{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-e01ac961ed48c100", "name": "Possibly dead Python function: delete_session", "shortDescription": {"text": "Possibly dead Python function: delete_session"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-79a989c2b2a387ba", "name": "Possibly dead Python function: increment_usage", "shortDescription": {"text": "Possibly dead Python function: increment_usage"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2221e360b6d1c384", "name": "Possibly dead Python function: record_payment", "shortDescription": {"text": "Possibly dead Python function: record_payment"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1e753890893e759b", "name": "Possibly dead Python function: load_config", "shortDescription": {"text": "Possibly dead Python function: load_config"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a0969c06bdb8d16a", "name": "Possibly dead Python function: generate_coaching_plan", "shortDescription": {"text": "Possibly dead Python function: generate_coaching_plan"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-280802304d3b1be9", "name": "Possibly dead Python function: rank_gap", "shortDescription": {"text": "Possibly dead Python function: rank_gap"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d233177374d4036b", "name": "Possibly dead Python function: poll_now", "shortDescription": {"text": "Possibly dead Python function: poll_now"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4e53477e5db1a925", "name": "Possibly dead Python function: is_processed", "shortDescription": {"text": "Possibly dead Python function: is_processed"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6dce7e516a2bc56e", "name": "Possibly dead Python function: mark_failed", "shortDescription": {"text": "Possibly dead Python function: mark_failed"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4711859c18b0ea9e", "name": "Possibly dead Python function: needs_setup", "shortDescription": {"text": "Possibly dead Python function: needs_setup"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8ccd064933d82469", "name": "Possibly dead Python function: restart_on", "shortDescription": {"text": "Possibly dead Python function: restart_on"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-697ab6d8f294db9a", "name": "Possibly dead Python function: generate_series_report", "shortDescription": {"text": "Possibly dead Python function: generate_series_report"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5845bd6c6222b621", "name": "Possibly dead Python function: parse_start", "shortDescription": {"text": "Possibly dead Python function: parse_start"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-011fd22f4d679f97", "name": "Possibly dead Python function: metrics_start", "shortDescription": {"text": "Possibly dead Python function: metrics_start"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f32f8e3e81496ff2", "name": "Possibly dead Python function: render_start", "shortDescription": {"text": "Possibly dead Python function: render_start"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aaaeffb16a2ee8f7", "name": "Possibly dead Python function: write_start", "shortDescription": {"text": "Possibly dead Python function: write_start"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7252a842acc9e44f", "name": "Possibly dead Python function: replay_done", "shortDescription": {"text": "Possibly dead Python function: replay_done"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8743c719aeb41f8a", "name": "Possibly dead Python function: show", "shortDescription": {"text": "Possibly dead Python function: show"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-538993180807a746", "name": "Possibly dead Python function: quit", "shortDescription": {"text": "Possibly dead Python function: quit"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa0df2cc933aa230", "name": "Possibly dead Python function: authenticate_with_code", "shortDescription": {"text": "Possibly dead Python function: authenticate_with_code"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f0db0c31e0e3d5ca", "name": "Possibly dead Python function: authenticate_with_refresh_token", "shortDescription": {"text": "Possibly dead Python function: authenticate_with_refresh_token"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e2826cc2a7e2c710", "name": "Possibly dead Python function: exchange_eos_token", "shortDescription": {"text": "Possibly dead Python function: exchange_eos_token"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d63da3583b14afc0", "name": "Dockerfile runs as root: Dockerfile", "shortDescription": {"text": "Dockerfile runs as root: Dockerfile"}, "fullDescription": {"text": "No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e066691601852931", "name": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7b92ab7387e5f44d", "name": "Insecure pattern 'direct_innerhtml_assignment' in static/index.html:868", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/index.html:868"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-aa6a9af4342a5665", "name": "Insecure pattern 'direct_innerhtml_assignment' in static/admin.html:332", "shortDescription": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/admin.html:332"}, "fullDescription": {"text": "Found a known-risky pattern (direct_innerhtml_assignment). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-66e3db74c9998fcd", "name": "Insecure pattern 'exec_used' in rlcoach/parser.py:416", "shortDescription": {"text": "Insecure pattern 'exec_used' in rlcoach/parser.py:416"}, "fullDescription": {"text": "Found a known-risky pattern (exec_used). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d4c91d8044185655", "name": "Very large file: web_app.py (1586 lines)", "shortDescription": {"text": "Very large file: web_app.py (1586 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "1 test file(s) for 46 source file(s) (ratio 0.02). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 5 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-c5c042e9834a2a3f", "name": "Commented-code block (6 lines) in web_app.py:430", "shortDescription": {"text": "Commented-code block (6 lines) in web_app.py:430"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-75045f8880835ed0", "name": "Commented-code block (5 lines) in rlcoach/parser.py:292", "shortDescription": {"text": "Commented-code block (5 lines) in rlcoach/parser.py:292"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-3a4398ed3b275aa2", "name": "Legacy-named symbol `debug_copy` in rlcoach/poller.py:164", "shortDescription": {"text": "Legacy-named symbol `debug_copy` in rlcoach/poller.py:164"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b63b547b8bbf38e8", "name": "Legacy-named symbol `debug_copy` in rlcoach/web_pipeline.py:491", "shortDescription": {"text": "Legacy-named symbol `debug_copy` in rlcoach/web_pipeline.py:491"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f5519d3ef79bba55", "name": "Legacy-named symbol `debug_copy` in rlcoach/replay_selector.py:336", "shortDescription": {"text": "Legacy-named symbol `debug_copy` in rlcoach/replay_selector.py:336"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-af022f937dd5b7fd", "name": "9 env vars used in code but missing from .env.example", "shortDescription": {"text": "9 env vars used in code but missing from .env.example"}, "fullDescription": {"text": "Drift between code and config docs. The first few: `ADMIN_EMAILS`, `EGS_CLIENT_ID`, `EGS_CLIENT_SECRET`, `EOS_AUTH_HEADER`, `EOS_CLIENT_ID`, `EOS_DEPLOYMENT_ID`, `PUBLIC_BASE_URL`, `RRROCKET_PATH` + 1 more. Add them (with a placeholder/comment) to .env.example so onboarding doesn't break."