645505", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b84fccbcddcc4eb3", "level": "note", "message": {"text": "Unused endpoint: POST /worlds/{world_id}/gather"}, "properties": {"repobilityId": "6b1d0ef9c276a857", "scanner": "scanner-primary", "fingerprint": "b84fccbcddcc4eb3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-63592331015e3b3b", "level": "note", "message": {"text": "Unused endpoint: POST /worlds/{world_id}/craft"}, "properties": {"repobilityId": "d53394f14e097e5b", "scanner": "scanner-primary", "fingerprint": "63592331015e3b3b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c87df92fcb66d90a", "level": "note", "message": {"text": "Unused endpoint: POST /worlds/{world_id}/facilities"}, "properties": {"repobilityId": "b2e11fa8e261496e", "scanner": "scanner-primary", "fingerprint": "c87df92fcb66d90a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-88646486f3b88d94", "level": "note", "message": {"text": "Unused endpoint: POST /worlds/{world_id}/facilities/{facility_id}/upgrade"}, "properties": {"repobilityId": "a56cc3d9fc830374", "scanner": "scanner-primary", "fingerprint": "88646486f3b88d94", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-80c7d5043b9ed42d", "level": "note", "message": {"text": "Unused endpoint: POST /worlds/{world_id}/facilities/{facility_id}/workers"}, "properties": {"repobilityId": "c4e8c2161a0d0e52", "scanner": "scanner-primary", "fingerprint": "80c7d5043b9ed42d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-17c900b2de373e20", "level": "note", "message": {"text": "Unused endpoint: POST /worlds/{world_id}/facilities/{facility_id}/scrubber"}, "properties": {"repobilityId": "d8add10c89fe6544", "scanner": "scanner-primary", "fingerprint": "17c900b2de373e20", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3a7d20293dab7627", "level": "note", "message": {"text": "Unused endpoint: POST /worlds/{world_id}/shop"}, "properties": {"repobilityId": "8515700280227b74", "scanner": "scanner-primary", "fingerprint": "3a7d20293dab7627", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0ee7027808b9b7bc", "level": "note", "message": {"text": "Unused endpoint: GET /worlds/{world_id}/shop"}, "properties": {"repobilityId": "c882345b029774ac", "scanner": "scanner-primary", "fingerprint": "0ee7027808b9b7bc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8e4002dd863010dc", "level": "note", "message": {"text": "Unused endpoint: POST /worlds/{world_id}/fresh-start"}, "properties": {"repobilityId": "8e3c55244bfb587d", "scanner": "scanner-primary", "fingerprint": "8e4002dd863010dc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-563aa6a59a91df29", "level": "note", "message": {"text": "Unused endpoint: GET /worlds/{world_id}/crier"}, "properties": {"repobilityId": "76b6e4d403978663", "scanner": "scanner-primary", "fingerprint": "563aa6a59a91df29", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-db3faa0339ffd0ce", "level": "note", "message": {"text": "Unused endpoint: GET /worlds/{world_id}/leaderboards"}, "properties": {"repobilityId": "a18e0421957f7d06", "scanner": "scanner-primary", "fingerprint": "db3faa0339ffd0ce", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c3b8165c9bb252cc", "level": "note", "message": {"text": "Unused endpoint: GET /worlds/{world_id}/compacts"}, "properties": {"repobilityId": "cd2304dc9bd1daa4", "scanner": "scanner-primary", "fingerprint": "c3b8165c9bb252cc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7cf5c0ec40ef9753", "level": "note", "message": {"text": "Unused endpoint: POST /worlds/{world_id}/compacts"}, "properties": {"repobilityId": "5ece7d843ca2d743", "scanner": "scanner-primary", "fingerprint": "7cf5c0ec40ef9753", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5542bac2910592da", "level": "note", "message": {"text": "Unused endpoint: POST /worlds/{world_id}/compacts/{compact_id}/join"}, "properties": {"repobilityId": "27447fa47edf231c", "scanner": "scanner-primary", "fingerprint": "5542bac2910592da", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a8de36646d75b65a", "level": "note", "message": {"text": "Unused