{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-7b962b043bc1231c", "name": "Stray `console.log` in TS/JS \u2014 test_login.js:7", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 test_login.js:7"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-609b900960321b62", "name": "Stray `console.log` in TS/JS \u2014 test_login2.js:10", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 test_login2.js:10"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1ef72a1b26584783", "name": "Stray `console.log` in TS/JS \u2014 test_headful.js:1", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 test_headful.js:1"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cdbcf13492a96802", "name": "Stray `console.log` in TS/JS \u2014 test_ua.js:1", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 test_ua.js:1"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7255f6d0596aec52", "name": "Stray `console.log` in TS/JS \u2014 test_url.js:1", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 test_url.js:1"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5af7535f575ff129", "name": "Stray `console.log` in TS/JS \u2014 test_redir.js:1", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 test_redir.js:1"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-db6d632d96685b36", "name": "Stray `console.log` in TS/JS \u2014 test_login3.js:6", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 test_login3.js:6"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a853b162411b3c7e", "name": "Stray `console.log` in TS/JS \u2014 test_login4.js:20", "shortDescription": {"text": "Stray `console.log` in TS/JS \u2014 test_login4.js:20"}, "fullDescription": {"text": "Replace with the toast helper, an error boundary, or remove. `console.warn` / `console.error` are acceptable.\n\nWhy: Hygiene \u2014 easy to leak debug output.\nRule id: fq.console-leak"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0525824e073c7dd6", "name": "Insecure pattern 'direct_innerhtml_assignment' in server.js:426", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in server.js:426"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-a2d187e6c6142f2c", "name": "Insecure pattern 'cors_wildcard' in server.js:58", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in server.js:58"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-c353fab434a51377", "name": "Very large file: server.js (2861 lines)", "shortDescription": {"text": "Very large file: server.js (2861 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ef802bc4ef8793fc", "name": "Commented-code block (6 lines) in server.js:4", "shortDescription": {"text": "Commented-code block (6 lines) in server.js:4"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-37271937fa6aef5b", "name": "`fetch()` without try/.catch or AbortSignal \u2014 server.js:384", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 server.js:384"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3482f7e5dd70cd1a", "name": "6 env vars used in code but missing from .env.example", "shortDescription": {"text": "6 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `CHARGERBACK_URL`, `CLOUDBEDS_GUEST_PORTAL_BASE`, `MESSAGING_PROVIDER`, `PORT`, `TZ`, `WEBHOOK_PUBLIC_URL`. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-93800ee52f75a67d", "name": "Express POST `/api/admin/webhooks/register` admin endpoint without auth \u2014 server.js:1272", "shortDescription": {"text": "Express POST `/api/admin/webhooks/register` admin endpoint without auth \u2014 server.js:1272"}, "fullDescription": {"text": "Admin-scoped Express route with no recognizable auth: no middleware-position guard, no router-level guard above it in this file, and no inline permission call within the first 15 lines of the handler. If auth is applied where this router is mounted, dismiss with reason `by_design` or tag the route `// public-by-design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-b7ad37cc33af7604", "name": "Express DELETE `/api/admin/webhooks/:id` admin endpoint without auth \u2014 server.js:1297", "shortDescription": {"text": "Express DELETE `/api/admin/webhooks/:id` admin endpoint without auth \u2014 server.js:1297"}, "fullDescription": {"text": "Admin-scoped Express route with no recognizable auth: no middleware-position guard, no router-level guard above it in this file, and no inline permission call within the first 15 lines of the handler. If auth is applied where this router is mounted, dismiss with reason `by_design` or tag the route `// public-by-design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`server.js` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d3a434fedb1fa40", "name": "Unused endpoint: GET /chat", "shortDescription": {"text": "Unused