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nweb_database.py:get_matches, web_database.py:get_match\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cbde2c0a3f058fbf", "name": "FastAPI POST `delete_account` without auth dependency \u2014 web_app.py:293", "shortDescription": {"text": "FastAPI POST `delete_account` without auth dependency \u2014 web_app.py:293"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-4735ef8fe0a45db8", "name": "FastAPI POST `epic_start` without auth dependency \u2014 web_app.py:331", "shortDescription": {"text": "FastAPI POST `epic_start` without auth dependency \u2014 web_app.py:331"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0c9118b312933d1c", "name": "FastAPI POST `epic_disconnect` without auth dependency \u2014 web_app.py:400", "shortDescription": {"text": "FastAPI POST `epic_disconnect` without auth dependency \u2014 web_app.py:400"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3f30f33034d9917d", "name": "FastAPI POST `epic_refresh_name` without auth dependency \u2014 web_app.py:407", "shortDescription": {"text": "FastAPI POST `epic_refresh_name` without auth dependency \u2014 web_app.py:407"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c30c62d1435de9ea", "name": "FastAPI POST `set_player_id` without auth dependency \u2014 web_app.py:511", "shortDescription": {"text": "FastAPI POST `set_player_id` without auth dependency \u2014 web_app.py:511"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-930d6948e949b78e", "name": "FastAPI POST `trigger_fetch` without auth dependency \u2014 web_app.py:714", "shortDescription": {"text": "FastAPI POST `trigger_fetch` without auth dependency \u2014 web_app.py:714"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-eefa984284e5779e", "name": "FastAPI POST `analyze_match` without auth dependency \u2014 web_app.py:796", "shortDescription": {"text": "FastAPI POST `analyze_match` without auth dependency \u2014 web_app.py:796"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-a05fbf28d35e7cf6", "name": "FastAPI POST `stop_job` without auth dependency \u2014 web_app.py:829", "shortDescription": {"text": "FastAPI POST `stop_job` without auth dependency \u2014 web_app.py:829"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-c27d1e38d2fd4308", "name": "FastAPI POST `save_profile` without auth dependency \u2014 web_app.py:906", "shortDescription": {"text": "FastAPI POST `save_profile` without auth dependency \u2014 web_app.py:906"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-774ab52a6f3b3472", "name": "FastAPI POST `coaching_generate` without auth dependency \u2014 web_app.py:917", "shortDescription": {"text": "FastAPI POST `coaching_generate` without auth dependency \u2014 web_app.py:917"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-e2d54a868c0ff64a", "name": "FastAPI POST `coaching_complete` without auth dependency \u2014 web_app.py:998", "shortDescription": {"text": "FastAPI POST `coaching_complete` without auth dependency \u2014 web_app.py:998"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-289ca84ad59946dd", "name": "FastAPI DELETE `delete_coaching` without auth dependency \u2014 web_app.py:1021", "shortDescription": {"text": "FastAPI DELETE `delete_coaching` without auth dependency \u2014 web_app.py:1021"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-336410f1df78b01f", "name": "FastAPI POST `series_generate` without auth dependency \u2014 web_app.py:1042", "shortDescription": {"text": "FastAPI POST `series_generate` without auth dependency \u2014 web_app.py:1042"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0168cd90de7dc3ce", "name": "FastAPI DELETE `delete_series` without auth dependency \u2014 web_app.py:1086", "shortDescription": {"text": "FastAPI DELETE `delete_series` without auth dependency \u2014 web_app.py:1086"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-d393c46c0675ed5d", "name": "FastAPI POST `save_tracker` without auth dependency \u2014 web_app.py:1200", "shortDescription": {"text": "FastAPI POST `save_tracker` without auth dependency \u2014 web_app.py:1200"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-98718896a66dee9a", "name": "FastAPI POST `sync_mmr` without auth dependency \u2014 web_app.py:1210", "shortDescription": {"text": "FastAPI POST `sync_mmr` without auth dependency \u2014 web_app.py:1210"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-0383d43da2af2e1d", "name": "FastAPI POST `admin_set_role` without auth dependency \u2014 web_app.py:1297", "shortDescription": {"text": "FastAPI POST `admin_set_role` without auth dependency \u2014 web_app.py:1297"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-3e621a04c47ced58", "name": "FastAPI POST `admin_set_ban` without auth dependency \u2014 web_app.py:1315", "shortDescription": {"text": "FastAPI POST `admin_set_ban` without auth dependency \u2014 web_app.py:1315"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-614075de5f9830c9", "name": "FastAPI POST `admin_reset_usage` without auth dependency \u2014 web_app.py:1331", "shortDescription": {"text": "FastAPI POST `admin_reset_usage` without auth dependency \u2014 web_app.py:1331"}, "fullDescription": {"text": "`@router.post` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-226f1c82ee755422", "name": "FastAPI DELETE `admin_delete_user` without auth dependency \u2014 web_app.py:1347", "shortDescription": {"text": "FastAPI DELETE `admin_delete_user` without auth dependency \u2014 web_app.py:1347"}, "fullDescription": {"text": "`@router.delete` decorator with no `Depends(get_current_user)` or auth-shaped dependency in its signature. Mutating endpoints should require authentication unless explicitly public."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`web_app.py` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-25702767f50d6c7d", "name": "Unused endpoint: POST /api/register", "shortDescription": {"text": "Unused endpoint: POST /api/register"}, "fullDescription": {"text": "`web_app.py` declares `POST /api/register` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-200ab2e98a288506", "name": "Unused endpoint: POST /api/login", "shortDescription": {"text": "Unused endpoint: POST /api/login"}, "fullDescription": {"text": "`web_app.py` declares `POST /api/login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a10936f69cf3bbb4", "name": "Unused endpoint: POST /api/logout", "shortDescription": {"text": "Unused endpoint: POST /api/logout"}, "fullDescription": {"text": "`web_app.py` declares `POST /api/logout` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-71f01af52d9d4263", "name": "Unused endpoint: POST /api/account/delete", "shortDescription": {"text": "Unused endpoint: POST /api/account/delete"}, "fullDescription": {"text": "`web_app.py` declares `POST /api/account/delete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5c1545494ab6166c", "name": "Unused endpoint: GET /api/me", "shortDescription": {"text": "Unused endpoint: GET /api/me"}, "fullDescription": {"text": "`web_app.py` declares `GET /api/me` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8d3d6d93918e5111", "name": "Unused endpoint: POST /api/epic/start", "shortDescription": {"text": "Unused endpoint: POST /api/epic/start"}, "fullDescription": {"text": "`web_app.py` declares `POST /api/epic/start` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9b5fcc4569c64a15", "name": "Unused endpoint: GET /api/epic/poll/{device_code}", "shortDescription": {"text": "Unused endpoint: GET /api/epic/poll/{device_code}"}, "fullDescription": {"text": "`web_app.py` declares `GET /api/epic/poll/{device_code}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f1ace91ed1d44718", "name": "Unused endpoint: POST /api/epic/disconnect", "shortDescription": {"text": "Unused endpoint: POST /api/epic/disconnect"}, "fullDescription": {"text": "`web_app.py` declares `POST /api/epic/disconnect` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1fffc543460ad0c5", "name": "Unused endpoint: POST /api/epic/refresh-name", "shortDescription": {"text": "Unused endpoint: POST /api/epic/refresh-name"}, "fullDescription": {"text": "`web_app.py` declares `POST /api/epic/refresh-name` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-34ab09c7a97f88bc", "name": "Unused endpoint: GET /api/steam/login", "shortDescription": {"text": "Unused endpoint: GET /api/steam/login"}, "fullDescription": {"text": "`web_app.py` declares `GET /api/steam/login` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7d3b6b959e040309", "name": "Unused endpoint: GET /api/steam/callback", "shortDescription": {"text": "Unused endpoint: GET /api/steam/callback"}, "fullDescription": {"text": "`web_app.py` declares `GET /api/steam/callback` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b4cbdede017f60cc", "name": "Unused endpoint: POST /api/auth/player_id", "shortDescription": {"text": "Unused endpoint: POST /api/auth/player_id"}, "fullDescription": {"text": "`web_app.py` declares `POST /api/auth/player_id` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-591252659cafb6c3", "name": "Unused endpoint: GET /api/rank", "shortDescription": {"text": "Unused endpoint: GET /api/rank"}, "fullDescription": {"text": "`web_app.py` declares `GET /api/rank` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f44c9a68aca84f37", "name": "Unused endpoint: GET /api/stats/summary", "shortDescription": {"text": "Unused endpoint: GET /api/stats/summary"}, "fullDescription": {"text": "`web_app.py` declares `GET /api/stats/summary` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c9e0c0985f62051b", "name": "Unused endpoint: GET /api/debug/service-status", "shortDescription": {"text": "Unused endpoint: GET /api/debug/service-status"}, "fullDescription": {"text": "`web_app.py` declares `GET /api/debug/service-status` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea9f38c4cf89c58c", "name": "Unused endpoint: GET /api/debug/psynet-probe", "shortDescription": {"text": "Unused endpoint: GET /api/debug/psynet-probe"}, "fullDescription": {"text": "`web_app.py` declares `GET /api/debug/psynet-probe` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-429753b3470733dd", "name": "Unused endpoint: GET /api/stats/lifetime", "shortDescription": {"text": "Unused endpoint: GET /api/stats/lifetime"}, "fullDescription": {"text": "`web_app.py` declares `GET /api/stats/lifetime` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf6ee825064b8d93", "name": "Unused endpoint: POST /api/fetch", "shortDescription": {"text": "Unused endpoint: POST /api/fetch"}, "fullDescription": {"text": "`web_app.py` declares `POST /api/fetch` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b64b859f2efc3054", "name": "Unused endpoint: GET /api/fetch/status/{job_id}", "shortDescription": {"text": "Unused endpoint: GET /api/fetch/status/{job_id}"}, "fullDescription": {"text": "`web_app.py` declares `GET /api/fetch/status/{job_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fbcacabcecf377a6", "name": "Unused endpoint: GET /api/fetch/stream/{job_id}", "shortDescription": {"text": "Unused endpoint: GET /api/fetch/stream/{job_id}"}, "fullDescription": {"text": "`web_app.py` declares `GET /api/fetch/stream/{job_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1658e2c0fb5d325e", "name": "Unused endpoint: GET /api/matches", "shortDescription": {"text": "Unused endpoint: GET /api/matches"}, "fullDescription": {"text": "`web_app.py` declares `GET /api/matches` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-745b9a0e660edeaf", "name": "Unused endpoint: GET /api/matches/{match_id}", "shortDescription": {"text": "Unused endpoint: GET /api/matches/{match_id}"}, "fullDescription": {"text": "`web_app.py` declares `GET /api/matches/{match_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fea9f0844fc941d2", "name": "Unused endpoint: GET /api/matches/{match_id}/dashboard", "shortDescription": {"text": "Unused endpoint: GET /api/matches/{match_id}/dashboard"}, "fullDescription": {"text": "`web_app.py` declares `GET /api/matches/{match_id}/dashboard` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1488f23521923524", "name": "Unused endpoint: POST /api/matches/{match_id}/analyze", "shortDescription": {"text": "Unused endpoint: POST /api/matches/{match_id}/analyze"}, "fullDescription": {"text": "`web_app.py` declares `POST /api/matches/{match_id}/analyze` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1defc33808b8c4e1", "name": "Unused endpoint: POST /api/job/{job_id}/stop", "shortDescription": {"text": "Unused endpoint: POST /api/job/{job_id}/stop"}, "fullDescription": {"text": "`web_app.py` declares `POST /api/job/{job_id}/stop` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-60e78a867a1a28c9", "name": "Unused endpoint: GET /api/usage", "shortDescription": {"text": "Unused endpoint: GET /api/usage"}, "fullDescription": {"text": "`web_app.py` declares `GET /api/usage` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-de6d42a494e388bc", "name": "Unused endpoint: GET /api/metrics/history", "shortDescription": {"text": "Unused endpoint: GET /api/metrics/history"}, "fullDescription": {"text": "`web_app.py` declares `GET /api/metrics/history` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4f8315c7763f7352", "name": "Unused endpoint: GET /api/profile", "shortDescription": {"text": "Unused endpoint: GET /api/profile"}, "fullDescription": {"text": "`web_app.py` declares `GET /api/profile` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-58d7aaced3281e36", "name": "Unused endpoint: POST /api/profile", "shortDescription": {"text": "Unused endpoint: POST /api/profile"}, "fullDescription": {"text": "`web_app.py` declares `POST /api/profile` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7ccceb6f7f25df17", "name": "Unused endpoint: POST /api/coaching/generate", "shortDescription": {"text": "Unused endpoint: POST /api/coaching/generate"}, "fullDescription": {"text": "`web_app.py` declares `POST /api/coaching/generate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-87c91dfcda83cf85", "name": "Unused endpoint: GET /api/coaching", "shortDescription": {"text": "Unused endpoint: GET /api/coaching"}, "fullDescription": {"text": "`web_app.py` declares `GET /api/coaching` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4ff64e780cf58140", "name": "Unused endpoint: POST /api/coaching/complete", "shortDescription": {"text": "Unused endpoint: POST /api/coaching/complete"}, "fullDescription": {"text": "`web_app.py` declares `POST /api/coaching/complete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b9d8c214ebbef8c5", "name": "Unused endpoint: GET /api/coaching/list", "shortDescription": {"text": "Unused endpoint: GET /api/coaching/list"}, "fullDescription": {"text": "`web_app.py` declares `GET /api/coaching/list` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2b28baea66e984cc", "name": "Unused endpoint: DELETE /api/coaching/{plan_id}", "shortDescription": {"text": "Unused endpoint: DELETE /api/coaching/{plan_id}"}, "fullDescription": {"text": "`web_app.py` declares `DELETE /api/coaching/{plan_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6c63847c40ef3e86", "name": "Unused endpoint: GET /api/coaching/view", "shortDescription": {"text": "Unused endpoint: GET /api/coaching/view"}, "fullDescription": {"text": "`web_app.py` declares `GET /api/coaching/view` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-67d24ab29eb40433", "name": "Unused endpoint: POST /api/series/generate", "shortDescription": {"text": "Unused endpoint: POST /api/series/generate"}, "fullDescription": {"text": "`web_app.py` declares `POST /api/series/generate` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b54d31e5ab163733", "name": "Unused endpoint: GET /api/series", "shortDescription": {"text": "Unused endpoint: GET /api/series"}, "fullDescription": {"text": "`web_app.py` declares `GET /api/series` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-85def21b6e123cb4", "name": "Unused endpoint: GET /api/series/list", "shortDescription": {"text": "Unused endpoint: GET /api/series/list"}, "fullDescription": {"text": "`web_app.py` declares `GET /api/series/list` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1724b9e583a0ac90", "name": "Unused endpoint: DELETE /api/series/{report_id}", "shortDescription": {"text": "Unused endpoint: DELETE /api/series/{report_id}"}, "fullDescription": {"text": "`web_app.py` declares `DELETE /api/series/{report_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8b9e93be6d96c600", "name": "Unused endpoint: GET /api/series/view", "shortDescription": {"text": "Unused endpoint: GET /api/series/view"}, "fullDescription": {"text": "`web_app.py` declares `GET /api/series/view` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e89baa7ad2fe79a9", "name": "Unused endpoint: GET /api/tracker", "shortDescription": {"text": "Unused endpoint: GET /api/tracker"}, "fullDescription": {"text": "`web_app.py` declares `GET /api/tracker` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9eb6ef216712c1ad", "name": "Unused endpoint: POST /api/tracker", "shortDescription": {"text": "Unused endpoint: POST /api/tracker"}, "fullDescription": {"text": "`web_app.py` declares `POST /api/tracker` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-262e1e5963e2ae97", "name": "Unused endpoint: POST /api/tracker/sync-mmr", "shortDescription": {"text": "Unused endpoint: POST /api/tracker/sync-mmr"}, "fullDescription": {"text": "`web_app.py` declares `POST /api/tracker/sync-mmr` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72a1c7992338a2fc", "name": "Unused endpoint: GET /api/resources", "shortDescription": {"text": "Unused endpoint: GET /api/resources"}, "fullDescription": {"text": "`web_app.py` declares `GET /api/resources` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-953ec1a0ee6df50d", "name": "Unused endpoint: GET /admin", "shortDescription": {"text": "Unused endpoint: GET /admin"}, "fullDescription": {"text": "`web_app.py` declares `GET /admin` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e150ecfd4e11c48c", "name": "Unused endpoint: GET /api/admin/overview", "shortDescription": {"text": "Unused endpoint: GET /api/admin/overview"}, "fullDescription": {"text": "`web_app.py` declares `GET /api/admin/overview` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b4d87f54d62a1386", "name": "Unused endpoint: GET /api/admin/users", "shortDescription": {"text": "Unused endpoint: GET /api/admin/users"}, "fullDescription": {"text": "`web_app.py` declares `GET /api/admin/users` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-94e87df6af16dab3", "name": "Unused endpoint: GET /api/admin/users/{user_id}", "shortDescription": {"text": "Unused endpoint: GET /api/admin/users/{user_id}"}, "fullDescription": {"text": "`web_app.py` declares `GET /api/admin/users/{user_id}` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2a9cb25e5830a1c2", "name": "Unused endpoint: POST /api/admin/users/{user_id}/role", "shortDescription": {"text": "Unused endpoint: POST /api/admin/users/{user_id}/role"}, "fullDescription": {"text": "`web_app.py` declares `POST /api/admin/users/{user_id}/role` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/22624"}, "properties": {"repository": "WebxSupport/RLCoach", "repoUrl": "https://github.com/WebxSupport/RLCoach", "branch": "main"}, "results": [{"ruleId": "scanner-e01ac961ed48c100", "level": "note", "message": {"text": "Possibly dead Python function: delete_session"}, "properties": {"repobilityId": "36fadc1a914df01c", "scanner": "scanner-primary", "fingerprint": "e01ac961ed48c100", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_database.py:397"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-79a989c2b2a387ba", "level": "note", "message": {"text": "Possibly dead Python function: increment_usage"}, "properties": {"repobilityId": "c10b32539727b2d8", "scanner": "scanner-primary", "fingerprint": "79a989c2b2a387ba", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_database.py:456"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-2221e360b6d1c384", "level": "note", "message": {"text": "Possibly dead Python function: record_payment"}, "properties": {"repobilityId": "83d730af29b7d811", "scanner": "scanner-primary", "fingerprint": "2221e360b6d1c384", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_database.py:1070"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-1e753890893e759b", "level": "note", "message": {"text": "Possibly dead Python function: load_config"}, "properties": {"repobilityId": "8ae25e0afbffc55e", "scanner": "scanner-primary", "fingerprint": "1e753890893e759b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rlcoach/config.py:33"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-a0969c06bdb8d16a", "level": "note", "message": {"text": "Possibly dead Python function: generate_coaching_plan"}, "properties": {"repobilityId": "c48c3bc8daf0bf6f", "scanner": "scanner-primary", "fingerprint": "a0969c06bdb8d16a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rlcoach/coaching_engine.py:205"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-280802304d3b1be9", "level": "note", "message": {"text": "Possibly dead Python function: rank_gap"}, "properties": {"repobilityId": "1b81d7e0ef47f5cf", "scanner": "scanner-primary", "fingerprint": "280802304d3b1be9", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rlcoach/training_resources.py:229"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d233177374d4036b", "level": "note", "message": {"text": "Possibly dead Python function: poll_now"}, "properties": {"repobilityId": "3291043107c072f5", "scanner": "scanner-primary", "fingerprint": "d233177374d4036b", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rlcoach/poller.py:60"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4e53477e5db1a925", "level": "note", "message": {"text": "Possibly dead Python function: is_processed"}, "properties": {"repobilityId": "bcb0c6fb66021223", "scanner": "scanner-primary", "fingerprint": "4e53477e5db1a925", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rlcoach/ledger.py:40"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-6dce7e516a2bc56e", "level": "note", "message": {"text": "Possibly