{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-59cbf6e36a0e3777", "name": "Docker base image is tag-pinned but not digest-pinned: node:22-bookworm-slim", "shortDescription": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-bookworm-slim"}, "fullDescription": {"text": "Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-aa5acaa49eb8315b", "name": "Containers defined but no K8s/orchestration manifest found", "shortDescription": {"text": "Containers defined but no K8s/orchestration manifest found"}, "fullDescription": {"text": "Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo."}, "properties": {"scanner": "scanner-primary", "layer": "hardware", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9710c8d059e53154", "name": "No frontend routes/components detected", "shortDescription": {"text": "No frontend routes/components detected"}, "fullDescription": {"text": "No React/Vue/Next routes were found. This is fine for backend-only repos."}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "info", "confidence": 1.0}}, {"id": "scanner-7b778ad34acab37e", "name": "Insecure pattern 'cors_wildcard' in src/chat-server.ts:216", "shortDescription": {"text": "Insecure pattern 'cors_wildcard' in src/chat-server.ts:216"}, "fullDescription": {"text": "Found a known-risky pattern (cors_wildcard). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-3ad1891d36bc66a7", "name": "Very large file: src/tools.ts (2926 lines)", "shortDescription": {"text": "Very large file: src/tools.ts (2926 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6893a6c8b0861585", "name": "Very low test-to-source ratio", "shortDescription": {"text": "Very low test-to-source ratio"}, "fullDescription": {"text": "0 test file(s) for 13 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci, tests. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8d59dc27cdb18b60", "name": "Commented-code block (9 lines) in src/chat-server.ts:39", "shortDescription": {"text": "Commented-code block (9 lines) in src/chat-server.ts:39"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-8b4201cd19a23d66", "name": "Commented-code block (5 lines) in src/gemini-bridge.ts:272", "shortDescription": {"text": "Commented-code block (5 lines) in src/gemini-bridge.ts:272"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-970aa6fcfd6e150e", "name": "Commented-code block (6 lines) in src/tools.ts:696", "shortDescription": {"text": "Commented-code block (6 lines) in src/tools.ts:696"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-10624c4b8bdcb960", "name": "Commented-code block (7 lines) in src/http-server.ts:64", "shortDescription": {"text": "Commented-code block (7 lines) in src/http-server.ts:64"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0e29fb7123dcaa87", "name": "Commented-code block (5 lines) in src/time.ts:47", "shortDescription": {"text": "Commented-code block (5 lines) in src/time.ts:47"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-79b4c2a8b44f18b3", "name": "Commented-code block (8 lines) in src/oauth/metadata.ts:107", "shortDescription": {"text": "Commented-code block (8 lines) in src/oauth/metadata.ts:107"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-4dae82bb769e3890", "name": "Commented-code block (6 lines) in src/oauth/handlers.ts:299", "shortDescription": {"text": "Commented-code block (6 lines) in src/oauth/handlers.ts:299"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-0c63a6fa59025c73", "name": "Unused endpoint: POST /refresh-config", "shortDescription": {"text": "Unused endpoint: POST /refresh-config"}, "fullDescription": {"text": "`src/chat-server.ts` declares `POST /refresh-config` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cff8da5fbc19c76d", "name": "Unused endpoint: POST /chat", "shortDescription": {"text": "Unused endpoint: POST /chat"}, "fullDescription": {"text": "`src/chat-server.ts` declares `POST /chat` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2595b39638e5c045", "name": "Unused endpoint: GET /profile", "shortDescription": {"text": "Unused endpoint: GET /profile"}, "fullDescription": {"text": "`src/tools.ts` declares `GET /profile` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-38fe8bc38bc8d2df", "name": "Unused endpoint: GET /wallet", "shortDescription": {"text": "Unused endpoint: GET /wallet"}, "fullDescription": {"text": "`src/tools.ts` declares `GET /wallet` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c124716a4436518b", "name": "Unused endpoint: GET /reports", "shortDescription": {"text": "Unused endpoint: GET /reports"}, "fullDescription": {"text": "`src/tools.ts` declares `GET /reports` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-80dbae2195fe259a", "name": "Unused endpoint: POST /calendar", "shortDescription": {"text": "Unused endpoint: POST /calendar"}, "fullDescription": {"text": "`src/tools.ts` declares `POST /calendar` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4e60d58fe2111570", "name": "Unused endpoint: POST /pos", "shortDescription": {"text": "Unused endpoint: POST /pos"}, "fullDescription": {"text": "`src/tools.ts` declares `POST /pos` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-00cd5bee1c9f9566", "name": "Unused endpoint: POST /bookings", "shortDescription": {"text": "Unused endpoint: POST /bookings"}, "fullDescription": {"text": "`src/tools.ts` declares `POST /bookings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5b4d8b5420aeee16", "name": "Unused endpoint: GET /branches", "shortDescription": {"text": "Unused endpoint: GET /branches"}, "fullDescription": {"text": "`src/tools.ts` declares `GET /branches` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-785d50f121ed5854", "name": "Unused endpoint: POST /branches", "shortDescription": {"text": "Unused endpoint: POST /branches"}, "fullDescription": {"text": "`src/tools.ts` declares `POST /branches` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72fa7ed0df926aed", "name": "Unused endpoint: GET /branches/places/autocomplete", "shortDescription": {"text": "Unused endpoint: GET /branches/places/autocomplete"}, "fullDescription": {"text": "`src/tools.ts` declares `GET /branches/places/autocomplete` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-603824ccf0e28017", "name": "Unused endpoint: GET /branches/places/details", "shortDescription": {"text": "Unused endpoint: GET /branches/places/details"}, "fullDescription": {"text": "`src/tools.ts` declares `GET /branches/places/details` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3c2566b08f9c0155", "name": "Unused endpoint: POST /sections", "shortDescription": {"text": "Unused endpoint: POST /sections"}, "fullDescription": {"text": "`src/tools.ts` declares `POST /sections` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a96ac013791394de", "name": "Unused endpoint: POST /sections/sort", "shortDescription": {"text": "Unused endpoint: POST /sections/sort"}, "fullDescription": {"text": "`src/tools.ts` declares `POST /sections/sort` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c3dcab8cb11c2cdf", "name": "Unused endpoint: GET /popular-services", "shortDescription": {"text": "Unused endpoint: GET /popular-services"}, "fullDescription": {"text": "`src/tools.ts` declares `GET /popular-services` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c09b6d90f7fb6557", "name": "Unused endpoint: POST /services", "shortDescription": {"text": "Unused endpoint: POST /services"}, "fullDescription": {"text": "`src/tools.ts` declares `POST /services` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fc445045705bb83a", "name": "Unused endpoint: POST /offers", "shortDescription": {"text": "Unused endpoint: POST /offers"}, "fullDescription": {"text": "`src/tools.ts` declares `POST /offers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4a66d271b39b318e", "name": "Unused endpoint: POST /employees", "shortDescription": {"text": "Unused endpoint: POST /employees"}, "fullDescription": {"text": "`src/tools.ts` declares `POST /employees` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b3d29925dee8bcc0", "name": "Unused endpoint: POST /customers", "shortDescription": {"text": "Unused endpoint: POST /customers"}, "fullDescription": {"text": "`src/tools.ts` declares `POST /customers` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bc4a4520105bd660", "name": "Unused endpoint: POST /cancellation-reasons", "shortDescription": {"text": "Unused endpoint: POST /cancellation-reasons"}, "fullDescription": {"text": "`src/tools.ts` declares `POST /cancellation-reasons` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b8e1cef8cdbc5f14", "name": "Unused endpoint: POST /cancellation-reasons/sort", "shortDescription": {"text": "Unused endpoint: POST /cancellation-reasons/sort"}, "fullDescription": {"text": "`src/tools.ts` declares `POST /cancellation-reasons/sort` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2944403e996d951e", "name": "Unused endpoint: POST /promo-codes", "shortDescription": {"text": "Unused endpoint: POST /promo-codes"}, "fullDescription": {"text": "`src/tools.ts` declares `POST /promo-codes` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-078b3f8a9311d56a", "name": "Unused endpoint: POST /roles", "shortDescription": {"text": "Unused endpoint: POST /roles"}, "fullDescription": {"text": "`src/tools.ts` declares `POST /roles` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-470861e6affa876e", "name": "Unused endpoint: POST /reminders/reset-defaults", "shortDescription": {"text": "Unused endpoint: POST /reminders/reset-defaults"}, "fullDescription": {"text": "`src/tools.ts` declares `POST /reminders/reset-defaults` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ffd37dd1efcec812", "name": "Unused endpoint: GET /reminder-channels", "shortDescription": {"text": "Unused endpoint: GET /reminder-channels"}, "fullDescription": {"text": "`src/tools.ts` declares `GET /reminder-channels` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-512ccb0fd0b230ba", "name": "Unused endpoint: GET /settings", "shortDescription": {"text": "Unused endpoint: GET /settings"}, "fullDescription": {"text": "`src/tools.ts` declares `GET /settings` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8a0c471ec6f27893", "name": "Unused endpoint: GET /google-calendar", "shortDescription": {"text": "Unused endpoint: GET /google-calendar"}, "fullDescription": {"text": "`src/tools.ts` declares `GET /google-calendar` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7f40c4f1d06281ce", "name": "Unused endpoint: GET /google-calendar/connect", "shortDescription": {"text": "Unused endpoint: GET /google-calendar/connect"}, "fullDescription": {"text": "`src/tools.ts` declares `GET /google-calendar/connect` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6cd2edf262fdcbe6", "name": "Unused endpoint: POST /google-calendar/disconnect", "shortDescription": {"text": "Unused endpoint: POST /google-calendar/disconnect"}, "fullDescription": {"text": "`src/tools.ts` declares `POST /google-calendar/disconnect` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-62c66056ff8b4db8", "name": "Unused endpoint: POST /google-calendar/calendar", "shortDescription": {"text": "Unused endpoint: POST /google-calendar/calendar"}, "fullDescription": {"text": "`src/tools.ts` declares `POST /google-calendar/calendar` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-0578faf02c604a46", "name": "Unused endpoint: POST /subscriptions", "shortDescription": {"text": "Unused endpoint: POST /subscriptions"}, "fullDescription": {"text": "`src/tools.ts` declares `POST /subscriptions` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f0c7f10539cc0e23", "name": "Unused endpoint: POST /subscriptions/pay", "shortDescription": {"text": "Unused endpoint: POST /subscriptions/pay"}, "fullDescription": {"text": "`src/tools.ts` declares `POST /subscriptions/pay` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf5ba2481bf19c5e", "name": "Unused endpoint: POST /subscriptions/check_is_paid", "shortDescription": {"text": "Unused endpoint: POST /subscriptions/check_is_paid"}, "fullDescription": {"text": "`src/tools.ts` declares `POST /subscriptions/check_is_paid` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9a0ad1e54b48b85c", "name": "Unused endpoint: POST /subscriptions/activate-free", "shortDescription": {"text": "Unused endpoint: POST /subscriptions/activate-free"}, "fullDescription": {"text": "`src/tools.ts` declares `POST /subscriptions/activate-free` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-28d1e7685630a7cc", "name": "Unused endpoint: GET /zatca", "shortDescription": {"text": "Unused endpoint: GET /zatca"}, "fullDescription": {"text": "`src/tools.ts` declares `GET /zatca` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d3bbcf42778dcbe", "name": "Unused endpoint: POST /zatca/register", "shortDescription": {"text": "Unused endpoint: POST /zatca/register"}, "fullDescription": {"text": "`src/tools.ts` declares `POST /zatca/register` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4fe9bb486644f008", "name": "Unused endpoint: POST /change-password", "shortDescription": {"text": "Unused endpoint: POST /change-password"}, "fullDescription": {"text": "`src/tools.ts` declares `POST /change-password` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb8cdd3f4d307d6c", "name": "Unused endpoint: POST /send-code", "shortDescription": {"text": "Unused endpoint: POST /send-code"}, "fullDescription": {"text": "`src/tools.ts` declares `POST /send-code` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cfa4aa0bb85992dc", "name": "Unused endpoint: POST /update-email", "shortDescription": {"text": "Unused endpoint: POST /update-email"}, "fullDescription": {"text": "`src/tools.ts` declares `POST /update-email` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-df398f497209de6e", "name": "Unused endpoint: POST /update-phone", "shortDescription": {"text": "Unused endpoint: POST /update-phone"}, "fullDescription": {"text": "`src/tools.ts` declares `POST /update-phone` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f116bd329b6fd361", "name": "Unused endpoint: POST /update-profile", "shortDescription": {"text": "Unused endpoint: POST /update-profile"}, "fullDescription": {"text": "`src/tools.ts` declares `POST /update-profile` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5baa8971ebe192a1", "name": "Unused endpoint: GET /", "shortDescription": {"text": "Unused endpoint: GET /"}, "fullDescription": {"text": "`src/http-server.ts` declares `GET /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-bfd1643486ebb832", "name": "Unused endpoint: GET /mcp/.well-known/oauth-protected-resource", "shortDescription": {"text": "Unused endpoint: GET /mcp/.well-known/oauth-protected-resource"}, "fullDescription": {"text": "`src/http-server.ts` declares `GET /mcp/.well-known/oauth-protected-resource` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-10a1d3e929964a61", "name": "Unused endpoint: GET /sse/.well-known/oauth-protected-resource", "shortDescription": {"text": "Unused endpoint: GET /sse/.well-known/oauth-protected-resource"}, "fullDescription": {"text": "`src/http-server.ts` declares `GET /sse/.well-known/oauth-protected-resource` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-f97a00df2b7643a1", "name": "Unused endpoint: POST /oauth/register", "shortDescription": {"text": "Unused endpoint: POST /oauth/register"}, "fullDescription": {"text": "`src/http-server.ts` declares `POST /oauth/register` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9d51ccf0f5cd9fa4", "name": "Unused endpoint: GET /oauth/authorize", "shortDescription": {"text": "Unused endpoint: GET /oauth/authorize"}, "fullDescription": {"text": "`src/http-server.ts` declares `GET /oauth/authorize` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c68431d91d878a10", "name": "Unused endpoint: POST /oauth/authorize", "shortDescription": {"text": "Unused endpoint: POST /oauth/authorize"}, "fullDescription": {"text": "`src/http-server.ts` declares `POST /oauth/authorize` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-30c1225f6259028b", "name": "Unused endpoint: POST /oauth/token", "shortDescription": {"text": "Unused endpoint: POST /oauth/token"}, "fullDescription": {"text": "`src/http-server.ts` declares `POST /oauth/token` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7a009b1a56794f45", "name": "Unused endpoint: POST /", "shortDescription": {"text": "Unused endpoint: POST /"}, "fullDescription": {"text": "`src/http-server.ts` declares `POST /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3b30f4c0994a30b4", "name": "Unused endpoint: DELETE /", "shortDescription": {"text": "Unused endpoint: DELETE /"}, "fullDescription": {"text": "`src/http-server.ts` declares `DELETE /` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/20382"}, "properties": {"repository": "Streamline-For-Trade-And-Marketing/streamline-mcp", "repoUrl": "https://github.com/Streamline-For-Trade-And-Marketing/streamline-mcp", "branch": "main"}, "results": [{"ruleId": "scanner-59cbf6e36a0e3777", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-bookworm-slim"}, "properties": {"repobilityId": "53602caa5713e7e7", "scanner": "scanner-primary", "fingerprint": "59cbf6e36a0e3777", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-59cbf6e36a0e3777", "level": "note", "message": {"text": "Docker base image is tag-pinned but not digest-pinned: node:22-bookworm-slim"}, "properties": {"repobilityId": "75886bede6bb11df", "scanner": "scanner-primary", "fingerprint": "59cbf6e36a0e3777", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["supply-chain", "docker", "pinned-dependencies"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "Dockerfile"}, "region": {"startLine": 36}}}]}, {"ruleId": "scanner-aa5acaa49eb8315b", "level": "note", "message": {"text": "Containers defined but no K8s/orchestration manifest found"}, "properties": {"repobilityId": "b230ea9b68736081", "scanner": "scanner-primary", "fingerprint": "aa5acaa49eb8315b", "layer": "hardware", "severity": "low", "confidence": 1.0, "tags": ["coverage", "deployment"]}}, {"ruleId": "scanner-9710c8d059e53154", "level": "none", "message": {"text": "No frontend routes/components detected"}, "properties": {"repobilityId": "44ca61485762e494", "scanner": "scanner-primary", "fingerprint": "9710c8d059e53154", "layer": "frontend", "severity": "info", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-7b778ad34acab37e", "level": "warning", "message": {"text": "Insecure pattern 'cors_wildcard' in src/chat-server.ts:216"}, "properties": {"repobilityId": "4ce79ffa67d15810", "scanner": "scanner-primary", "fingerprint": "7b778ad34acab37e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "cors_wildcard"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "src/chat-server.ts"}, "region": {"startLine": 216}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-3ad1891d36bc66a7", "level": "note", "message": {"text": "Very large file: src/tools.ts (2926 lines)"}, "properties": {"repobilityId": "f2f5a8c6c6866a11", "scanner": "scanner-primary", "fingerprint": "3ad1891d36bc66a7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-6893a6c8b0861585", "level": "warning", "message": {"text": "Very low test-to-source ratio"}, "properties": {"repobilityId": "54a7de3f06314bf0", "scanner": "scanner-primary", "fingerprint": "6893a6c8b0861585", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["tests", "coverage"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "40d6bd1efd260c3f", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "4d724df71f3edd2b", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "warning", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "95dd28278b46288d", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "53f1a2f4a1702044", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "86cd3fe9e539deab", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8d59dc27cdb18b60", "level": "none", "message": {"text": "Commented-code block (9 lines) in src/chat-server.ts:39"}, "properties": {"repobilityId": "ac89b5fdc003bf10", "scanner": "scanner-primary", "fingerprint": "8d59dc27cdb18b60", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-8b4201cd19a23d66", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/gemini-bridge.ts:272"}, "properties": {"repobilityId": "e146ccbc4abe7c16", "scanner": "scanner-primary", "fingerprint": "8b4201cd19a23d66", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-970aa6fcfd6e150e", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/tools.ts:696"}, "properties": {"repobilityId": "b9c6c397d301bd7e", "scanner": "scanner-primary", "fingerprint": "970aa6fcfd6e150e", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-10624c4b8bdcb960", "level": "none", "message": {"text": "Commented-code block (7 lines) in src/http-server.ts:64"}, "properties": {"repobilityId": "b4263c339dafc2c8", "scanner": "scanner-primary", "fingerprint": "10624c4b8bdcb960", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0e29fb7123dcaa87", "level": "none", "message": {"text": "Commented-code block (5 lines) in src/time.ts:47"}, "properties": {"repobilityId": "cc8f0207b2826e13", "scanner": "scanner-primary", "fingerprint": "0e29fb7123dcaa87", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-79b4c2a8b44f18b3", "level": "none", "message": {"text": "Commented-code block (8 lines) in src/oauth/metadata.ts:107"}, "properties": {"repobilityId": "83e5f7e0aa64f526", "scanner": "scanner-primary", "fingerprint": "79b4c2a8b44f18b3", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-4dae82bb769e3890", "level": "none", "message": {"text": "Commented-code block (6 lines) in src/oauth/handlers.ts:299"}, "properties": {"repobilityId": "81f9d3f1949bf74d", "scanner": "scanner-primary", "fingerprint": "4dae82bb769e3890", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-0c63a6fa59025c73", "level": "note", "message": {"text": "Unused endpoint: POST /refresh-config"}, "properties": {"repobilityId": "5ee389fa98fbef9d", "scanner": "scanner-primary", "fingerprint": "0c63a6fa59025c73", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cff8da5fbc19c76d", "level": "note", "message": {"text": "Unused endpoint: POST /chat"}, "properties": {"repobilityId": "766f4be66b6d79d5", "scanner": "scanner-primary", "fingerprint": "cff8da5fbc19c76d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2595b39638e5c045", "level": "note", "message": {"text": "Unused endpoint: GET /profile"}, "properties": {"repobilityId": "43ceb5dbc0e50c1d", "scanner": "scanner-primary", "fingerprint": "2595b39638e5c045", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-38fe8bc38bc8d2df", "level": "note", "message": {"text": "Unused endpoint: GET /wallet"}, "properties": {"repobilityId": "1f73be0229640f8c", "scanner": "scanner-primary", "fingerprint": "38fe8bc38bc8d2df", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c124716a4436518b", "level": "note", "message": {"text": "Unused endpoint: GET /reports"}, "properties": {"repobilityId": "df31adf66f0de65f", "scanner": "scanner-primary", "fingerprint": "c124716a4436518b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-80dbae2195fe259a", "level": "note", "message": {"text": "Unused endpoint: POST /calendar"}, "properties": {"repobilityId": "17f17042e1828e6e", "scanner": "scanner-primary", "fingerprint": "80dbae2195fe259a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4e60d58fe2111570", "level": "note", "message": {"text": "Unused endpoint: POST /pos"}, "properties": {"repobilityId": "ca40820080482acf", "scanner": "scanner-primary", "fingerprint": "4e60d58fe2111570", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-00cd5bee1c9f9566", "level": "note", "message": {"text": "Unused endpoint: POST /bookings"}, "properties": {"repobilityId": "3c56e5fbd6a5ca4b", "scanner": "scanner-primary", "fingerprint": "00cd5bee1c9f9566", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5b4d8b5420aeee16", "level": "note", "message": {"text": "Unused endpoint: GET /branches"}, "properties": {"repobilityId": "f10a0f1dce8b457a", "scanner": "scanner-primary", "fingerprint": "5b4d8b5420aeee16", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-785d50f121ed5854", "level": "note", "message": {"text": "Unused endpoint: POST /branches"}, "properties": {"repobilityId": "d6d36c61ee292fa5", "scanner": "scanner-primary", "fingerprint": "785d50f121ed5854", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-72fa7ed0df926aed", "level": "note", "message": {"text": "Unused endpoint: GET /branches/places/autocomplete"}, "properties": {"repobilityId": "580a18a7d218f247", "scanner": "scanner-primary", "fingerprint": "72fa7ed0df926aed", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-603824ccf0e28017", "level": "note", "message": {"text": "Unused endpoint: GET /branches/places/details"}, "properties": {"repobilityId": "d6dcba54a5d42e88", "scanner": "scanner-primary", "fingerprint": "603824ccf0e28017", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3c2566b08f9c0155", "level": "note", "message": {"text": "Unused endpoint: POST /sections"}, "properties": {"repobilityId": "323df117e7d78b29", "scanner": "scanner-primary", "fingerprint": "3c2566b08f9c0155", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a96ac013791394de", "level": "note", "message": {"text": "Unused endpoint: POST /sections/sort"}, "properties": {"repobilityId": "a5ddbdc431254f59", "scanner": "scanner-primary", "fingerprint": "a96ac013791394de", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c3dcab8cb11c2cdf", "level": "note", "message": {"text": "Unused endpoint: GET /popular-services"}, "properties": {"repobilityId": "e696ed301f3f3a9a", "scanner": "scanner-primary", "fingerprint": "c3dcab8cb11c2cdf", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c09b6d90f7fb6557", "level": "note", "message": {"text": "Unused endpoint: POST /services"}, "properties": {"repobilityId": "76d1afea0b46d707", "scanner": "scanner-primary", "fingerprint": "c09b6d90f7fb6557", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-fc445045705bb83a", "level": "note", "message": {"text": "Unused endpoint: POST /offers"}, "properties": {"repobilityId": "08367671fbfdca14", "scanner": "scanner-primary", "fingerprint": "fc445045705bb83a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4a66d271b39b318e", "level": "note", "message": {"text": "Unused