endpoint: GET /chat"}, "fullDescription": {"text": "`server.js` declares `GET /chat` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11267d2d402c9e3d", "name": "Unused endpoint: GET /employee", "shortDescription": {"text": "Unused endpoint: GET /employee"}, "fullDescription": {"text": "`server.js` declares `GET /employee` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4904d2c5573fafa7", "name": "Unused endpoint: USE /api/doorlock", "shortDescription": {"text": "Unused endpoint: USE /api/doorlock"}, "fullDescription": {"text": "`server.js` declares `USE /api/doorlock` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86914181509f18a8", "name": "Unused endpoint: GET /golf-kiosk", "shortDescription": {"text": "Unused endpoint: GET /golf-kiosk"}, "fullDescription": {"text": "`server.js` declares `GET /golf-kiosk` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d23187d5313c7db7", "name": "Unused endpoint: GET /api/golf/config", "shortDescription": {"text": "Unused endpoint: GET /api/golf/config"}, "fullDescription": {"text": "`server.js` declares `GET /api/golf/config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ba68110251e46cca", "name": "Unused endpoint: GET /api/golf/health", "shortDescription": {"text": "Unused endpoint: GET /api/golf/health"}, "fullDescription": {"text": "`server.js` declares `GET /api/golf/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-52bd9959f4f00b92", "name": "Unused endpoint: GET /api/golf/:bayId/state", "shortDescription": {"text": "Unused endpoint: GET /api/golf/:bayId/state"}, "fullDescription": {"text": "`server.js` declares `GET /api/golf/:bayId/state` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d57a1bf43858213", "name": "Unused endpoint: POST /api/golf/:bayId/heartbeat", "shortDescription": {"text": "Unused endpoint: POST /api/golf/:bayId/heartbeat"}, "fullDescription": {"text": "`server.js` declares `POST /api/golf/:bayId/heartbeat` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6ca4e5bb18a56867", "name": "Unused endpoint: POST /api/golf/:bayId/force-end", "shortDescription": {"text": "Unused endpoint: POST /api/golf/:bayId/force-end"}, "fullDescription": {"text": "`server.js` declares `POST /api/golf/:bayId/force-end` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c5d434a3b1621a62", "name": "Unused endpoint: POST /api/golf/:bayId/extend", "shortDescription": {"text": "Unused endpoint: POST /api/golf/:bayId/extend"}, "fullDescription": {"text": "`server.js` declares `POST /api/golf/:bayId/extend` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f45daf52b3500736", "name": "Unused endpoint: POST /api/golf/:bayId/maintenance", "shortDescription": {"text": "Unused endpoint: POST /api/golf/:bayId/maintenance"}, "fullDescription": {"text": "`server.js` declares `POST /api/golf/:bayId/maintenance` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c455536fa53e1a9", "name": "Unused endpoint: POST /api/golf/:bayId/test-booking", "shortDescription": {"text": "Unused endpoint: POST /api/golf/:bayId/test-booking"}, "fullDescription": {"text": "`server.js` declares `POST /api/golf/:bayId/test-booking` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2df5fab436577306", "name": "Unused endpoint: POST /api/golf/:bayId/test-booking/clear", "shortDescription": {"text": "Unused endpoint: POST /api/golf/:bayId/test-booking/clear"}, "fullDescription": {"text": "`server.js` declares `POST /api/golf/:bayId/test-booking/clear` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e83919386d1f1b2a", "name": "Unused endpoint: GET /golf/test", "shortDescription": {"text": "Unused endpoint: GET /golf/test"}, "fullDescription": {"text": "`server.js` declares `GET /golf/test` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0c11b3a54ffd6bd5", "name": "Unused endpoint: POST /api/golf/profiles", "shortDescription": {"text": "Unused endpoint: POST /api/golf/profiles"}, "fullDescription": {"text": "`server.js` declares `POST /api/golf/profiles` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ed94bac6aaf5e4c0", "name": "Unused endpoint: GET /api/golf/profiles/search", "shortDescription": {"text": "Unused endpoint: GET /api/golf/profiles/search"}, "fullDescription": {"text": "`server.js` declares `GET /api/golf/profiles/search` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c70dc46ebbe1a97c", "name": "Unused endpoint: GET /api/golf/profiles/:id/settings", "shortDescription": {"text": "Unused endpoint: GET /api/golf/profiles/:id/settings"}, "fullDescription": {"text": "`server.js` declares `GET /api/golf/profiles/:id/settings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1da83585585f64eb", "name": "Unused endpoint: POST /api/golf/profiles/:id/settings", "shortDescription": {"text": "Unused