dead Python function: mark_failed"}, "properties": {"repobilityId": "b198eec284137b9b", "scanner": "scanner-primary", "fingerprint": "6dce7e516a2bc56e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rlcoach/ledger.py:56"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-4711859c18b0ea9e", "level": "note", "message": {"text": "Possibly dead Python function: needs_setup"}, "properties": {"repobilityId": "acbd5218d74e85ba", "scanner": "scanner-primary", "fingerprint": "4711859c18b0ea9e", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rlcoach/psynet_auth.py:88"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8ccd064933d82469", "level": "note", "message": {"text": "Possibly dead Python function: restart_on"}, "properties": {"repobilityId": "9a90f9537efaee88", "scanner": "scanner-primary", "fingerprint": "8ccd064933d82469", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rlcoach/watcher.py:78"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-697ab6d8f294db9a", "level": "note", "message": {"text": "Possibly dead Python function: generate_series_report"}, "properties": {"repobilityId": "63df6a46208794a4", "scanner": "scanner-primary", "fingerprint": "697ab6d8f294db9a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rlcoach/series_analyst.py:283"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-5845bd6c6222b621", "level": "note", "message": {"text": "Possibly dead Python function: parse_start"}, "properties": {"repobilityId": "985cb7246307337b", "scanner": "scanner-primary", "fingerprint": "5845bd6c6222b621", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rlcoach/ui.py:100"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-011fd22f4d679f97", "level": "note", "message": {"text": "Possibly dead Python function: metrics_start"}, "properties": {"repobilityId": "15d5bf5ee9e49093", "scanner": "scanner-primary", "fingerprint": "011fd22f4d679f97", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rlcoach/ui.py:103"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f32f8e3e81496ff2", "level": "note", "message": {"text": "Possibly dead Python function: render_start"}, "properties": {"repobilityId": "ca6576664f2b6338", "scanner": "scanner-primary", "fingerprint": "f32f8e3e81496ff2", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rlcoach/ui.py:106"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aaaeffb16a2ee8f7", "level": "note", "message": {"text": "Possibly dead Python function: write_start"}, "properties": {"repobilityId": "2d04e8176c823ae0", "scanner": "scanner-primary", "fingerprint": "aaaeffb16a2ee8f7", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rlcoach/ui.py:111"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-7252a842acc9e44f", "level": "note", "message": {"text": "Possibly dead Python function: replay_done"}, "properties": {"repobilityId": "87fb3636deddad02", "scanner": "scanner-primary", "fingerprint": "7252a842acc9e44f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rlcoach/ui.py:114"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-8743c719aeb41f8a", "level": "note", "message": {"text": "Possibly dead Python function: show"}, "properties": {"repobilityId": "f2a0b226163b7325", "scanner": "scanner-primary", "fingerprint": "8743c719aeb41f8a", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rlcoach/ui.py:175"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-538993180807a746", "level": "note", "message": {"text": "Possibly dead Python function: quit"}, "properties": {"repobilityId": "09bdd6412a02a732", "scanner": "scanner-primary", "fingerprint": "538993180807a746", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rlcoach/ui.py:179"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa0df2cc933aa230", "level": "note", "message": {"text": "Possibly dead Python function: authenticate_with_code"}, "properties": {"repobilityId": "9da98018d37e5ba7", "scanner": "scanner-primary", "fingerprint": "aa0df2cc933aa230", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rlapi/egs.py:85"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-f0db0c31e0e3d5ca", "level": "note", "message": {"text": "Possibly dead Python function: authenticate_with_refresh_token"}, "properties": {"repobilityId": "7f9ff88d7997b01d", "scanner": "scanner-primary", "fingerprint": "f0db0c31e0e3d5ca", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rlapi/egs.py:92"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e2826cc2a7e2c710", "level": "note", "message": {"text": "Possibly dead Python function: exchange_eos_token"}, "properties": {"repobilityId": "5fc85e25eb854a9b", "scanner": "scanner-primary", "fingerprint": "e2826cc2a7e2c710", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rlapi/egs.py:143"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-d63da3583b14afc0", "level": "warning", "message": {"text": "Dockerfile runs as root: Dockerfile"}, "properties": {"repobilityId": "a2ed1bd120e507db", "scanner": "scanner-primary", "fingerprint": "d63da3583b14afc0", "layer": "hardware", "severity": "medium", "confidence": 1.0, "tags": ["security", "container"]}}, {"ruleId": "scanner-e066691601852931", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: python:3.11-slim"}, "properties": {"repobilityId": "f391052c9bfd7e8b", "scanner": "scanner-primary", "fingerprint": "e066691601852931", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-7b92ab7387e5f44d", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/index.html:868"}, "properties": {"repobilityId": "54c44d8c983139f7", "scanner": "scanner-primary", "fingerprint": "7b92ab7387e5f44d", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "static/index.html"}, "region": {"startLine": 868}}}]}, {"ruleId": "scanner-aa6a9af4342a5665", "level": "warning", "message": {"text": "Insecure pattern 'direct_innerhtml_assignment' in static/admin.html:332"}, "properties": {"repobilityId": "041eed868fb45924", "scanner": "scanner-primary", "fingerprint": "aa6a9af4342a5665", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "direct_innerhtml_assignment"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "static/admin.html"}, "region": {"startLine": 332}}}]}, {"ruleId": "scanner-66e3db74c9998fcd", "level": "error", "message": {"text": "Insecure pattern 'exec_used' in rlcoach/parser.py:416"}, "properties": {"repobilityId": "00204b88e04ac49d", "scanner": "scanner-primary", "fingerprint": "66e3db74c9998fcd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["owasp", "exec_used"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "rlcoach/parser.py"}, "region": {"startLine": 416}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-d4c91d8044185655", "level": "note", "message": {"text": "Very large file: web_app.py (1586 lines)"}, "properties": {"repobilityId": "704f1116e3225ec3", "scanner": "scanner-primary", "fingerprint": "d4c91d8044185655", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "21c11c83892b0922", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "7c77df634794ff18", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "77bb8eba731dec02", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "b0e992cf1272216c", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "13803df9a55e9d05", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-c5c042e9834a2a3f", "level": "none", "message": {"text": "Commented-code block (6 lines) in