{"version": "2.1.0", "$schema": "https://json.schemastore.org/sarif-2.1.0.json", "runs": [{"tool": {"driver": {"name": "Repobility", "informationUri": "https://repobility.com", "rules": [{"id": "scanner-96e9cc52aa3023b1", "name": "Possibly dead Python function: option_label", "shortDescription": {"text": "Possibly dead Python function: option_label"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-308451448d2e4c8f", "name": "Possibly dead Python function: refund_mwallet_payment", "shortDescription": {"text": "Possibly dead Python function: refund_mwallet_payment"}, "fullDescription": {"text": "No callers detected by AST scan in this repo. Could be exported for external callers or a framework handler."}, "properties": {"scanner": "scanner-primary", "layer": "software", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e18142a425b1a0ec", "name": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/components/JsonLd.js:12", "shortDescription": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/components/JsonLd.js:12"}, "fullDescription": {"text": "Open XSS surface unless the input is provably trusted. Replace with explicit JSX or sanitize via a vetted library.\n\nWhy: OWASP basics. Already partially flagged by the security analyzer.\nRule id: fq.dangerous-html"}, "properties": {"scanner": "scanner-primary", "layer": "frontend", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bed0996920c45fb4", "name": "Insecure pattern 'dangerous_innerhtml' in frontend/components/JsonLd.js:12", "shortDescription": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/components/JsonLd.js:12"}, "fullDescription": {"text": "Found a known-risky pattern (dangerous_innerhtml). Review and replace if possible."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d47c8ba1b3fc9dd5", "name": "Possible secret in backend/seed_data.py", "shortDescription": {"text": "Possible secret in backend/seed_data.py"}, "fullDescription": {"text": "Detected pattern matching password_literal. Rotate the credential and move to a secret manager."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "critical", "confidence": 1.0}}, {"id": "scanner-4601e3ad3bb28677", "name": "No CI/CD pipelines detected", "shortDescription": {"text": "No CI/CD pipelines detected"}, "fullDescription": {"text": "No GitHub Actions, GitLab CI, or CircleCI configs found. Without CI you can't gate deploys on tests/lints."}, "properties": {"scanner": "scanner-primary", "layer": "cicd", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-422329f5384e96c0", "name": "Very large file: frontend/app/games/[slug]/[categorySlug]/GameCategoryClient.js (1280 lines)", "shortDescription": {"text": "Very large file: frontend/app/games/[slug]/[categorySlug]/GameCategoryClient.js (1280 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-4982c2d8a95c5d1f", "name": "Very large file: backend/core/serializers.py (1668 lines)", "shortDescription": {"text": "Very large file: backend/core/serializers.py (1668 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-713324b6b2bd6a22", "name": "Very large file: backend/core/views.py (4599 lines)", "shortDescription": {"text": "Very large file: backend/core/views.py (4599 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-981741a5a6b795f9", "name": "Very large file: backend/core/services.py (1594 lines)", "shortDescription": {"text": "Very large file: backend/core/services.py (1594 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ee4b6c023fc85b15", "name": "Very large file: backend/core/tests.py (9942 lines)", "shortDescription": {"text": "Very large file: backend/core/tests.py (9942 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-b6cb038b727b58a9", "name": "Very large file: backend/core/models.py (1325 lines)", "shortDescription": {"text": "Very large file: backend/core/models.py (1325 lines)"}, "fullDescription": {"text": "Files with >800 lines often hide complexity hotspots and discourage tests."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ea3b5e389d8c9c0f", "name": "Low test-to-source ratio", "shortDescription": {"text": "Low test-to-source ratio"}, "fullDescription": {"text": "19 tests / 185 src (ratio 0.10)."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-141b30a41e03817b", "name": "No license file detected", "shortDescription": {"text": "No license file detected"}, "fullDescription": {"text": "No LICENSE/COPYING/NOTICE file was found. Generated repositories often omit licensing, which blocks reuse and automated intake."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3ab5d313dda8e5f9", "name": "Debug logging residue appears in source files", "shortDescription": {"text": "Debug logging residue appears in source files"}, "fullDescription": {"text": "Found 30 console/debugger/print-style debug statements in non-test source. This is a common fast-generation residue before production cleanup."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-72b2a6250083a784", "name": "Placeholder or mock-heavy implementation detected", "shortDescription": {"text": "Placeholder or mock-heavy implementation detected"}, "fullDescription": {"text": "Found 71 placeholder/mock markers across 24 source files. This often means the repo looks complete while core flows still use generated scaffolding or fake data."