endpoint: POST /worlds/{world_id}/compacts/{compact_id}/leave"}, "properties": {"repobilityId": "6740d3652f776b16", "scanner": "scanner-primary", "fingerprint": "a8de36646d75b65a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6074c7022681ef52", "level": "note", "message": {"text": "Unused endpoint: POST /worlds/{world_id}/license-bids"}, "properties": {"repobilityId": "88e3fcae0e697e81", "scanner": "scanner-primary", "fingerprint": "6074c7022681ef52", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e433a6d34bc1d5d0", "level": "note", "message": {"text": "Unused endpoint: GET /worlds/{world_id}/license-auctions"}, "properties": {"repobilityId": "d90d8a71bb8bdfb0", "scanner": "scanner-primary", "fingerprint": "e433a6d34bc1d5d0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-839b456f3083153d", "level": "note", "message": {"text": "Unused endpoint: GET /worlds/{world_id}/recap"}, "properties": {"repobilityId": "674724bbbb29d180", "scanner": "scanner-primary", "fingerprint": "839b456f3083153d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-304b6f2b403d93f7", "level": "note", "message": {"text": "Unused endpoint: POST /register"}, "properties": {"repobilityId": "43913206e72a18a9", "scanner": "scanner-primary", "fingerprint": "304b6f2b403d93f7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-618721b912bad1c2", "level": "note", "message": {"text": "Unused endpoint: POST /login"}, "properties": {"repobilityId": "e7d3ffcdf5909ce7", "scanner": "scanner-primary", "fingerprint": "618721b912bad1c2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d92c71d9acccce68", "level": "note", "message": {"text": "Unused endpoint: POST /magic/request"}, "properties": {"repobilityId": "de8f4eecb229502d", "scanner": "scanner-primary", "fingerprint": "d92c71d9acccce68", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-602db5f103fa952e", "level": "note", "message": {"text": "Unused endpoint: POST /magic/redeem"}, "properties": {"repobilityId": "afaa534637e37203", "scanner": "scanner-primary", "fingerprint": "602db5f103fa952e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fd1dc91abf32142d", "level": "note", "message": {"text": "Unused endpoint: GET /me"}, "properties": {"repobilityId": "be68bcaaa1b53d6c", "scanner": "scanner-primary", "fingerprint": "fd1dc91abf32142d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b484de5627287407", "level": "note", "message": {"text": "Unused endpoint: POST /student"}, "properties": {"repobilityId": "186d1371d7f281be", "scanner": "scanner-primary", "fingerprint": "b484de5627287407", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-05a73222757e136f", "level": "note", "message": {"text": "Unused endpoint: POST /instructor"}, "properties": {"repobilityId": "2eb064848a8a310f", "scanner": "scanner-primary", "fingerprint": "05a73222757e136f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ac2f552bf9d967ce", "level": "note", "message": {"text": "Unused endpoint: GET /overview"}, "properties": {"repobilityId": "fb213784550f0203", "scanner": "scanner-primary", "fingerprint": "ac2f552bf9d967ce", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d7fa8929da9cbe3f", "level": "note", "message": {"text": "Unused endpoint: GET /balance"}, "properties": {"repobilityId": "5646f90cd6c246f4", "scanner": "scanner-primary", "fingerprint": "d7fa8929da9cbe3f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e0cab2960e7dbc4c", "level": "note", "message": {"text": "Unused endpoint: GET /worlds/{world_id}/puzzle"}, "properties": {"repobilityId": "89746509b208221e", "scanner": "scanner-primary", "fingerprint": "e0cab2960e7dbc4c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4ee0d69b7399b1ac", "level": "note", "message": {"text": "Unused endpoint: POST /worlds/{world_id}/puzzle/guess"}, "properties": {"repobilityId": "d2a2fbb8f077005c", "scanner": "scanner-primary", "fingerprint": "4ee0d69b7399b1ac", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2555cdbf4701e692", "level": "note", "message": {"text": "Unused