web_app.py:430"}, "properties": {"repobilityId": "e066f0b6146a34ad", "scanner": "scanner-primary", "fingerprint": "c5c042e9834a2a3f", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-75045f8880835ed0", "level": "none", "message": {"text": "Commented-code block (5 lines) in rlcoach/parser.py:292"}, "properties": {"repobilityId": "9823cf8b01cb18bc", "scanner": "scanner-primary", "fingerprint": "75045f8880835ed0", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-3a4398ed3b275aa2", "level": "note", "message": {"text": "Legacy-named symbol `debug_copy` in rlcoach/poller.py:164"}, "properties": {"repobilityId": "4ae708554c58fd61", "scanner": "scanner-primary", "fingerprint": "3a4398ed3b275aa2", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-b63b547b8bbf38e8", "level": "note", "message": {"text": "Legacy-named symbol `debug_copy` in rlcoach/web_pipeline.py:491"}, "properties": {"repobilityId": "3c8acd783eb4821a", "scanner": "scanner-primary", "fingerprint": "b63b547b8bbf38e8", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-f5519d3ef79bba55", "level": "note", "message": {"text": "Legacy-named symbol `debug_copy` in rlcoach/replay_selector.py:336"}, "properties": {"repobilityId": "52b3ab18b2f34b27", "scanner": "scanner-primary", "fingerprint": "f5519d3ef79bba55", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-af022f937dd5b7fd", "level": "note", "message": {"text": "9 env vars used in code but missing from .env.example"}, "properties": {"repobilityId": "5597384795dea7a4", "scanner": "scanner-primary", "fingerprint": "af022f937dd5b7fd", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "config-drift"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "1da2cd365306713c", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "6b9ac14752bb2d47", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-cbde2c0a3f058fbf", "level": "error", "message": {"text": "FastAPI POST `delete_account` without auth dependency \u2014 web_app.py:293"}, "properties": {"repobilityId": "ae4a5c929bede106", "scanner": "scanner-primary", "fingerprint": "cbde2c0a3f058fbf", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_app.py"}, "region": {"startLine": 293}}}]}, {"ruleId": "scanner-4735ef8fe0a45db8", "level": "error", "message": {"text": "FastAPI POST `epic_start` without auth dependency \u2014 web_app.py:331"}, "properties": {"repobilityId": "cc84d65988a00a8c", "scanner": "scanner-primary", "fingerprint": "4735ef8fe0a45db8", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_app.py"}, "region": {"startLine": 331}}}]}, {"ruleId": "scanner-0c9118b312933d1c", "level": "error", "message": {"text": "FastAPI POST `epic_disconnect` without auth dependency \u2014 web_app.py:400"}, "properties": {"repobilityId": "82b946421c747781", "scanner": "scanner-primary", "fingerprint": "0c9118b312933d1c", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_app.py"}, "region": {"startLine": 400}}}]}, {"ruleId": "scanner-3f30f33034d9917d", "level": "error", "message": {"text": "FastAPI POST `epic_refresh_name` without auth dependency \u2014 web_app.py:407"}, "properties": {"repobilityId": "4e6b07f382460b49", "scanner": "scanner-primary", "fingerprint": "3f30f33034d9917d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_app.py"}, "region": {"startLine": 407}}}]}, {"ruleId": "scanner-c30c62d1435de9ea", "level": "error", "message": {"text": "FastAPI POST `set_player_id` without auth dependency \u2014 web_app.py:511"}, "properties": {"repobilityId": "9c103d0c997d2f6f", "scanner": "scanner-primary", "fingerprint": "c30c62d1435de9ea", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_app.py"}, "region": {"startLine": 511}}}]}, {"ruleId": "scanner-930d6948e949b78e", "level": "error", "message": {"text": "FastAPI POST `trigger_fetch` without auth dependency \u2014 web_app.py:714"}, "properties": {"repobilityId": "66471f5390b47e79", "scanner": "scanner-primary", "fingerprint": "930d6948e949b78e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_app.py"}, "region": {"startLine": 714}}}]}, {"ruleId": "scanner-eefa984284e5779e", "level": "error", "message": {"text": "FastAPI POST `analyze_match` without auth dependency \u2014 web_app.py:796"}, "properties": {"repobilityId": "c3cef4a87b23e072", "scanner": "scanner-primary", "fingerprint": "eefa984284e5779e", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_app.py"}, "region": {"startLine": 796}}}]}, {"ruleId": "scanner-a05fbf28d35e7cf6", "level": "error", "message": {"text": "FastAPI POST `stop_job` without auth dependency \u2014 web_app.py:829"}, "properties": {"repobilityId": "074e8f22cad3b2a5", "scanner": "scanner-primary", "fingerprint": "a05fbf28d35e7cf6", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_app.py"}, "region": {"startLine": 829}}}]}, {"ruleId": "scanner-c27d1e38d2fd4308", "level": "error", "message": {"text": "FastAPI POST `save_profile` without auth dependency \u2014 web_app.py:906"}, "properties": {"repobilityId": "11094faf06663208", "scanner": "scanner-primary", "fingerprint": "c27d1e38d2fd4308", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_app.py"}, "region": {"startLine": 906}}}]}, {"ruleId": "scanner-774ab52a6f3b3472", "level": "error", "message": {"text": "FastAPI POST `coaching_generate` without auth dependency \u2014 web_app.py:917"}, "properties": {"repobilityId": "e101c6433439e3b3", "scanner": "scanner-primary", "fingerprint": "774ab52a6f3b3472", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_app.py"}, "region": {"startLine": 917}}}]}, {"ruleId": "scanner-e2d54a868c0ff64a", "level": "error", "message": {"text": "FastAPI POST `coaching_complete` without auth dependency \u2014 web_app.py:998"}, "properties": {"repobilityId": "405c58e4d41ead50", "scanner": "scanner-primary", "fingerprint": "e2d54a868c0ff64a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_app.py"}, "region": {"startLine": 998}}}]}, {"ruleId": "scanner-289ca84ad59946dd", "level": "error", "message": {"text": "FastAPI DELETE `delete_coaching` without auth dependency \u2014 web_app.py:1021"}, "properties": {"repobilityId": "20fcebc84d4753f3", "scanner": "scanner-primary", "fingerprint": "289ca84ad59946dd", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_app.py"}, "region": {"startLine": 1021}}}]}, {"ruleId": "scanner-336410f1df78b01f", "level": "error", "message": {"text": "FastAPI POST `series_generate` without auth dependency \u2014 web_app.py:1042"}, "properties": {"repobilityId": "c6876b4b6588798d", "scanner": "scanner-primary", "fingerprint": "336410f1df78b01f", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_app.py"}, "region": {"startLine": 1042}}}]}, {"ruleId": "scanner-0168cd90de7dc3ce", "level": "error", "message": {"text": "FastAPI DELETE `delete_series` without auth dependency \u2014 web_app.py:1086"}, "properties": {"repobilityId": "40a22bd33f9a0ed8", "scanner": "scanner-primary", "fingerprint": "0168cd90de7dc3ce", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_app.py"}, "region": {"startLine": 1086}}}]}, {"ruleId": "scanner-d393c46c0675ed5d", "level": "error", "message": {"text": "FastAPI POST `save_tracker` without auth dependency \u2014 web_app.py:1200"}, "properties": {"repobilityId": "24e424fc4a4e58a2", "scanner": "scanner-primary", "fingerprint": "d393c46c0675ed5d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_app.py"}, "region": {"startLine": 1200}}}]}, {"ruleId": "scanner-98718896a66dee9a", "level": "error", "message": {"text": "FastAPI POST `sync_mmr` without auth dependency \u2014 