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2d0c7b7ab8f8aacf", "name": "Critical user flow still appears backed by mock or placeholder data", "shortDescription": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "fullDescription": {"text": "A payment/auth/admin/order/billing-style flow contains mock, fake, TODO, dummy, or placeholder markers in runtime source. In the Fable corpus this is a high-leverage completeness smell: the app can look finished while the money, identity, or tenant flow is still scaffolded."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-b9088664ace7f748", "name": "Composite production-readiness gap", "shortDescription": {"text": "Composite production-readiness gap"}, "fullDescription": {"text": "Multiple low-cost hardening controls are missing together: license, ci. Opus verification showed these co-occurring gaps are a better readiness signal than reading each flag in isolation."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-749d4bc1bd66df5f", "name": "Agent instructions exist but release-hardening basics are missing", "shortDescription": {"text": "Agent instructions exist but release-hardening basics are missing"}, "fullDescription": {"text": "AI-coder instruction files were found, but the repo is missing license, ci. Treat this as a contract gap: the agent is guided, but the generated output is not yet guarded by the controls that make it repeatable."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ea8f3013f588db25", "name": "Shallow git history limits provenance confidence", "shortDescription": {"text": "Shallow git history limits provenance confidence"}, "fullDescription": {"text": "The repository is a shallow clone. Origin/evolution analysis cannot distinguish fresh generation, imported legacy code, or long-lived human code with high confidence."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8424db9c75e04ba4", "name": "Very short observed git history", "shortDescription": {"text": "Very short observed git history"}, "fullDescription": {"text": "The repo has multiple source files but two or fewer visible commits. This is not a failure by itself, but it lowers confidence in evolution-based diagnosis."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-a223d65791dcfdbb", "name": "Commented-code block (5 lines) in frontend/components/Analytics.js:10", "shortDescription": {"text": "Commented-code block (5 lines) in frontend/components/Analytics.js:10"}, "fullDescription": {"text": "A long run of `//` or `#` lines usually means abandoned code. Delete or move to git history. Keeps the canvas + dead-code detection honest."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "info", "confidence": 1.0}}, {"id": "scanner-b1dadd78ce41e9d7", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app/sitemap.js:20", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app/sitemap.js:20"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-bc104d1d1028fb2d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app/games/[slug]/[categorySlug]/page.js:20", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app/games/[slug]/[categorySlug]/page.js:20"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-09789390165b011d", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app/games/[slug]/[categorySlug]/GameCategoryClient.js:158", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app/games/[slug]/[categorySlug]/GameCategoryClient.js:158"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c2fb1703ad3357c", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app/games/[slug]/[categorySlug]/layout.js:11", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app/games/[slug]/[categorySlug]/layout.js:11"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ce6e36f835239bfe", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/lib/auth.js:34", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/lib/auth.js:34"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-d5fa578abf86a5f0", "name": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/lib/api.js:41", "shortDescription": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/lib/api.js:41"}, "fullDescription": {"text": "Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-940d5040285dbec5", "name": "Legacy-named symbol `list_objects_v2` in deploy/backup_db.py:46", "shortDescription": {"text": "Legacy-named symbol `list_objects_v2` in deploy/backup_db.py:46"}, "fullDescription": {"text": "Names with suffixes like `_old`, `_v1`, `_deprecated` usually indicate replaced-but-not-removed code (typical AI-coder leftover). Confirm and delete, or rename if it's the active version."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-30cdd436ba5f879d", "name": "Network/subprocess call without timeout or try/except \u2014 deploy/backup_db.py:27", "shortDescription": {"text": "Network/subprocess call without timeout or try/except \u2014 deploy/backup_db.py:27"}, "fullDescription": {"text": "`subprocess.run(...)` here lacks both a `timeout=` arg and an enclosing try/except. This is exactly the class of bug that took down our git-clone earlier (HTTP/2 stream cancel surfaced as a fatal). Add a `timeout=` and wrap in try/except, or use a wrapper that retries."