endpoint: POST /worlds/{world_id}/fishing/cast"}, "properties": {"repobilityId": "7ddcd221e7a0a216", "scanner": "scanner-primary", "fingerprint": "2555cdbf4701e692", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-382d0bc19d1a4f9d", "level": "note", "message": {"text": "Unused endpoint: GET /worlds/{world_id}/merchant"}, "properties": {"repobilityId": "680e9c0360027862", "scanner": "scanner-primary", "fingerprint": "382d0bc19d1a4f9d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fb30d6aefda3ecf2", "level": "note", "message": {"text": "Unused endpoint: POST /worlds/{world_id}/merchant/submit"}, "properties": {"repobilityId": "cfbc28aee457802a", "scanner": "scanner-primary", "fingerprint": "fb30d6aefda3ecf2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4ca190efd2427443", "level": "note", "message": {"text": "Unused endpoint: GET /worlds/{world_id}/boutique"}, "properties": {"repobilityId": "97afe4a3f300e567", "scanner": "scanner-primary", "fingerprint": "4ca190efd2427443", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4652224903e49dc6", "level": "note", "message": {"text": "Unused endpoint: POST /worlds/{world_id}/boutique/buy"}, "properties": {"repobilityId": "d2e8c4dcec5b6ecc", "scanner": "scanner-primary", "fingerprint": "4652224903e49dc6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-889eec3e61d2d420", "level": "note", "message": {"text": "Unused endpoint: POST /worlds/{world_id}/orders"}, "properties": {"repobilityId": "339fbaf587cd11d3", "scanner": "scanner-primary", "fingerprint": "889eec3e61d2d420", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d7a2b670eb6566f0", "level": "note", "message": {"text": "Unused endpoint: DELETE /worlds/{world_id}/orders/{order_id}"}, "properties": {"repobilityId": "b1ed2b6a422c82b7", "scanner": "scanner-primary", "fingerprint": "d7a2b670eb6566f0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-af1c8438a0448805", "level": "note", "message": {"text": "Unused endpoint: GET /worlds/{world_id}/markets/{good_id}/book"}, "properties": {"repobilityId": "9c6b864efdeb6bf7", "scanner": "scanner-primary", "fingerprint": "af1c8438a0448805", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f5467aeca9c45a70", "level": "note", "message": {"text": "Unused endpoint: GET /worlds/{world_id}/markets/{good_id}/history"}, "properties": {"repobilityId": "4a45922535d45551", "scanner": "scanner-primary", "fingerprint": "f5467aeca9c45a70", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7b0721caa0bd773a", "level": "note", "message": {"text": "Unused endpoint: GET /worlds/{world_id}/markets/{good_id}/tape"}, "properties": {"repobilityId": "b9841b6043c527a7", "scanner": "scanner-primary", "fingerprint": "7b0721caa0bd773a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f1c6082f939b28d8", "level": "note", "message": {"text": "Unused endpoint: POST /instructor/worlds"}, "properties": {"repobilityId": "de2c62885fe2bc38", "scanner": "scanner-primary", "fingerprint": "f1c6082f939b28d8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4ccf446c3366a5fe", "level": "note", "message": {"text": "Unused endpoint: GET /worlds/{world_id}/instructor/dashboard"}, "properties": {"repobilityId": "d151b2fa090f8ec0", "scanner": "scanner-primary", "fingerprint": "4ccf446c3366a5fe", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-351715375132eeea", "level": "note", "message": {"text": "Unused endpoint: GET /worlds/{world_id}/instructor/feed"}, "properties": {"repobilityId": "cadd372f91199db8", "scanner": "scanner-primary", "fingerprint": "351715375132eeea", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f36d5f14b25b9e89", "level": "note", "message": {"text": "Unused endpoint: GET /worlds/{world_id}/instructor/interventions"}, "properties": {"repobilityId": "53595af003fc920d", "scanner": "scanner-primary", "fingerprint": "f36d5f14b25b9e89", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}