endpoint: POST /api/golf/profiles/:id/settings"}, "fullDescription": {"text": "`server.js` declares `POST /api/golf/profiles/:id/settings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ba28d00c05129215", "name": "Unused endpoint: POST /api/golf/rounds", "shortDescription": {"text": "Unused endpoint: POST /api/golf/rounds"}, "fullDescription": {"text": "`server.js` declares `POST /api/golf/rounds` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-23219ff8cbed4b26", "name": "Unused endpoint: POST /api/golf/agent-heartbeat", "shortDescription": {"text": "Unused endpoint: POST /api/golf/agent-heartbeat"}, "fullDescription": {"text": "`server.js` declares `POST /api/golf/agent-heartbeat` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6925066f5ae5cce4", "name": "Unused endpoint: POST /api/golf/:bayId/launch", "shortDescription": {"text": "Unused endpoint: POST /api/golf/:bayId/launch"}, "fullDescription": {"text": "`server.js` declares `POST /api/golf/:bayId/launch` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-67db81ff589a2912", "name": "Unused endpoint: GET /alerts", "shortDescription": {"text": "Unused endpoint: GET /alerts"}, "fullDescription": {"text": "`server.js` declares `GET /alerts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7f8379af015149f1", "name": "Unused endpoint: GET /api/alerts", "shortDescription": {"text": "Unused endpoint: GET /api/alerts"}, "fullDescription": {"text": "`server.js` declares `GET /api/alerts` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2e9863a92cb67dda", "name": "Unused endpoint: POST /api/alerts/:id/ack", "shortDescription": {"text": "Unused endpoint: POST /api/alerts/:id/ack"}, "fullDescription": {"text": "`server.js` declares `POST /api/alerts/:id/ack` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4756b4c4da7d2088", "name": "Unused endpoint: GET /api/health", "shortDescription": {"text": "Unused endpoint: GET /api/health"}, "fullDescription": {"text": "`server.js` declares `GET /api/health` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0d921b8b07bec829", "name": "Unused endpoint: GET /api/employee/status", "shortDescription": {"text": "Unused endpoint: GET /api/employee/status"}, "fullDescription": {"text": "`server.js` declares `GET /api/employee/status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d936fa8019609d54", "name": "Unused endpoint: GET /api/employee/knowledge", "shortDescription": {"text": "Unused endpoint: GET /api/employee/knowledge"}, "fullDescription": {"text": "`server.js` declares `GET /api/employee/knowledge` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-76f65a9a6ff8f02d", "name": "Unused endpoint: POST /api/employee/knowledge", "shortDescription": {"text": "Unused endpoint: POST /api/employee/knowledge"}, "fullDescription": {"text": "`server.js` declares `POST /api/employee/knowledge` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a1fbdb22d27db3eb", "name": "Unused endpoint: POST /api/employee/learning/discover", "shortDescription": {"text": "Unused endpoint: POST /api/employee/learning/discover"}, "fullDescription": {"text": "`server.js` declares `POST /api/employee/learning/discover` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-86e6cc5d21f1c726", "name": "Unused endpoint: GET /api/employee/learning/logs", "shortDescription": {"text": "Unused endpoint: GET /api/employee/learning/logs"}, "fullDescription": {"text": "`server.js` declares `GET /api/employee/learning/logs` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b41ebc4856c232b7", "name": "Unused endpoint: POST /api/employee/reports/night-audit", "shortDescription": {"text": "Unused endpoint: POST /api/employee/reports/night-audit"}, "fullDescription": {"text": "`server.js` declares `POST /api/employee/reports/night-audit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4afe09a51f98a779", "name": "Unused endpoint: GET /api/housekeeping/state", "shortDescription": {"text": "Unused endpoint: GET /api/housekeeping/state"}, "fullDescription": {"text": "`server.js` declares `GET /api/housekeeping/state` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f12a342e0dd7e5ca", "name": "Unused endpoint: GET /api/housekeeping/housekeepers", "shortDescription": {"text": "Unused endpoint: GET /api/housekeeping/housekeepers"}, "fullDescription": {"text": "`server.js` declares `GET /api/housekeeping/housekeepers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c7029518b10dcd1", "name": "Unused endpoint: GET /api/employee/housekeeping/roster", "shortDescription": {"text": "Unused endpoint: GET /api/employee/housekeeping/roster"}, "fullDescription": {"text": "`server.js` declares `GET /api/employee/housekeeping/roster` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-92f04db62b5d0b94", "name": "Unused endpoint: POST /api/employee/housekeeping/roster", "shortDescription": {"text": "Unused endpoint: POST /api/employee/housekeeping/roster"}, "fullDescription": {"text": "`server.js` declares `POST /api/employee/housekeeping/roster` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-115b6acbd593cde5", "name": "Unused endpoint: DELETE /api/employee/housekeeping/roster/:id", "shortDescription": {"text": "Unused endpoint: DELETE /api/employee/housekeeping/roster/:id"}, "fullDescription": {"text": "`server.js` declares `DELETE /api/employee/housekeeping/roster/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a6d94e9bee338e5", "name": "Unused endpoint: GET /api/employee/housekeeping/statuses", "shortDescription": {"text": "Unused endpoint: GET /api/employee/housekeeping/statuses"}, "fullDescription": {"text": "`server.js` declares `GET /api/employee/housekeeping/statuses` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-926c792e6bfe6fed", "name": "Unused endpoint: POST /api/employee/housekeeping/statuses", "shortDescription": {"text": "Unused endpoint: POST /api/employee/housekeeping/statuses"}, "fullDescription": {"text": "`server.js` declares `POST /api/employee/housekeeping/statuses` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9a1189b05eb63d10", "name": "Unused endpoint: DELETE /api/employee/housekeeping/statuses/:id", "shortDescription": {"text": "Unused endpoint: DELETE /api/employee/housekeeping/statuses/:id"}, "fullDescription": {"text": "`server.js` declares `DELETE /api/employee/housekeeping/statuses/:id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-179890e717aa581c", "name": "Unused endpoint: GET /api/employee/housekeeping/productivity", "shortDescription": {"text": "Unused endpoint: GET /api/employee/housekeeping/productivity"}, "fullDescription": {"text": "`server.js` declares `GET /api/employee/housekeeping/productivity` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-03a20e54deb1e0a7", "name": "Unused endpoint: GET /api/employee/housekeeping/audit", "shortDescription": {"text": "Unused endpoint: GET /api/employee/housekeeping/audit"}, "fullDescription": {"text": "`server.js` declares `GET /api/employee/housekeeping/audit` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-60be252341fe0b8b", "name": "Unused endpoint: GET /api/housekeeping/config", "shortDescription": {"text": "Unused endpoint: GET /api/housekeeping/config"}, "fullDescription": {"text": "`server.js` declares `GET /api/housekeeping/config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b576a40e104d1f9b", "name": "Unused endpoint: POST /api/employee/housekeeping/import-from-sheets", "shortDescription": {"text": "Unused endpoint: POST /api/employee/housekeeping/import-from-sheets"}, "fullDescription": {"text": "`server.js` declares `POST /api/employee/housekeeping/import-from-sheets` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bb7ed5ba6f743872", "name": "Unused endpoint: POST /api/employee/housekeeping/rerun-assignment", "shortDescription": {"text": "Unused endpoint: POST /api/employee/housekeeping/rerun-assignment"}, "fullDescription": {"text": "`server.js` declares `POST /api/employee/housekeeping/rerun-assignment` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-193e06e786683e2f", "name": "Unused endpoint: GET /api/employee/forecast", "shortDescription": {"text": "Unused endpoint: GET /api/employee/forecast"}, "fullDescription": {"text": "`server.js` declares `GET /api/employee/forecast` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b5f69d9125f9361c", "name": "Unused endpoint: GET /api/employee/business-on-books", "shortDescription": {"text": "Unused endpoint: GET /api/employee/business-on-books"}, "fullDescription": {"text": "`server.js` declares `GET /api/employee/business-on-books` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9b22be1a9f5554b4", "name": "Unused endpoint: GET /api/employee/groups", "shortDescription": {"text": "Unused endpoint: GET /api/employee/groups"}, "fullDescription": {"text": "`server.js` declares `GET /api/employee/groups` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-65739ecbf97d4a99", "name": "Unused endpoint: GET /api/employee/groups/:id/outstanding-invoice", "shortDescription": {"text": "Unused endpoint: GET /api/employee/groups/:id/outstanding-invoice"}, "fullDescription": {"text": "`server.js` declares `GET /api/employee/groups/:id/outstanding-invoice` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6609ad10c66fe12c", "name": "Unused endpoint: GET /api/employee/debug/report-shape", "shortDescription": {"text": "Unused endpoint: GET /api/employee/debug/report-shape"}, "fullDescription": {"text": "`server.js` declares `GET /api/employee/debug/report-shape` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/25682"}, "properties": {"repository": "ericdolsen/cloudbeds-autonomy-engine", "repoUrl": "https://github.com/ericdolsen/cloudbeds-autonomy-engine", "branch": "main"}, "results": [{"ruleId": "scanner-7b962b043bc1231c", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 test_login.js:7"}, "properties": {"repobilityId": "6f4fcc793a8873a5", "scanner": "scanner-primary", "fingerprint": "7b962b043bc1231c", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-609b900960321b62", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 test_login2.js:10"}, "properties": {"repobilityId": "56e799dad1247708", "scanner": "scanner-primary", "fingerprint": "609b900960321b62", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-1ef72a1b26584783", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 test_headful.js:1"}, "properties": {"repobilityId": "efa2eec21667cf3d", "scanner": "scanner-primary", "fingerprint": "1ef72a1b26584783", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-cdbcf13492a96802", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 test_ua.js:1"}, "properties": {"repobilityId": "dccef150cc93cff1", "scanner": "scanner-primary", "fingerprint": "cdbcf13492a96802", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-7255f6d0596aec52", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 test_url.js:1"}, "properties": {"repobilityId": "361fa7f235b08b85", "scanner": "scanner-primary", "fingerprint": "7255f6d0596aec52", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-5af7535f575ff129", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 test_redir.js:1"}, "properties": {"repobilityId": "d274fe31221cf0b4", "scanner": "scanner-primary", "fingerprint": "5af7535f575ff129", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-db6d632d96685b36", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 test_login3.js:6"}, "properties": {"repobilityId": "cbe7c458218ffc26", "scanner": "scanner-primary", "fingerprint": "db6d632d96685b36", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-a853b162411b3c7e", "level": "note", "message": {"text": "Stray `console.log` in TS/JS \u2014 test_login4.js:20"}, "properties": {"repobilityId": "a19d61cdadc3a428", "scanner": "scanner-primary", "fingerprint": "a853b162411b3c7e", "layer": "frontend", "severity": "low", "confidence": 1.0, "tags": ["frontend-quality", "fq.console-leak"]}}, {"ruleId": "scanner-0525824e073c7dd6", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in server.js:426"}, "properties": {"repobilityId": "eced4d3daf81c2bf", "scanner": "scanner-primary", "fingerprint": "0525824e073c7dd6", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.js"}, "region": {"startLine": 426}}}]}, {"ruleId": "scanner-a2d187e6c6142f2c", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in server.js:58"}, "properties": {"repobilityId": "0d9bca6c0839725e", "scanner": "scanner-primary", "fingerprint": "a2d187e6c6142f2c", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.js"}, "region": {"startLine": 58}}}]}, {"ruleId": "scanner-c353fab434a51377", "level": "note", "message": {"text": "Very large file: server.js (2861 lines)"}, "properties": {"repobilityId": "1479ba50e708c5c1", "scanner": "scanner-primary", "fingerprint": "c353fab434a51377", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "81cad8d133b8282e", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "06cd6684de99e619", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "89abdba2bd597af2", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ef802bc4ef8793fc", "level": "none", "message": {"text": "Commented-code block (6 lines) in server.js:4"}, "properties": {"repobilityId": "fa508a4f12c00f99", "scanner": "scanner-primary", "fingerprint": "ef802bc4ef8793fc", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-37271937fa6aef5b", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 server.js:384"}, "properties": {"repobilityId": "3a3e2799e01769a6", "scanner": "scanner-primary", "fingerprint": "37271937fa6aef5b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-3482f7e5dd70cd1a", "level": "note", "message": {"text": "6 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "1da70f25aa46f6e9", "scanner": "scanner-primary", "fingerprint": "3482f7e5dd70cd1a", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-93800ee52f75a67d", "level": "error", "message": {"text": "Express POST `/api/admin/webhooks/register` admin endpoint without auth \u2014 server.js:1272"}, "properties": {"repobilityId": "a20b873e7b84c9c0", "scanner": "scanner-primary", "fingerprint": "93800ee52f75a67d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.js.admin_unauth"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.js"}, "region": {"startLine": 