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ffa886e0862584dc", "name": "Likely N+1 query: `for order in \u2026` triggers a query per row \u2014 backend/core/views.py:2646", "shortDescription": {"text": "Likely N+1 query: `for order in \u2026` triggers a query per row \u2014 backend/core/views.py:2646"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `order.buyer.username` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-0a1bd3f709832fb5", "name": "Likely N+1 query: `for gc in \u2026` triggers a query per row \u2014 backend/core/views.py:4160", "shortDescription": {"text": "Likely N+1 query: `for gc in \u2026` triggers a query per row \u2014 backend/core/views.py:4160"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `gc.game.icon` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-e94984c708bf6ec3", "name": "Likely N+1 query: `for user in \u2026` triggers a query per row \u2014 backend/core/tests.py:4933", "shortDescription": {"text": "Likely N+1 query: `for user in \u2026` triggers a query per row \u2014 backend/core/tests.py:4933"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `user.profile.seller_status` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-379465faf6cf7a43", "name": "Likely N+1 query: `for sibling in \u2026` triggers a query per row \u2014 backend/core/models.py:199", "shortDescription": {"text": "Likely N+1 query: `for sibling in \u2026` triggers a query per row \u2014 backend/core/models.py:199"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `sibling.category.slug` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9f19447e4c6f103b", "name": "Likely N+1 query: `for gcf in \u2026` triggers a query per row \u2014 backend/core/management/commands/copy_category_filters.py:46", "shortDescription": {"text": "Likely N+1 query: `for gcf in \u2026` triggers a query per row \u2014 backend/core/management/commands/copy_category_filters.py:46"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `gcf.visible_when_options.all` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-ec91c668f79d8425", "name": "Likely N+1 query: `for target in \u2026` triggers a query per row \u2014 backend/core/management/commands/copy_category_filters.py", "shortDescription": {"text": "Likely N+1 query: `for target in \u2026` triggers a query per row \u2014 backend/core/management/commands/copy_category_filters.py:68"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `target.assigned_filters.all` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-6c472e326d71d147", "name": "Likely N+1 query: `for gcf in \u2026` triggers a query per row \u2014 backend/core/management/commands/copy_category_filters.py:74", "shortDescription": {"text": "Likely N+1 query: `for gcf in \u2026` triggers a query per row \u2014 backend/core/management/commands/copy_category_filters.py:74"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `gcf.visible_when_options.all` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-53c0e0f1354a45f2", "name": "Likely N+1 query: `for gc in \u2026` triggers a query per row \u2014 backend/core/management/commands/export_catalog.py:32", "shortDescription": {"text": "Likely N+1 query: `for gc in \u2026` triggers a query per row \u2014 backend/core/management/commands/export_catalog.py:32"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `gc.game.name` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-9f66e2ac92d46c2b", "name": "Likely N+1 query: `for gcf in \u2026` triggers a query per row \u2014 backend/core/migrations/0052_gamecategoryfilter_visible_when", "shortDescription": {"text": "Likely N+1 query: `for gcf in \u2026` triggers a query per row \u2014 backend/core/migrations/0052_gamecategoryfilter_visible_when_options_m2m.py:7"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `gcf.visible_when_options.add` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-dbc197cca13c60ab", "name": "Likely N+1 query: `for gcf in \u2026` triggers a query per row \u2014 backend/core/migrations/0052_gamecategoryfilter_visible_when", "shortDescription": {"text": "Likely N+1 query: `for gcf in \u2026` triggers a query per row \u2014 backend/core/migrations/0052_gamecategoryfilter_visible_when_options_m2m.py:13"}, "fullDescription": {"text": "The loop iterates a Django queryset and accesses `gcf.visible_when_options.order_by` per row, which fires an additional database query each iteration. Add `.select_related('<fk_field>')` for FK / O2O relations or `.prefetch_related('<m2m_or_reverse>')` for many-related lookups, to load everything in 1-2 queries instead of N."