endpoint: POST /employees"}, "properties": {"repobilityId": "450492715a60f40a", "scanner": "scanner-primary", "fingerprint": "4a66d271b39b318e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b3d29925dee8bcc0", "level": "note", "message": {"text": "Unused endpoint: POST /customers"}, "properties": {"repobilityId": "c0120d8b0e567d38", "scanner": "scanner-primary", "fingerprint": "b3d29925dee8bcc0", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bc4a4520105bd660", "level": "note", "message": {"text": "Unused endpoint: POST /cancellation-reasons"}, "properties": {"repobilityId": "e9bf65e60244ca57", "scanner": "scanner-primary", "fingerprint": "bc4a4520105bd660", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-b8e1cef8cdbc5f14", "level": "note", "message": {"text": "Unused endpoint: POST /cancellation-reasons/sort"}, "properties": {"repobilityId": "655a56dd6a5e8c00", "scanner": "scanner-primary", "fingerprint": "b8e1cef8cdbc5f14", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2944403e996d951e", "level": "note", "message": {"text": "Unused endpoint: POST /promo-codes"}, "properties": {"repobilityId": "d60d5823ddb20ab0", "scanner": "scanner-primary", "fingerprint": "2944403e996d951e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-078b3f8a9311d56a", "level": "note", "message": {"text": "Unused endpoint: POST /roles"}, "properties": {"repobilityId": "051eff78d295da28", "scanner": "scanner-primary", "fingerprint": "078b3f8a9311d56a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-470861e6affa876e", "level": "note", "message": {"text": "Unused endpoint: POST /reminders/reset-defaults"}, "properties": {"repobilityId": "02b5a60c74850aa1", "scanner": "scanner-primary", "fingerprint": "470861e6affa876e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ffd37dd1efcec812", "level": "note", "message": {"text": "Unused endpoint: GET /reminder-channels"}, "properties": {"repobilityId": "a1a55bfbf68ad7d7", "scanner": "scanner-primary", "fingerprint": "ffd37dd1efcec812", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-512ccb0fd0b230ba", "level": "note", "message": {"text": "Unused endpoint: GET /settings"}, "properties": {"repobilityId": "dafa25310a8e56af", "scanner": "scanner-primary", "fingerprint": "512ccb0fd0b230ba", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8a0c471ec6f27893", "level": "note", "message": {"text": "Unused endpoint: GET /google-calendar"}, "properties": {"repobilityId": "5b49165cf3bfd8ae", "scanner": "scanner-primary", "fingerprint": "8a0c471ec6f27893", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7f40c4f1d06281ce", "level": "note", "message": {"text": "Unused endpoint: GET /google-calendar/connect"}, "properties": {"repobilityId": "421f571818b7c083", "scanner": "scanner-primary", "fingerprint": "7f40c4f1d06281ce", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6cd2edf262fdcbe6", "level": "note", "message": {"text": "Unused endpoint: POST /google-calendar/disconnect"}, "properties": {"repobilityId": "9842ba5f980c8cc2", "scanner": "scanner-primary", "fingerprint": "6cd2edf262fdcbe6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-62c66056ff8b4db8", "level": "note", "message": {"text": "Unused endpoint: POST /google-calendar/calendar"}, "properties": {"repobilityId": "6415a0a9f3241335", "scanner": "scanner-primary", "fingerprint": "62c66056ff8b4db8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-0578faf02c604a46", "level": "note", "message": {"text": "Unused endpoint: POST /subscriptions"}, "properties": {"repobilityId": "7ef4a2b338e31118", "scanner": "scanner-primary", "fingerprint": "0578faf02c604a46", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f0c7f10539cc0e23", "level": "note", "message": {"text": "Unused endpoint: POST /subscriptions/pay"}, "properties": {"repobilityId": "3e354f0c81f8768d", "scanner": "scanner-primary", "fingerprint": "f0c7f10539cc0e23", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cf5ba2481bf19c5e", "level": "note", "message": {"text": "Unused endpoint: POST /subscriptions/check_is_paid"}, "properties": {"repobilityId": "27cb716f953f6b66", "scanner": "scanner-primary", "fingerprint": "cf5ba2481bf19c5e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9a0ad1e54b48b85c", "level": "note", "message": {"text": "Unused endpoint: POST /subscriptions/activate-free"}, "properties": {"repobilityId": "448c331314eb90a8", "scanner": "scanner-primary", "fingerprint": "9a0ad1e54b48b85c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-28d1e7685630a7cc", "level": "note", "message": {"text": "Unused endpoint: GET /zatca"}, "properties": {"repobilityId": "0b6f00eadc2d3c61", "scanner": "scanner-primary", "fingerprint": "28d1e7685630a7cc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9d3bbcf42778dcbe", "level": "note", "message": {"text": "Unused endpoint: POST /zatca/register"}, "properties": {"repobilityId": "ab12e6b71fe7d73b", "scanner": "scanner-primary", "fingerprint": "9d3bbcf42778dcbe", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-4fe9bb486644f008", "level": "note", "message": {"text": "Unused endpoint: POST /change-password"}, "properties": {"repobilityId": "1864f3e91ce807b6", "scanner": "scanner-primary", "fingerprint": "4fe9bb486644f008", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cb8cdd3f4d307d6c", "level": "note", "message": {"text": "Unused endpoint: POST /send-code"}, "properties": {"repobilityId": "dfa707cf0e29de97", "scanner": "scanner-primary", "fingerprint": "cb8cdd3f4d307d6c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cfa4aa0bb85992dc", "level": "note", "message": {"text": "Unused endpoint: POST /update-email"}, "properties": {"repobilityId": "7ea9503efe59fd29", "scanner": "scanner-primary", "fingerprint": "cfa4aa0bb85992dc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-df398f497209de6e", "level": "note", "message": {"text": "Unused endpoint: POST /update-phone"}, "properties": {"repobilityId": "e7d034eac305628f", "scanner": "scanner-primary", "fingerprint": "df398f497209de6e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f116bd329b6fd361", "level": "note", "message": {"text": "Unused endpoint: POST /update-profile"}, "properties": {"repobilityId": "ba61d2f1967e91b7", "scanner": "scanner-primary", "fingerprint": "f116bd329b6fd361", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5baa8971ebe192a1", "level": "note", "message": {"text": "Unused endpoint: GET /"}, "properties": {"repobilityId": "5d77588acb91b0cc", "scanner": "scanner-primary", "fingerprint": "5baa8971ebe192a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-bfd1643486ebb832", "level": "note", "message": {"text": "Unused endpoint: GET /mcp/.well-known/oauth-protected-resource"}, "properties": {"repobilityId": "132e11a6ec814dd8", "scanner": "scanner-primary", "fingerprint": "bfd1643486ebb832", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-10a1d3e929964a61", "level": "note", "message": {"text": "Unused endpoint: GET /sse/.well-known/oauth-protected-resource"}, "properties": {"repobilityId": "d36955a2a4d0fa3d", "scanner": "scanner-primary", "fingerprint": "10a1d3e929964a61", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-f97a00df2b7643a1", "level": "note", "message": {"text": "Unused endpoint: POST /oauth/register"}, "properties": {"repobilityId": "db522db4ca306aba", "scanner": "scanner-primary", "fingerprint": "f97a00df2b7643a1", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9d51ccf0f5cd9fa4", "level": "note", "message": {"text": "Unused endpoint: GET /oauth/authorize"}, "properties": {"repobilityId": "9083391770a229f8", "scanner": "scanner-primary", "fingerprint": "9d51ccf0f5cd9fa4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c68431d91d878a10", "level": "note", "message": {"text": "Unused endpoint: POST /oauth/authorize"}, "properties": {"repobilityId": "c03cc8cfff0e7ceb", "scanner": "scanner-primary", "fingerprint": "c68431d91d878a10", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-30c1225f6259028b", "level": "note", "message": {"text": "Unused endpoint: POST /oauth/token"}, "properties": {"repobilityId": "b317b28f32c6ad4a", "scanner": "scanner-primary", "fingerprint": "30c1225f6259028b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7a009b1a56794f45", "level": "note", "message": {"text": "Unused endpoint: POST /"}, "properties": {"repobilityId": "2f4346e517983343", "scanner": "scanner-primary", "fingerprint": "7a009b1a56794f45", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3b30f4c0994a30b4", "level": "note", "message": {"text": "Unused endpoint: DELETE /"}, "properties": {"repobilityId": "a70af4e245b867b7", "scanner": "scanner-primary", "fingerprint": "3b30f4c0994a30b4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}