1272}}}]}, {"ruleId": "scanner-b7ad37cc33af7604", "level": "error", "message": {"text": "Express DELETE `/api/admin/webhooks/:id` admin endpoint without auth \u2014 server.js:1297"}, "properties": {"repobilityId": "8bd6f302714dd2c3", "scanner": "scanner-primary", "fingerprint": "b7ad37cc33af7604", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.js.admin_unauth"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "server.js"}, "region": {"startLine": 1297}}}]}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "9b883326e67da4e4", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0d3a434fedb1fa40", "level": "note", "message": {"text": "Unused endpoint: GET /chat"}, "properties": {"repobilityId": "a6fca40d41648c2e", "scanner": "scanner-primary", "fingerprint": "0d3a434fedb1fa40", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-11267d2d402c9e3d", "level": "note", "message": {"text": "Unused endpoint: GET /employee"}, "properties": {"repobilityId": "bc26293c1d55068b", "scanner": "scanner-primary", "fingerprint": "11267d2d402c9e3d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4904d2c5573fafa7", "level": "note", "message": {"text": "Unused endpoint: USE /api/doorlock"}, "properties": {"repobilityId": "7811bcb2140edfad", "scanner": "scanner-primary", "fingerprint": "4904d2c5573fafa7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-86914181509f18a8", "level": "note", "message": {"text": "Unused endpoint: GET /golf-kiosk"}, "properties": {"repobilityId": "c3631265ecb80a0e", "scanner": "scanner-primary", "fingerprint": "86914181509f18a8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d23187d5313c7db7", "level": "note", "message": {"text": "Unused endpoint: GET /api/golf/config"}, "properties": {"repobilityId": "f216937c313ce527", "scanner": "scanner-primary", "fingerprint": "d23187d5313c7db7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ba68110251e46cca", "level": "note", "message": {"text": "Unused endpoint: GET /api/golf/health"}, "properties": {"repobilityId": "1df4ca83fe086f6e", "scanner": "scanner-primary", "fingerprint": "ba68110251e46cca", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-52bd9959f4f00b92", "level": "note", "message": {"text": "Unused endpoint: GET /api/golf/:bayId/state"}, "properties": {"repobilityId": "e272b7fdc7fac854", "scanner": "scanner-primary", "fingerprint": "52bd9959f4f00b92", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9d57a1bf43858213", "level": "note", "message": {"text": "Unused endpoint: POST /api/golf/:bayId/heartbeat"}, "properties": {"repobilityId": "76ec5b5fa11f2e80", "scanner": "scanner-primary", "fingerprint": "9d57a1bf43858213", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6ca4e5bb18a56867", "level": "note", "message": {"text": "Unused endpoint: POST /api/golf/:bayId/force-end"}, "properties": {"repobilityId": "5ef2d2e6132e4cb8", "scanner": "scanner-primary", "fingerprint": "6ca4e5bb18a56867", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c5d434a3b1621a62", "level": "note", "message": {"text": "Unused endpoint: POST /api/golf/:bayId/extend"}, "properties": {"repobilityId": "352cacc8eac63047", "scanner": "scanner-primary", "fingerprint": "c5d434a3b1621a62", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f45daf52b3500736", "level": "note", "message": {"text": "Unused endpoint: POST /api/golf/:bayId/maintenance"}, "properties": {"repobilityId": "3c3531bd663d9c2d", "scanner": "scanner-primary", "fingerprint": "f45daf52b3500736", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2c455536fa53e1a9", "level": "note", "message": {"text": "Unused endpoint: POST /api/golf/:bayId/test-booking"}, "properties": {"repobilityId": "ce004ddc7ffae2b4", "scanner": "scanner-primary", "fingerprint": "2c455536fa53e1a9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2df5fab436577306", "level": "note", "message": {"text": "Unused endpoint: POST /api/golf/:bayId/test-booking/clear"}, "properties": {"repobilityId": "f443f29815f8bede", "scanner": "scanner-primary", "fingerprint": "2df5fab436577306", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e83919386d1f1b2a", "level": "note", "message": {"text": "Unused endpoint: GET /golf/test"}, "properties": {"repobilityId": "c904fdf671cb903a", "scanner": "scanner-primary", "fingerprint": "e83919386d1f1b2a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0c11b3a54ffd6bd5", "level": "note", "message": {"text": "Unused endpoint: POST /api/golf/profiles"}, "properties": {"repobilityId": "d7bf498717bf0647", "scanner": "scanner-primary", "fingerprint": "0c11b3a54ffd6bd5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ed94bac6aaf5e4c0", "level": "note", "message": {"text": "Unused