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-2c04133e54348533", "name": "Near-duplicate function bodies in 2 places", "shortDescription": {"text": "Near-duplicate function bodies in 2 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/core/serializers.py:get_listing_count, backend/core/serializers.py:get_listing_count\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-fe1d9311d6aee734", "name": "Near-duplicate function bodies in 12 places", "shortDescription": {"text": "Near-duplicate function bodies in 12 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/core/serializers.py:validate_accepted_terms, backend/core/serializers.py:validate, backend/core/serializers.py:validate, backend/core/serializers.py:validate\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-76e04eba8bce3620", "name": "Near-duplicate function bodies in 30 places", "shortDescription": {"text": "Near-duplicate function bodies in 30 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/core/views.py:get_throttles, backend/core/views.py:get, backend/core/views.py:get, backend/core/views.py:get\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6718a631ead09376", "name": "Near-duplicate function bodies in 38 places", "shortDescription": {"text": "Near-duplicate function bodies in 38 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/core/views.py:post, backend/core/views.py:post, backend/core/views.py:post, backend/core/views.py:post\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-49c98f7cedd9c977", "name": "Near-duplicate function bodies in 4 places", "shortDescription": {"text": "Near-duplicate function bodies in 4 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/core/views.py:put, backend/core/views.py:put, backend/core/views.py:put, backend/core/views.py:put\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-be46ea126aa5d8dc", "name": "Near-duplicate function bodies in 3 places", "shortDescription": {"text": "Near-duplicate function bodies in 3 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/core/views.py:delete, backend/core/views.py:delete, backend/core/views.py:delete\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-02525d39071dd2c7", "name": "Near-duplicate function bodies in 5 places", "shortDescription": {"text": "Near-duplicate function bodies in 5 places"}, "fullDescription": {"text": "Functions with the same first-5-line body hash:\nbackend/core/admin.py:save_model, backend/core/admin.py:save_model, backend/core/admin.py:save_model, backend/core/admin.py:save_model\n\nThis is *the* AI-coder failure mode (4\u00d7 more duplication in vibe-coded repos \u2014 see https://jw.hn/ai-code-hygiene). Consolidate or document why they're separate."}, "properties": {"scanner": "scanner-primary", "layer": "quality", "severity": "low", "confidence": 1.0}}, {"id": "scanner-78cc082bf431d0eb", "name": "Django view `request_origin_cache_scope` may be unauthenticated \u2014 backend/core/views.py:149", "shortDescription": {"text": "Django view `request_origin_cache_scope` may be unauthenticated \u2014 backend/core/views.py:149"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-369a94c1b1467222", "name": "Django view `game_list_cache_key` may be unauthenticated \u2014 backend/core/views.py:153", "shortDescription": {"text": "Django view `game_list_cache_key` may be unauthenticated \u2014 backend/core/views.py:153"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-52a2455fc956a267", "name": "Django view `has_valid_private_media_ticket` may be unauthenticated \u2014 backend/core/views.py:192", "shortDescription": {"text": "Django view `has_valid_private_media_ticket` may be unauthenticated \u2014 backend/core/views.py:192"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-461bceb7b9e5fc2e", "name": "Django view `get_pagination_params` may be unauthenticated \u2014 backend/core/views.py:288", "shortDescription": {"text": "Django view `get_pagination_params` may be unauthenticated \u2014 backend/core/views.py:288"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-be2d2528da2aa6e3", "name": "Django view `get_before_id` may be unauthenticated \u2014 backend/core/views.py:315", "shortDescription": {"text": "Django view `get_before_id` may be unauthenticated \u2014 backend/core/views.py:315"}, "fullDescription": {"text": "Function-view with `request` parameter has no `@login_required` or equivalent auth decorator within 5 lines above. If auth is enforced by middleware (`AUTHENTICATION_BACKENDS`), this is a false positive \u2014 dismiss with reason `by_design`."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-303d143032b4cfe8", "name": "Django CBV `RefreshTokenView` lacks `LoginRequiredMixin` \u2014 backend/core/views.py:964", "shortDescription": {"text": "Django CBV `RefreshTokenView` lacks `LoginRequiredMixin` \u2014 backend/core/views.py:964"}, "fullDescription": {"text": "Class-based view defines mutating methods (post/put/delete) without inheriting `LoginRequiredMixin`. If auth is enforced via `dispatch()` override or middleware, dismiss this finding."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "medium", "confidence": 1.0}}, {"id": "scanner-77ed1a58e38aeee0", "name": "DRF view `ListingDetailView` declares no `permission_classes` \u2014 backend/core/views.py:1874", "shortDescription": {"text": "DRF view `ListingDetailView` declares no `permission_classes` \u2014 backend/core/views.py:1874"}, "fullDescription": {"text": "DRF defaults to AllowAny when `permission_classes` is unset, exposing the endpoint publicly. Add `permission_classes = [IsAuthenticated]` (or stricter) at class level, or set `DEFAULT_PERMISSION_CLASSES` in settings."