web_app.py:1210"}, "properties": {"repobilityId": "7801100693208fb6", "scanner": "scanner-primary", "fingerprint": "98718896a66dee9a", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_app.py"}, "region": {"startLine": 1210}}}]}, {"ruleId": "scanner-0383d43da2af2e1d", "level": "error", "message": {"text": "FastAPI POST `admin_set_role` without auth dependency \u2014 web_app.py:1297"}, "properties": {"repobilityId": "7cebbc38235f2863", "scanner": "scanner-primary", "fingerprint": "0383d43da2af2e1d", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_app.py"}, "region": {"startLine": 1297}}}]}, {"ruleId": "scanner-3e621a04c47ced58", "level": "error", "message": {"text": "FastAPI POST `admin_set_ban` without auth dependency \u2014 web_app.py:1315"}, "properties": {"repobilityId": "69d3dda83e3a7f3f", "scanner": "scanner-primary", "fingerprint": "3e621a04c47ced58", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_app.py"}, "region": {"startLine": 1315}}}]}, {"ruleId": "scanner-614075de5f9830c9", "level": "error", "message": {"text": "FastAPI POST `admin_reset_usage` without auth dependency \u2014 web_app.py:1331"}, "properties": {"repobilityId": "ed7bb9d2c9365e09", "scanner": "scanner-primary", "fingerprint": "614075de5f9830c9", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_app.py"}, "region": {"startLine": 1331}}}]}, {"ruleId": "scanner-226f1c82ee755422", "level": "error", "message": {"text": "FastAPI DELETE `admin_delete_user` without auth dependency \u2014 web_app.py:1347"}, "properties": {"repobilityId": "0f65306baf81aef4", "scanner": "scanner-primary", "fingerprint": "226f1c82ee755422", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.fastapi.unauth_mutation"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "web_app.py"}, "region": {"startLine": 1347}}}]}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "d0de0046e2338ad5", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-25702767f50d6c7d", "level": "note", "message": {"text": "Unused endpoint: POST /api/register"}, "properties": {"repobilityId": "06c60c374eeab019", "scanner": "scanner-primary", "fingerprint": "25702767f50d6c7d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-200ab2e98a288506", "level": "note", "message": {"text": "Unused endpoint: POST /api/login"}, "properties": {"repobilityId": "11c1126b8f112864", "scanner": "scanner-primary", "fingerprint": "200ab2e98a288506", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a10936f69cf3bbb4", "level": "note", "message": {"text": "Unused endpoint: POST /api/logout"}, "properties": {"repobilityId": "6f5a22613f3ff1a5", "scanner": "scanner-primary", "fingerprint": "a10936f69cf3bbb4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-71f01af52d9d4263", "level": "note", "message": {"text": "Unused endpoint: POST /api/account/delete"}, "properties": {"repobilityId": "4c1b6458709c414b", "scanner": "scanner-primary", "fingerprint": "71f01af52d9d4263", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5c1545494ab6166c", "level": "note", "message": {"text": "Unused endpoint: GET /api/me"}, "properties": {"repobilityId": "cdc45f3ce3987a25", "scanner": "scanner-primary", "fingerprint": "5c1545494ab6166c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8d3d6d93918e5111", "level": "note", "message": {"text": "Unused endpoint: POST /api/epic/start"}, "properties": {"repobilityId": "b468cd78edb71279", "scanner": "scanner-primary", "fingerprint": "8d3d6d93918e5111", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9b5fcc4569c64a15", "level": "note", "message": {"text": "Unused endpoint: GET /api/epic/poll/{device_code}"}, "properties": {"repobilityId": "615d4ff8bbaa0a6d", "scanner": "scanner-primary", "fingerprint": "9b5fcc4569c64a15", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f1ace91ed1d44718", "level": "note", "message": {"text": "Unused endpoint: POST /api/epic/disconnect"}, "properties": {"repobilityId": "aedd07c03e005d9b", "scanner": "scanner-primary", "fingerprint": "f1ace91ed1d44718", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1fffc543460ad0c5", "level": "note", "message": {"text": "Unused endpoint: POST /api/epic/refresh-name"}, "properties": {"repobilityId": "654cbb98000aabb9", "scanner": "scanner-primary", "fingerprint": "1fffc543460ad0c5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-34ab09c7a97f88bc", "level": "note", "message": {"text": "Unused endpoint: GET /api/steam/login"}, "properties": {"repobilityId": "57ead7b014c420df", "scanner": "scanner-primary", "fingerprint": "34ab09c7a97f88bc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7d3b6b959e040309", "level": "note", "message": {"text": "Unused endpoint: GET /api/steam/callback"}, "properties": {"repobilityId": "8373cbdd105aa8df", "scanner": "scanner-primary", "fingerprint": "7d3b6b959e040309", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b4cbdede017f60cc", "level": "note", "message": {"text": "Unused endpoint: POST /api/auth/player_id"}, "properties": {"repobilityId": "da550852636f64ba", "scanner": "scanner-primary", "fingerprint": "b4cbdede017f60cc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-591252659cafb6c3", "level": "note", "message": {"text": "Unused endpoint: GET /api/rank"}, "properties": {"repobilityId": "a00720d066a4ca28", "scanner": "scanner-primary", "fingerprint": "591252659cafb6c3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f44c9a68aca84f37", "level": "note", "message": {"text": "Unused endpoint: GET /api/stats/summary"}, "properties": {"repobilityId": "fd2f2fe50d6d159d", "scanner": "scanner-primary", "fingerprint": "f44c9a68aca84f37", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c9e0c0985f62051b", "level": "note", "message": {"text": "Unused endpoint: GET /api/debug/service-status"}, "properties": {"repobilityId": "9c66b77487769f91", "scanner": "scanner-primary", "fingerprint": "c9e0c0985f62051b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ea9f38c4cf89c58c", "level": "note", "message": {"text": "Unused endpoint: GET /api/debug/psynet-probe"}, "properties": {"repobilityId": "74d829f91ba44bbe", "scanner": "scanner-primary", "fingerprint": "ea9f38c4cf89c58c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-429753b3470733dd", "level": "note", "message": {"text": "Unused endpoint: GET /api/stats/lifetime"}, "properties": {"repobilityId": "37f49e36541e6442", "scanner": "scanner-primary", "fingerprint": "429753b3470733dd", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cf6ee825064b8d93", "level": "note", "message": {"text": "Unused endpoint: POST /api/fetch"}, "properties": {"repobilityId": "bb372ba906477f76", "scanner": "scanner-primary", "fingerprint": "cf6ee825064b8d93", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b64b859f2efc3054", "level": "note", "message": {"text": "Unused endpoint: GET /api/fetch/status/{job_id}"}, "properties": {"repobilityId": "043fc7c5279b3038", "scanner": "scanner-primary", "fingerprint": "b64b859f2efc3054", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fbcacabcecf377a6", "level": "note", "message": {"text": "Unused endpoint: GET /api/fetch/stream/{job_id}"}, "properties": {"repobilityId": "71919a475e5fe9c4", "scanner": "scanner-primary", "fingerprint": "fbcacabcecf377a6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1658e2c0fb5d325e", "level": "note", "message": {"text": "Unused endpoint: GET /api/matches"}, "properties": {"repobilityId": "46ec6bc692396aa1", "scanner": "scanner-primary", "fingerprint": "1658e2c0fb5d325e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-745b9a0e660edeaf", "level": "note", "message": {"text": "Unused