{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-cef9dbca0a8a26df", "name": "Possibly dead Python function: cmd_add", "shortDescription": {"text": "Possibly dead Python function: cmd_add"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d8ae24b37326f92e", "name": "Possibly dead Python function: cmd_remove", "shortDescription": {"text": "Possibly dead Python function: cmd_remove"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6ad1065e7642095f", "name": "Possibly dead Python function: cmd_list", "shortDescription": {"text": "Possibly dead Python function: cmd_list"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f1c8a442daecab38", "name": "Possibly dead Python function: cmd_expire", "shortDescription": {"text": "Possibly dead Python function: cmd_expire"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6372cebde0220094", "name": "No auth library detected", "shortDescription": {"text": "No auth library detected"}, "fullDescription": {"text": "The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). The repo has auth/admin/session surface indicators, so auth may live in custom code, in a separate service, or be missing."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-cddfdbf48900e3d9", "name": "Very large file: consolidate.py (3335 lines)", "shortDescription": {"text": "Very large file: consolidate.py (3335 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "6 tests / 45 src (ratio 0.13)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 102 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 19 placeholder/mock markers across 9 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-24f2ea4bd14badc1", "name": "Agent instruction contains unpinned remote install: CLAUDE.md", "shortDescription": {"text": "Agent instruction contains unpinned remote install: CLAUDE.md"}, "fullDescription": {"text": "Remote install commands in agent instructions are a supply-chain risk, especially when an agent can execute shell commands."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ce7b4602397c300d", "name": "Commented-code block (6 lines) in consolidate.py:37", "shortDescription": {"text": "Commented-code block (6 lines) in consolidate.py:37"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-6c9253a50553f274", "name": "Legacy-named symbol `svc_backup` in test_workflow_classification.py:91", "shortDescription": {"text": "Legacy-named symbol `svc_backup` in test_workflow_classification.py:91"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d1e4a3e7d614fcb9", "name": "Commented-code block (5 lines) in test_slow_chains.py:136", "shortDescription": {"text": "Commented-code block (5 lines) in test_slow_chains.py:136"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-f79992a26fb5a894", "name": "Network/subprocess call without timeout or try/except \u2014 run_hunt.py:73", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 run_hunt.py:73"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-87d6dfe0200781f5", "name": "Commented-code block (8 lines) in web/app.py:46", "shortDescription": {"text": "Commented-code block (8 lines) in web/app.py:46"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8161eaac54596a77", "name": "Commented-code block (5 lines) in web/frontend/src/pages/EpisodesPage.jsx:360", "shortDescription": {"text": "Commented-code block (5 lines) in web/frontend/src/pages/EpisodesPage.jsx:360"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-e797bd0e42f44610", "name": "Frontend route `/coverage` has no Link/navigate to it \u2014 web/frontend/src/App.jsx", "shortDescription": {"text": "Frontend route `/coverage` has no Link/navigate to it \u2014 web/frontend/src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-7769ddb9b1e96ed2", "name": "Frontend route `/seasons` has no Link/navigate to it \u2014 web/frontend/src/App.jsx", "shortDescription": {"text": "Frontend route `/seasons` has no Link/navigate to it \u2014 web/frontend/src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-23d4835ca1f36da6", "name": "Frontend route `/episodes` has no Link/navigate to it \u2014 web/frontend/src/App.jsx", "shortDescription": {"text": "Frontend route `/episodes` has no Link/navigate to it \u2014 web/frontend/src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6313140c6833a7bb", "name": "Frontend route `/history` has no Link/navigate to it \u2014 web/frontend/src/App.jsx", "shortDescription": {"text": "Frontend route `/history` has no Link/navigate to it \u2014 web/frontend/src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d12de4734280338b", "name": "Frontend route `/slow-chains` has no Link/navigate to it \u2014 web/frontend/src/App.jsx", "shortDescription": {"text": "Frontend route `/slow-chains` has no Link/navigate to it \u2014 web/frontend/src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3f722110e1754b5a", "name": "Frontend route `/outbreaks` has no Link/navigate to it \u2014 web/frontend/src/App.jsx", "shortDescription": {"text": "Frontend route `/outbreaks` has no Link/navigate to it \u2014 web/frontend/src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3c0defca363305d0", "name": "Frontend route `/campaigns` has no Link/navigate to it \u2014 web/frontend/src/App.jsx", "shortDescription": {"text": "Frontend route `/campaigns` has no Link/navigate to it \u2014 web/frontend/src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-1a5870e7cb511d44", "name": "Frontend route `/suppressions` has no Link/navigate to it \u2014 web/frontend/src/App.jsx", "shortDescription": {"text": "Frontend route `/suppressions` has no Link/navigate to it \u2014 web/frontend/src/App.jsx"}, "fullDescription": {"text": "The route is registered but no `<Link to=\u2026>` or `navigate(\u2026)` in the codebase navigates here. Either it's reachable only via direct URL (intentional), it's dead, or the link broke during a refactor."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-573ec5cb7f203c7e", "name": "FastAPI POST `set_triage` without auth dependency \u2014 web/api/triage.py:69", "shortDescription": {"text": "FastAPI POST `set_triage` without auth dependency \u2014 web/api/triage.py:69"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3166772cd4b88ed0", "name": "FastAPI POST `create_pattern` without auth dependency \u2014 web/api/patterns.py:144", "shortDescription": {"text": "FastAPI POST `create_pattern` without auth dependency \u2014 web/api/patterns.py:144"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e15c1b151edb2ec4", "name": "FastAPI DELETE `delete_pattern` without auth dependency \u2014 web/api/patterns.py:176", "shortDescription": {"text": "FastAPI DELETE `delete_pattern` without auth dependency \u2014 web/api/patterns.py:176"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-08ff99251e5bc7ec", "name": "FastAPI POST `expire_patterns` without auth dependency \u2014 web/api/patterns.py:188", "shortDescription": {"text": "FastAPI POST `expire_patterns` without auth dependency \u2014 web/api/patterns.py:188"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-84d3fc53922f6ac9", "name": "FastAPI POST `reload_data` without auth dependency \u2014 web/api/pipeline.py:34", "shortDescription": {"text": "FastAPI POST `reload_data` without auth dependency \u2014 web/api/pipeline.py:34"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-ef0512dc951fba1d", "name": "FastAPI POST `add_suppression` without auth dependency \u2014 web/api/suppressions.py:77", "shortDescription": {"text": "FastAPI POST `add_suppression` without auth dependency \u2014 web/api/suppressions.py:77"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-175ec27020a33a94", "name": "FastAPI DELETE `remove_suppression` without auth dependency \u2014 web/api/suppressions.py:109", "shortDescription": {"text": "FastAPI DELETE `remove_suppression` without auth dependency \u2014 web/api/suppressions.py:109"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-476a5c77c63e2586", "name": "FastAPI POST `expire_suppressions` without auth dependency \u2014 web/api/suppressions.py:127", "shortDescription": {"text": "FastAPI POST `expire_suppressions` without auth dependency \u2014 web/api/suppressions.py:127"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`web/app.