endpoint: GET /api/golf/profiles/search"}, "properties": {"repobilityId": "672204ec1c32610b", "scanner": "scanner-primary", "fingerprint": "ed94bac6aaf5e4c0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c70dc46ebbe1a97c", "level": "note", "message": {"text": "Unused endpoint: GET /api/golf/profiles/:id/settings"}, "properties": {"repobilityId": "a595cc773e7ba08a", "scanner": "scanner-primary", "fingerprint": "c70dc46ebbe1a97c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1da83585585f64eb", "level": "note", "message": {"text": "Unused endpoint: POST /api/golf/profiles/:id/settings"}, "properties": {"repobilityId": "9e9ef43a736bcc46", "scanner": "scanner-primary", "fingerprint": "1da83585585f64eb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ba28d00c05129215", "level": "note", "message": {"text": "Unused endpoint: POST /api/golf/rounds"}, "properties": {"repobilityId": "ae4934bfc731308f", "scanner": "scanner-primary", "fingerprint": "ba28d00c05129215", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-23219ff8cbed4b26", "level": "note", "message": {"text": "Unused endpoint: POST /api/golf/agent-heartbeat"}, "properties": {"repobilityId": "b3b7d122d3e58183", "scanner": "scanner-primary", "fingerprint": "23219ff8cbed4b26", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6925066f5ae5cce4", "level": "note", "message": {"text": "Unused endpoint: POST /api/golf/:bayId/launch"}, "properties": {"repobilityId": "7c3135b849797e66", "scanner": "scanner-primary", "fingerprint": "6925066f5ae5cce4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-67db81ff589a2912", "level": "note", "message": {"text": "Unused endpoint: GET /alerts"}, "properties": {"repobilityId": "cfe4cc660a25244b", "scanner": "scanner-primary", "fingerprint": "67db81ff589a2912", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7f8379af015149f1", "level": "note", "message": {"text": "Unused endpoint: GET /api/alerts"}, "properties": {"repobilityId": "fad070d8523ebf86", "scanner": "scanner-primary", "fingerprint": "7f8379af015149f1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2e9863a92cb67dda", "level": "note", "message": {"text": "Unused endpoint: POST /api/alerts/:id/ack"}, "properties": {"repobilityId": "1e69f4f5e3964e09", "scanner": "scanner-primary", "fingerprint": "2e9863a92cb67dda", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4756b4c4da7d2088", "level": "note", "message": {"text": "Unused endpoint: GET /api/health"}, "properties": {"repobilityId": "98e09bb8fcd7909b", "scanner": "scanner-primary", "fingerprint": "4756b4c4da7d2088", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0d921b8b07bec829", "level": "note", "message": {"text": "Unused endpoint: GET /api/employee/status"}, "properties": {"repobilityId": "da7a80ebacdd0f03", "scanner": "scanner-primary", "fingerprint": "0d921b8b07bec829", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d936fa8019609d54", "level": "note", "message": {"text": "Unused endpoint: GET /api/employee/knowledge"}, "properties": {"repobilityId": "39bf8f6900e77515", "scanner": "scanner-primary", "fingerprint": "d936fa8019609d54", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-76f65a9a6ff8f02d", "level": "note", "message": {"text": "Unused endpoint: POST /api/employee/knowledge"}, "properties": {"repobilityId": "baabd1a902869714", "scanner": "scanner-primary", "fingerprint": "76f65a9a6ff8f02d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a1fbdb22d27db3eb", "level": "note", "message": {"text": "Unused endpoint: POST /api/employee/learning/discover"}, "properties": {"repobilityId": "9c5624b3c958ffbb", "scanner": "scanner-primary", "fingerprint": "a1fbdb22d27db3eb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-86e6cc5d21f1c726", "level": "note", "message": {"text": "Unused endpoint: GET /api/employee/learning/logs"}, "properties": {"repobilityId": "35888e05cac68e32", "scanner": "scanner-primary", "fingerprint": "86e6cc5d21f1c726", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b41ebc4856c232b7", "level": "note", "message": {"text": "Unused endpoint: POST /api/employee/reports/night-audit"}, "properties": {"repobilityId": "76330e0ce2428524", "scanner": "scanner-primary", "fingerprint": "b41ebc4856c232b7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4afe09a51f98a779", "level": "note", "message": {"text": "Unused endpoint: GET /api/housekeeping/state"}, "properties": {"repobilityId": "f0e1ce18998ed9ea", "scanner": "scanner-primary", "fingerprint": "4afe09a51f98a779", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f12a342e0dd7e5ca", "level": "note", "message": {"text": "Unused endpoint: GET /api/housekeeping/housekeepers"}, "properties": {"repobilityId": "76942e14202db1a2", "scanner": "scanner-primary", "fingerprint": "f12a342e0dd7e5ca", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7c7029518b10dcd1", "level": "note", "message": {"text": "Unused endpoint: GET /api/employee/housekeeping/roster"}, "properties": {"repobilityId": "deb10b21bde608ec", "scanner": "scanner-primary", "fingerprint": "7c7029518b10dcd1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-92f04db62b5d0b94", "level": "note", "message": {"text": "Unused endpoint: POST /api/employee/housekeeping/roster"}, "properties": {"repobilityId": "23ef58bbd420a197", "scanner": "scanner-primary", "fingerprint": "92f04db62b5d0b94", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-115b6acbd593cde5", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/employee/housekeeping/roster/:id"}, "properties": {"repobilityId": "13decce1f4cbdfa4", "scanner": "scanner-primary", "fingerprint": "115b6acbd593cde5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2a6d94e9bee338e5", "level": "note", "message": {"text": "Unused endpoint: GET /api/employee/housekeeping/statuses"}, "properties": {"repobilityId": "464d3a94a50f3bff", "scanner": "scanner-primary", "fingerprint": "2a6d94e9bee338e5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-926c792e6bfe6fed", "level": "note", "message": {"text": "Unused endpoint: POST /api/employee/housekeeping/statuses"}, "properties": {"repobilityId": "cdf6a58b3a6a44a4", "scanner": "scanner-primary", "fingerprint": "926c792e6bfe6fed", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9a1189b05eb63d10", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/employee/housekeeping/statuses/:id"}, "properties": {"repobilityId": "6ad18d48a53cbfa5", "scanner": "scanner-primary", "fingerprint": "9a1189b05eb63d10", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-179890e717aa581c", "level": "note", "message": {"text": "Unused endpoint: GET /api/employee/housekeeping/productivity"}, "properties": {"repobilityId": "c355e8022909b5a7", "scanner": "scanner-primary", "fingerprint": "179890e717aa581c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-03a20e54deb1e0a7", "level": "note", "message": {"text": "Unused endpoint: GET /api/employee/housekeeping/audit"}, "properties": {"repobilityId": "eb61bb0f2f7af9e9", "scanner": "scanner-primary", "fingerprint": "03a20e54deb1e0a7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-60be252341fe0b8b", "level": "note", "message": {"text": "Unused endpoint: GET /api/housekeeping/config"}, "properties": {"repobilityId": "9489f53fb4296e9d", "scanner": "scanner-primary", "fingerprint": "60be252341fe0b8b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b576a40e104d1f9b", "level": "note", "message": {"text": "Unused endpoint: POST /api/employee/housekeeping/import-from-sheets"}, "properties": {"repobilityId": "9d65e86924cf8267", "scanner": "scanner-primary", "fingerprint": "b576a40e104d1f9b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bb7ed5ba6f743872", "level": "note", "message": {"text": "Unused endpoint: POST /api/employee/housekeeping/rerun-assignment"}, "properties": {"repobilityId": "2102e5c9c78913ab", "scanner": "scanner-primary", "fingerprint": "bb7ed5ba6f743872", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-193e06e786683e2f", "level": "note", "message": {"text": "Unused endpoint: GET /api/employee/forecast"}, "properties": {"repobilityId": "d4a774287e1b55af", "scanner": "scanner-primary", "fingerprint": "193e06e786683e2f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b5f69d9125f9361c", "level": "note", "message": {"text": "Unused endpoint: GET /api/employee/business-on-books"}, "properties": {"repobilityId": "fee64e65b4adc314", "scanner": "scanner-primary", "fingerprint": "b5f69d9125f9361c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9b22be1a9f5554b4", "level": "note", "message": {"text": "Unused endpoint: GET /api/employee/groups"}, "properties": {"repobilityId": "a4891683d0b89240", "scanner": "scanner-primary", "fingerprint": "9b22be1a9f5554b4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-65739ecbf97d4a99", "level": "note", "message": {"text": "Unused endpoint: GET /api/employee/groups/:id/outstanding-invoice"}, "properties": {"repobilityId": "58a8c55f86ffaffb", "scanner": "scanner-primary", "fingerprint": "65739ecbf97d4a99", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6609ad10c66fe12c", "level": "note", "message": {"text": "Unused endpoint: GET /api/employee/debug/report-shape"}, "properties": {"repobilityId": "e322cb81b23d43b0", "scanner": "scanner-primary", "fingerprint": "6609ad10c66fe12c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}