endpoint: GET /api/matches/{match_id}"}, "properties": {"repobilityId": "3468feae54a1935d", "scanner": "scanner-primary", "fingerprint": "745b9a0e660edeaf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fea9f0844fc941d2", "level": "note", "message": {"text": "Unused endpoint: GET /api/matches/{match_id}/dashboard"}, "properties": {"repobilityId": "afb5fce10df92bf3", "scanner": "scanner-primary", "fingerprint": "fea9f0844fc941d2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1488f23521923524", "level": "note", "message": {"text": "Unused endpoint: POST /api/matches/{match_id}/analyze"}, "properties": {"repobilityId": "ef40c16026f9f607", "scanner": "scanner-primary", "fingerprint": "1488f23521923524", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1defc33808b8c4e1", "level": "note", "message": {"text": "Unused endpoint: POST /api/job/{job_id}/stop"}, "properties": {"repobilityId": "73c74af45c2d9212", "scanner": "scanner-primary", "fingerprint": "1defc33808b8c4e1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-60e78a867a1a28c9", "level": "note", "message": {"text": "Unused endpoint: GET /api/usage"}, "properties": {"repobilityId": "684f971b48682eee", "scanner": "scanner-primary", "fingerprint": "60e78a867a1a28c9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-de6d42a494e388bc", "level": "note", "message": {"text": "Unused endpoint: GET /api/metrics/history"}, "properties": {"repobilityId": "7a9bd50885fd1c62", "scanner": "scanner-primary", "fingerprint": "de6d42a494e388bc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4f8315c7763f7352", "level": "note", "message": {"text": "Unused endpoint: GET /api/profile"}, "properties": {"repobilityId": "7cc130551fab2db7", "scanner": "scanner-primary", "fingerprint": "4f8315c7763f7352", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-58d7aaced3281e36", "level": "note", "message": {"text": "Unused endpoint: POST /api/profile"}, "properties": {"repobilityId": "2f17c2c163e7ee10", "scanner": "scanner-primary", "fingerprint": "58d7aaced3281e36", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7ccceb6f7f25df17", "level": "note", "message": {"text": "Unused endpoint: POST /api/coaching/generate"}, "properties": {"repobilityId": "30f40531655304d5", "scanner": "scanner-primary", "fingerprint": "7ccceb6f7f25df17", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-87c91dfcda83cf85", "level": "note", "message": {"text": "Unused endpoint: GET /api/coaching"}, "properties": {"repobilityId": "064ae2c50740df7a", "scanner": "scanner-primary", "fingerprint": "87c91dfcda83cf85", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4ff64e780cf58140", "level": "note", "message": {"text": "Unused endpoint: POST /api/coaching/complete"}, "properties": {"repobilityId": "282955555227fb89", "scanner": "scanner-primary", "fingerprint": "4ff64e780cf58140", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b9d8c214ebbef8c5", "level": "note", "message": {"text": "Unused endpoint: GET /api/coaching/list"}, "properties": {"repobilityId": "f39e995bf80f23c1", "scanner": "scanner-primary", "fingerprint": "b9d8c214ebbef8c5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2b28baea66e984cc", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/coaching/{plan_id}"}, "properties": {"repobilityId": "040c6beed520b6a9", "scanner": "scanner-primary", "fingerprint": "2b28baea66e984cc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6c63847c40ef3e86", "level": "note", "message": {"text": "Unused endpoint: GET /api/coaching/view"}, "properties": {"repobilityId": "7fbe8a6fc1cbb3bf", "scanner": "scanner-primary", "fingerprint": "6c63847c40ef3e86", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-67d24ab29eb40433", "level": "note", "message": {"text": "Unused endpoint: POST /api/series/generate"}, "properties": {"repobilityId": "465aebb152b32c95", "scanner": "scanner-primary", "fingerprint": "67d24ab29eb40433", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b54d31e5ab163733", "level": "note", "message": {"text": "Unused endpoint: GET /api/series"}, "properties": {"repobilityId": "7a62f5a55430aeb1", "scanner": "scanner-primary", "fingerprint": "b54d31e5ab163733", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-85def21b6e123cb4", "level": "note", "message": {"text": "Unused endpoint: GET /api/series/list"}, "properties": {"repobilityId": "7afccc0146ce6d11", "scanner": "scanner-primary", "fingerprint": "85def21b6e123cb4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1724b9e583a0ac90", "level": "note", "message": {"text": "Unused endpoint: DELETE /api/series/{report_id}"}, "properties": {"repobilityId": "cdd24b4d44c9a51f", "scanner": "scanner-primary", "fingerprint": "1724b9e583a0ac90", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8b9e93be6d96c600", "level": "note", "message": {"text": "Unused endpoint: GET /api/series/view"}, "properties": {"repobilityId": "37742ddcec8171ef", "scanner": "scanner-primary", "fingerprint": "8b9e93be6d96c600", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e89baa7ad2fe79a9", "level": "note", "message": {"text": "Unused endpoint: GET /api/tracker"}, "properties": {"repobilityId": "79e657c9a85595b0", "scanner": "scanner-primary", "fingerprint": "e89baa7ad2fe79a9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9eb6ef216712c1ad", "level": "note", "message": {"text": "Unused endpoint: POST /api/tracker"}, "properties": {"repobilityId": "e93d5f9220431dfc", "scanner": "scanner-primary", "fingerprint": "9eb6ef216712c1ad", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-262e1e5963e2ae97", "level": "note", "message": {"text": "Unused endpoint: POST /api/tracker/sync-mmr"}, "properties": {"repobilityId": "190e1ff9b7250c7f", "scanner": "scanner-primary", "fingerprint": "262e1e5963e2ae97", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-72a1c7992338a2fc", "level": "note", "message": {"text": "Unused endpoint: GET /api/resources"}, "properties": {"repobilityId": "d362c3cb08ec8e3c", "scanner": "scanner-primary", "fingerprint": "72a1c7992338a2fc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-953ec1a0ee6df50d", "level": "note", "message": {"text": "Unused endpoint: GET /admin"}, "properties": {"repobilityId": "d842a5476d9dad94", "scanner": "scanner-primary", "fingerprint": "953ec1a0ee6df50d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e150ecfd4e11c48c", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/overview"}, "properties": {"repobilityId": "4724f7669c0cf931", "scanner": "scanner-primary", "fingerprint": "e150ecfd4e11c48c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b4d87f54d62a1386", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/users"}, "properties": {"repobilityId": "331b33708da9558b", "scanner": "scanner-primary", "fingerprint": "b4d87f54d62a1386", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-94e87df6af16dab3", "level": "note", "message": {"text": "Unused endpoint: GET /api/admin/users/{user_id}"}, "properties": {"repobilityId": "5e73dc7410217d82", "scanner": "scanner-primary", "fingerprint": "94e87df6af16dab3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2a9cb25e5830a1c2", "level": "note", "message": {"text": "Unused endpoint: POST /api/admin/users/{user_id}/role"}, "properties": {"repobilityId": "c8b1e0ba97c60a90", "scanner": "scanner-primary", "fingerprint": "2a9cb25e5830a1c2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}