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1b1d5926fda286fa", "name": "Unused endpoint: GET /{full_path:path}", "shortDescription": {"text": "Unused endpoint: GET /{full_path:path}"}, "fullDescription": {"text": "`web/app.py` declares `GET /{full_path:path}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-afc064028ae39ea9", "name": "Unused endpoint: GET /history", "shortDescription": {"text": "Unused endpoint: GET /history"}, "fullDescription": {"text": "`web/api/history.py` declares `GET /history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0368bfd4f26b051b", "name": "Unused endpoint: GET /history/{entity_type}/{entity_name:path}", "shortDescription": {"text": "Unused endpoint: GET /history/{entity_type}/{entity_name:path}"}, "fullDescription": {"text": "`web/api/history.py` declares `GET /history/{entity_type}/{entity_name:path}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6fc0caa269292c44", "name": "Unused endpoint: GET /coverage", "shortDescription": {"text": "Unused endpoint: GET /coverage"}, "fullDescription": {"text": "`web/api/coverage.py` declares `GET /coverage` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4bc36be5cf6d0f2d", "name": "Unused endpoint: GET /scene-history/{entity_type}/{entity_name:path}", "shortDescription": {"text": "Unused endpoint: GET /scene-history/{entity_type}/{entity_name:path}"}, "fullDescription": {"text": "`web/api/scene_history.py` declares `GET /scene-history/{entity_type}/{entity_name:path}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-55d6d639be4deef2", "name": "Unused endpoint: GET /episodes", "shortDescription": {"text": "Unused endpoint: GET /episodes"}, "fullDescription": {"text": "`web/api/episodes.py` declares `GET /episodes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fae594688193e8d8", "name": "Unused endpoint: GET /episodes/{device_name:path}", "shortDescription": {"text": "Unused endpoint: GET /episodes/{device_name:path}"}, "fullDescription": {"text": "`web/api/episodes.py` declares `GET /episodes/{device_name:path}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-236dacb9496f4201", "name": "Unused endpoint: GET /user-episodes", "shortDescription": {"text": "Unused endpoint: GET /user-episodes"}, "fullDescription": {"text": "`web/api/episodes.py` declares `GET /user-episodes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3f404379484e352c", "name": "Unused endpoint: GET /user-episodes/{account_name:path}", "shortDescription": {"text": "Unused endpoint: GET /user-episodes/{account_name:path}"}, "fullDescription": {"text": "`web/api/episodes.py` declares `GET /user-episodes/{account_name:path}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8268966ddcf79f30", "name": "Unused endpoint: GET /triage", "shortDescription": {"text": "Unused endpoint: GET /triage"}, "fullDescription": {"text": "`web/api/triage.py` declares `GET /triage` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-350490d9c8d25153", "name": "Unused endpoint: POST /triage", "shortDescription": {"text": "Unused endpoint: POST /triage"}, "fullDescription": {"text": "`web/api/triage.py` declares `POST /triage` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-633c3d1316b4ce98", "name": "Unused endpoint: GET /triage/log/{entity_type}/{entity_name:path}", "shortDescription": {"text": "Unused endpoint: GET /triage/log/{entity_type}/{entity_name:path}"}, "fullDescription": {"text": "`web/api/triage.py` declares `GET /triage/log/{entity_type}/{entity_name:path}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7aedeadc7f98b772", "name": "Unused endpoint: GET /patterns", "shortDescription": {"text": "Unused endpoint: GET /patterns"}, "fullDescription": {"text": "`web/api/patterns.py` declares `GET /patterns` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f51028ccc3e5e0d", "name": "Unused endpoint: POST /patterns", "shortDescription": {"text": "Unused endpoint: POST /patterns"}, "fullDescription": {"text": "`web/api/patterns.py` declares `POST /patterns` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-74ac8bba89ee4bcf", "name": "Unused endpoint: DELETE /patterns/{name:path}", "shortDescription": {"text": "Unused endpoint: DELETE /patterns/{name:path}"}, "fullDescription": {"text": "`web/api/patterns.py` declares `DELETE /patterns/{name:path}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4a579cb92a269720", "name": "Unused endpoint: POST /patterns/expire", "shortDescription": {"text": "Unused endpoint: POST /patterns/expire"}, "fullDescription": {"text": "`web/api/patterns.py` declares `POST /patterns/expire` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-53dcb815f5c5b4f0", "name": "Unused endpoint: GET /seasons/devices", "shortDescription": {"text": "Unused endpoint: GET /seasons/devices"}, "fullDescription": {"text": "`web/api/seasons.py` declares `GET /seasons/devices` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e8e2809c2a4be206", "name": "Unused endpoint: GET /seasons/users", "shortDescription": {"text": "Unused endpoint: GET /seasons/users"}, "fullDescription": {"text": "`web/api/seasons.py` declares `GET /seasons/users` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-16e716df758f05bd", "name": "Unused endpoint: GET /slow-chains", "shortDescription": {"text": "Unused endpoint: GET /slow-chains"}, "fullDescription": {"text": "`web/api/slow_chains.py` declares `GET /slow-chains` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d736e997d2c6a06f", "name": "Unused endpoint: GET /insights", "shortDescription": {"text": "Unused endpoint: GET /insights"}, "fullDescription": {"text": "`web/api/insights.py` declares `GET /insights` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72a85e55b8c9db51", "name": "Unused endpoint: GET /priority-cases", "shortDescription": {"text": "Unused endpoint: GET /priority-cases"}, "fullDescription": {"text": "`web/api/priority.py` declares `GET /priority-cases` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1f77f6f75187981c", "name": "Unused endpoint: GET /recommendations", "shortDescription": {"text": "Unused endpoint: GET /recommendations"}, "fullDescription": {"text": "`web/api/recommendations.py` declares `GET /recommendations` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-93c96852fb7d3298", "name": "Unused endpoint: POST /pipeline/reload", "shortDescription": {"text": "Unused endpoint: POST /pipeline/reload"}, "fullDescription": {"text": "`web/api/pipeline.py` declares `POST /pipeline/reload` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-689bdcaf1aae59d4", "name": "Unused endpoint: GET /pipeline/run", "shortDescription": {"text": "Unused endpoint: GET /pipeline/run"}, "fullDescription": {"text": "`web/api/pipeline.py` declares `GET /pipeline/run` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c89a6462e482c9da", "name": "Unused endpoint: GET /suppressions", "shortDescription": {"text": "Unused endpoint: GET /suppressions"}, "fullDescription": {"text": "`web/api/suppressions.py` declares `GET /suppressions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eef90890d8556aa6", "name": "Unused endpoint: POST /suppressions", "shortDescription": {"text": "Unused endpoint: POST /suppressions"}, "fullDescription": {"text": "`web/api/suppressions.py` declares `POST /suppressions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d3cfe21d6716494c", "name": "Unused endpoint: DELETE /suppressions/{entity_type}/{entity_name:path}", "shortDescription": {"text": "Unused endpoint: DELETE /suppressions/{entity_type}/{entity_name:path}"}, "fullDescription": {"text": "`web/api/suppressions.py` declares `DELETE /suppressions/{entity_type}/{entity_name:path}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4dcc9786561dd894", "name": "Unused endpoint: POST /suppressions/expire", "shortDescription": {"text": "Unused endpoint: POST /suppressions/expire"}, "fullDescription": {"text": "`web/api/suppressions.py` declares `POST /suppressions/expire` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f267cc6244ff132b", "name": "Unused endpoint: GET /campaigns", "shortDescription": {"text": "Unused endpoint: GET /campaigns"}, "fullDescription": {"text": "`web/api/campaigns.py` declares `GET /campaigns` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7909e51d42ce3eb5", "name": "Unused endpoint: GET /outbreaks", "shortDescription": {"text": "Unused endpoint: GET /outbreaks"}, "fullDescription": {"text": "`web/api/outbreaks.py` declares `GET /outbreaks` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/17794"}, "properties": {"repository": "random2haju/hunting_season_discovery", "repoUrl": "https://github.com/random2haju/hunting_season_discovery", "branch": "main"}, "results": [{"ruleId": "scanner-cef9dbca0a8a26df", "level": "note", "message": {"text": "Possibly dead Python function: cmd_add"}, "properties": {"repobilityId": "3b364c25c0f2804a", "scanner": "scanner-primary", "fingerprint": "cef9dbca0a8a26df", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "suppress.py:63"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d8ae24b37326f92e", "level": "note", "message": {"text": "Possibly dead Python function: cmd_remove"}, "properties": {"repobilityId": "d39b296d61583f94", "scanner": "scanner-primary", "fingerprint": "d8ae24b37326f92e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "suppress.py:90"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6ad1065e7642095f", "level": "note", "message": {"text": "Possibly dead Python function: cmd_list"}, "properties": {"repobilityId": "bd09044da90857da", "scanner": "scanner-primary", "fingerprint": "6ad1065e7642095f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "suppress.py:102"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f1c8a442daecab38", "level": "note", "message": {"text": "Possibly dead Python function: cmd_expire"}, "properties": {"repobilityId": "b07c72979282c9cc", "scanner": "scanner-primary", "fingerprint": "f1c8a442daecab38", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "suppress.py:130"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6372cebde0220094", "level": "warning", "message": {"text": "No auth library detected"}, "properties": {"repobilityId": "a5b6035a5bbf8054", "scanner": "scanner-primary", "fingerprint": "6372cebde0220094", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["coverage", "auth"]}}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-cddfdbf48900e3d9", "level": "note", "message": {"text": "Very large file: consolidate.py (3335 lines)"}, "properties": {"repobilityId": "d1ae664a45b733c9", "scanner": "scanner-primary", "fingerprint": "cddfdbf48900e3d9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "3c5d0e4234610dd7", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "7f537dac1c5d783d", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "93bbc1ba12fe66f8", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "60fc3b8f2bdac86c", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "0b39934a880fdc81", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "8c944d256c2b2e4d", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "52093ef37c33cbac", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "59ffd1ff4267e9f1", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-24f2ea4bd14badc1", "level": "warning", "message": {"text": "Agent instruction contains unpinned remote install: CLAUDE.md"}, "properties": {"repobilityId": "0f6049734704e537", "scanner": "scanner-primary", "fingerprint": "24f2ea4bd14badc1", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "supply-chain", "claude_instruction"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "CLAUDE.md"}, "region": {"startLine": 224}}}]}, {"ruleId": "scanner-ce7b4602397c300d", "level": "none", "message": {"text": "Commented-code block (6 lines) in consolidate.py:37"}, "properties": {"repobilityId": "342c93e2280061e2", "scanner": "scanner-primary", "fingerprint": "ce7b4602397c300d", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-6c9253a50553f274", "level": "note", "message": {"text": "Legacy-named symbol `svc_backup` in test_workflow_classification.py:91"}, "properties": {"repobilityId": "75799912f1cb326c", "scanner": "scanner-primary", "fingerprint": "6c9253a50553f274", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-d1e4a3e7d614fcb9", "level": "none", "message": {"text": "Commented-code block (5 lines) in test_slow_chains.py:136"}, "properties": {"repobilityId": "fcbb08c2b8924194", "scanner": "scanner-primary", "fingerprint": "d1e4a3e7d614fcb9", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-f79992a26fb5a894", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 run_hunt.py:73"}, "properties": {"repobilityId": "38aca6a7dec86086", "scanner": "scanner-primary", "fingerprint": "f79992a26fb5a894", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-87d6dfe0200781f5", "level": "none", "message": {"text": "Commented-code block (8 lines) in web/app.py:46"}, "properties": {"repobilityId": "03754ec223c0c92c", "scanner": "scanner-primary", "fingerprint": "87d6dfe0200781f5", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8161eaac54596a77", "level": "none", "message": {"text": "Commented-code block (5 lines) in web/frontend/src/pages/EpisodesPage.jsx:360"}, "properties": {"repobilityId": "c2cdcae5d093c5c3", "scanner": "scanner-primary", "fingerprint": "8161eaac54596a77", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-e797bd0e42f44610", "level": "warning", "message": {"text": "Frontend route `/coverage` has no Link/navigate to it \u2014 web/frontend/src/App.jsx"}, "properties": {"repobilityId": "e3dd77ea8c196669", "scanner": "scanner-primary", "fingerprint": "e797bd0e42f44610", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-7769ddb9b1e96ed2", "level": "warning", "message": {"text": "Frontend route `/seasons` has no Link/navigate to it \u2014 web/frontend/src/App.jsx"}, "properties": {"repobilityId": "719fee1841d4fd4d", "scanner": "scanner-primary", "fingerprint": "7769ddb9b1e96ed2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-23d4835ca1f36da6", "level": "warning", "message": {"text": "Frontend route `/episodes` has no Link/navigate to it \u2014 web/frontend/src/App.jsx"}, "properties": {"repobilityId": "a4d718d27fba15c2", "scanner": "scanner-primary", "fingerprint": "23d4835ca1f36da6", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-6313140c6833a7bb", "level": "warning", "message": {"text": "Frontend route `/history` has no Link/navigate to it \u2014 web/frontend/src/App.jsx"}, "properties": {"repobilityId": "754c73202f1e595c", "scanner": "scanner-primary", "fingerprint": "6313140c6833a7bb", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-d12de4734280338b", "level": "warning", "message": {"text": "Frontend route `/slow-chains` has no Link/navigate to it \u2014 web/frontend/src/App.jsx"}, "properties": {"repobilityId": "08e21768c1bb0df3", "scanner": "scanner-primary", "fingerprint": "d12de4734280338b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-3f722110e1754b5a", "level": "warning", "message": {"text": "Frontend route `/outbreaks` has no Link/navigate to it \u2014 web/frontend/src/App.jsx"}, "properties": {"repobilityId": "2697bf59a679ed98", "scanner": "scanner-primary", "fingerprint": "3f722110e1754b5a", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-3c0defca363305d0", "level": "warning", "message": {"text": "Frontend route `/campaigns` has no Link/navigate to it \u2014 web/frontend/src/App.jsx"}, "properties": {"repobilityId": "de9fa9d3fa58ae0c", "scanner": "scanner-primary", "fingerprint": "3c0defca363305d0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-1a5870e7cb511d44", "level": "warning", "message": {"text": "Frontend route `/suppressions` has no Link/navigate to it \u2014 web/frontend/src/App.jsx"}, "properties": {"repobilityId": "a59e1e14be853464", "scanner": "scanner-primary", "fingerprint": "1a5870e7cb511d44", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "orphan-page", "wiring"]}}, {"ruleId": "scanner-573ec5cb7f203c7e", "level": "error", "message": {"text": "FastAPI POST `set_triage` without auth dependency \u2014 web/api/triage.py:69"}, "properties": {"repobilityId": "00541b223b62388e", "scanner": "scanner-primary", "fingerprint": "573ec5cb7f203c7e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/api/triage.py"}, "region": {"startLine": 69}}}]}, {"ruleId": "scanner-3166772cd4b88ed0", "level": "error", "message": {"text": "FastAPI POST `create_pattern` without auth dependency \u2014 web/api/patterns.py:144"}, "properties": {"repobilityId": "7ae4ed12ddbfd9cc", "scanner": "scanner-primary", "fingerprint": "3166772cd4b88ed0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/api/patterns.py"}, "region": {"startLine": 144}}}]}, {"ruleId": "scanner-e15c1b151edb2ec4", "level": "error", "message": {"text": "FastAPI DELETE `delete_pattern` without auth dependency \u2014 web/api/patterns.py:176"}, "properties": {"repobilityId": "f01fbdcad03ee76d", "scanner": "scanner-primary", "fingerprint": "e15c1b151edb2ec4", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/api/patterns.py"}, "region": {"startLine": 176}}}]}, {"ruleId": "scanner-08ff99251e5bc7ec", "level": "error", "message": {"text": "FastAPI POST `expire_patterns` without auth dependency \u2014 web/api/patterns.py:188"}, "properties": {"repobilityId": "08905119eef57df2", "scanner": "scanner-primary", "fingerprint": "08ff99251e5bc7ec", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/api/patterns.py"}, "region": {"startLine": 188}}}]}, {"ruleId": "scanner-84d3fc53922f6ac9", "level": "error", "message": {"text": "FastAPI POST `reload_data` without auth dependency \u2014 web/api/pipeline.py:34"}, "properties": {"repobilityId": "f38932f202f298e4", "scanner": "scanner-primary", "fingerprint": "84d3fc53922f6ac9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/api/pipeline.py"}, "region": {"startLine": 34}}}]}, {"ruleId": "scanner-ef0512dc951fba1d", "level": "error", "message": {"text": "FastAPI POST `add_suppression` without auth dependency \u2014 web/api/suppressions.py:77"}, "properties": {"repobilityId": "b1d8efdd3901b2a8", "scanner": "scanner-primary", "fingerprint": "ef0512dc951fba1d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/api/suppressions.py"}, "region": {"startLine": 77}}}]}, {"ruleId": "scanner-175ec27020a33a94", "level": "error", "message": {"text": "FastAPI DELETE `remove_suppression` without auth dependency \u2014 web/api/suppressions.py:109"}, "properties": {"repobilityId": "df9f7bbf3bca0376", "scanner": "scanner-primary", "fingerprint": "175ec27020a33a94", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/api/suppressions.py"}, "region": {"startLine": 109}}}]}, {"ruleId": "scanner-476a5c77c63e2586", "level": "error", "message": {"text": "FastAPI POST `expire_suppressions` without auth dependency \u2014 web/api/suppressions.py:127"}, "properties": {"repobilityId": "1275479488222236", "scanner": "scanner-primary", "fingerprint": "476a5c77c63e2586", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web/api/suppressions.py"}, "region": {"startLine": 127}}}]}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "f0c32eb2e07cab14", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1b1d5926fda286fa", "level": "note", "message": {"text": "Unused endpoint: GET /{full_path:path}"}, "properties": {"repobilityId": "8a4eb57f1fa233e1", "scanner": "scanner-primary", "fingerprint": "1b1d5926fda286fa", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-afc064028ae39ea9", "level": "note", "message": {"text": "Unused endpoint: GET /history"}, "properties": {"repobilityId": "8be1da888ab51055", "scanner": "scanner-primary", "fingerprint": "afc064028ae39ea9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0368bfd4f26b051b", "level": "note", "message": {"text": "Unused endpoint: GET /history/{entity_type}/{entity_name:path}"}, "properties": {"repobilityId": "fac7cfefeee9bd59", "scanner": "scanner-primary", "fingerprint": "0368bfd4f26b051b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6fc0caa269292c44", "level": "note", "message": {"text": "Unused endpoint: GET /coverage"}, "properties": {"repobilityId": "69799396c566af43", "scanner": "scanner-primary", "fingerprint": "6fc0caa269292c44", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4bc36be5cf6d0f2d", "level": "note", "message": {"text": "Unused endpoint: GET /scene-history/{entity_type}/{entity_name:path}"}, "properties": {"repobilityId": "010d8ad02a829a47", "scanner": "scanner-primary", "fingerprint": "4bc36be5cf6d0f2d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-55d6d639be4deef2", "level": "note", "message": {"text": "Unused endpoint: GET /episodes"}, "properties": {"repobilityId": "67a61619a1e3cdcf", "scanner": "scanner-primary", "fingerprint": "55d6d639be4deef2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fae594688193e8d8", "level": "note", "message": {"text": "Unused endpoint: GET /episodes/{device_name:path}"}, "properties": {"repobilityId": "eeab983ac382f3d1", "scanner": "scanner-primary", "fingerprint": "fae594688193e8d8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-236dacb9496f4201", "level": "note", "message": {"text": "Unused endpoint: GET /user-episodes"}, "properties": {"repobilityId": "0f195233b24ad70f", "scanner": "scanner-primary", "fingerprint": "236dacb9496f4201", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3f404379484e352c", "level": "note", "message": {"text": "Unused endpoint: GET /user-episodes/{account_name:path}"}, "properties": {"repobilityId": "591376d70dd015a7", "scanner": "scanner-primary", "fingerprint": "3f404379484e352c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8268966ddcf79f30", "level": "note", "message": {"text": "Unused endpoint: GET /triage"}, "properties": {"repobilityId": "ad3a31a509ecb3dd", "scanner": "scanner-primary", "fingerprint": "8268966ddcf79f30", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-350490d9c8d25153", "level": "note", "message": {"text": "Unused endpoint: POST /triage"}, "properties": {"repobilityId": "ba43d7e83da8354a", "scanner": "scanner-primary", "fingerprint": "350490d9c8d25153", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-633c3d1316b4ce98", "level": "note", "message": {"text": "Unused endpoint: GET /triage/log/{entity_type}/{entity_name:path}"}, "properties": {"repobilityId": "8caf8351b3958666", "scanner": "scanner-primary", "fingerprint": "633c3d1316b4ce98", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7aedeadc7f98b772", "level": "note", "message": {"text": "Unused endpoint: GET /patterns"}, "properties": {"repobilityId": "4fa9acf8fe6bee73", "scanner": "scanner-primary", "fingerprint": "7aedeadc7f98b772", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1f51028ccc3e5e0d", "level": "note", "message": {"text": "Unused endpoint: POST /patterns"}, "properties": {"repobilityId": "6a12f994d7920d30", "scanner": "scanner-primary", "fingerprint": "1f51028ccc3e5e0d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-74ac8bba89ee4bcf", "level": "note", "message": {"text": "Unused endpoint: DELETE /patterns/{name:path}"}, "properties": {"repobilityId": "0d71fec41511742c", "scanner": "scanner-primary", "fingerprint": "74ac8bba89ee4bcf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4a579cb92a269720", "level": "note", "message": {"text": "Unused endpoint: POST /patterns/expire"}, "properties": {"repobilityId": "7f0e34c301bf0639", "scanner": "scanner-primary", "fingerprint": "4a579cb92a269720", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-53dcb815f5c5b4f0", "level": "note", "message": {"text": "Unused endpoint: GET /seasons/devices"}, "properties": {"repobilityId": "9a31d3aecbfc2bbe", "scanner": "scanner-primary", "fingerprint": "53dcb815f5c5b4f0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e8e2809c2a4be206", "level": "note", "message": {"text": "Unused endpoint: GET /seasons/users"}, "properties": {"repobilityId": "a7ac76b703e89e9d", "scanner": "scanner-primary", "fingerprint": "e8e2809c2a4be206", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-16e716df758f05bd", "level": "note", "message": {"text": "Unused endpoint: GET /slow-chains"}, "properties": {"repobilityId": "76abdf0502f6ff5e", "scanner": "scanner-primary", "fingerprint": "16e716df758f05bd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d736e997d2c6a06f", "level": "note", "message": {"text": "Unused endpoint: GET /insights"}, "properties": {"repobilityId": "57c8fe7866a9dba6", "scanner": "scanner-primary", "fingerprint": "d736e997d2c6a06f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-72a85e55b8c9db51", "level": "note", "message": {"text": "Unused endpoint: GET /priority-cases"}, "properties": {"repobilityId": "5413ac96857cd3ef", "scanner": "scanner-primary", "fingerprint": "72a85e55b8c9db51", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1f77f6f75187981c", "level": "note", "message": {"text": "Unused endpoint: GET /recommendations"}, "properties": {"repobilityId": "4c406bcb238b6884", "scanner": "scanner-primary", "fingerprint": "1f77f6f75187981c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-93c96852fb7d3298", "level": "note", "message": {"text": "Unused endpoint: POST /pipeline/reload"}, "properties": {"repobilityId": "fef773504857f912", "scanner": "scanner-primary", "fingerprint": "93c96852fb7d3298", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-689bdcaf1aae59d4", "level": "note", "message": {"text": "Unused endpoint: GET /pipeline/run"}, "properties": {"repobilityId": "5a5d26d562cc14ae", "scanner": "scanner-primary", "fingerprint": "689bdcaf1aae59d4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c89a6462e482c9da", "level": "note", "message": {"text": "Unused endpoint: GET /suppressions"}, "properties": {"repobilityId": "ebd7cd50a0cc16ba", "scanner": "scanner-primary", "fingerprint": "c89a6462e482c9da", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-eef90890d8556aa6", "level": "note", "message": {"text": "Unused endpoint: POST /suppressions"}, "properties": {"repobilityId": "86c824b7b0ee6c39", "scanner": "scanner-primary", "fingerprint": "eef90890d8556aa6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d3cfe21d6716494c", "level": "note", "message": {"text": "Unused endpoint: DELETE /suppressions/{entity_type}/{entity_name:path}"}, "properties": {"repobilityId": "bdfea9c29d95874b", "scanner": "scanner-primary", "fingerprint": "d3cfe21d6716494c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4dcc9786561dd894", "level": "note", "message": {"text": "Unused endpoint: POST /suppressions/expire"}, "properties": {"repobilityId": "aa9802e14656e7b8", "scanner": "scanner-primary", "fingerprint": "4dcc9786561dd894", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f267cc6244ff132b", "level": "note", "message": {"text": "Unused endpoint: GET /campaigns"}, "properties": {"repobilityId": "e81423783e9d9941", "scanner": "scanner-primary", "fingerprint": "f267cc6244ff132b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7909e51d42ce3eb5", "level": "note", "message": {"text": "Unused endpoint: GET /outbreaks"}, "properties": {"repobilityId": "fe14dc590ecb99db", "scanner": "scanner-primary", "fingerprint": "7909e51d42ce3eb5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}