}, "properties": {"scanner": "scanner-primary", "layer": "security", "severity": "high", "confidence": 1.0}}, {"id": "scanner-7309bf2446873ccc", "name": "Unused endpoint: ANY /admin/", "shortDescription": {"text": "Unused endpoint: ANY /admin/"}, "fullDescription": {"text": "`backend/gamesbazaar/urls.py` declares `ANY /admin/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ce0a9b4397331ef4", "name": "Unused endpoint: ANY /api/", "shortDescription": {"text": "Unused endpoint: ANY /api/"}, "fullDescription": {"text": "`backend/gamesbazaar/urls.py` declares `ANY /api/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a7ab6f136f143890", "name": "Unused endpoint: ANY /^media/(?P<path>.*)$", "shortDescription": {"text": "Unused endpoint: ANY /^media/(?P<path>.*)$"}, "fullDescription": {"text": "`backend/gamesbazaar/urls.py` declares `ANY /^media/(?P<path>.*)$` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-35e9e406f6f4537e", "name": "Unused endpoint: ANY /api/home/popular/", "shortDescription": {"text": "Unused endpoint: ANY /api/home/popular/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/home/popular/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-540c1859b66bd00a", "name": "Unused endpoint: ANY /api/games/", "shortDescription": {"text": "Unused endpoint: ANY /api/games/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/games/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8ab130762c8660b5", "name": "Unused endpoint: ANY /api/games/<slug:slug>/", "shortDescription": {"text": "Unused endpoint: ANY /api/games/<slug:slug>/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/games/<slug:slug>/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-babe4fffd2129ba8", "name": "Unused endpoint: ANY /api/games/<slug:game_slug>/<slug:category_slug>/", "shortDescription": {"text": "Unused endpoint: ANY /api/games/<slug:game_slug>/<slug:category_slug>/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/games/<slug:game_slug>/<slug:category_slug>/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-2b9ab53458f72d57", "name": "Unused endpoint: ANY /api/auth/register/", "shortDescription": {"text": "Unused endpoint: ANY /api/auth/register/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/auth/register/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8548e6d2f5846242", "name": "Unused endpoint: ANY /api/auth/verify-email/", "shortDescription": {"text": "Unused endpoint: ANY /api/auth/verify-email/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/auth/verify-email/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-5d9aa3d6c8390e4f", "name": "Unused endpoint: ANY /api/auth/resend-verification/", "shortDescription": {"text": "Unused endpoint: ANY /api/auth/resend-verification/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/auth/resend-verification/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-36cdb7f9351bcef6", "name": "Unused endpoint: ANY /api/auth/login/", "shortDescription": {"text": "Unused endpoint: ANY /api/auth/login/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/auth/login/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-11ee291d2e100a5f", "name": "Unused endpoint: ANY /api/auth/refresh/", "shortDescription": {"text": "Unused endpoint: ANY /api/auth/refresh/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/auth/refresh/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-e0f4083d667c135a", "name": "Unused endpoint: ANY /api/auth/logout/", "shortDescription": {"text": "Unused endpoint: ANY /api/auth/logout/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/auth/logout/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-69f11e4f376a4fc2", "name": "Unused endpoint: ANY /api/auth/me/", "shortDescription": {"text": "Unused endpoint: ANY /api/auth/me/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/auth/me/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6ee9a66cbe83716c", "name": "Unused endpoint: ANY /api/auth/google/", "shortDescription": {"text": "Unused endpoint: ANY /api/auth/google/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/auth/google/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-c074f38c28eabcce", "name": "Unused endpoint: ANY /api/auth/profile/", "shortDescription": {"text": "Unused endpoint: ANY /api/auth/profile/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/auth/profile/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-65daacbfab797f3a", "name": "Unused endpoint: ANY /api/auth/complete-profile/", "shortDescription": {"text": "Unused endpoint: ANY /api/auth/complete-profile/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/auth/complete-profile/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7eb648e1aa704a2b", "name": "Unused endpoint: ANY /api/auth/password/", "shortDescription": {"text": "Unused endpoint: ANY /api/auth/password/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/auth/password/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-ad0d411a7a33fe37", "name": "Unused endpoint: ANY /api/auth/password/reset-request/", "shortDescription": {"text": "Unused endpoint: ANY /api/auth/password/reset-request/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/auth/password/reset-request/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3a5b8dd0e4899042", "name": "Unused endpoint: ANY /api/auth/password/reset-confirm/", "shortDescription": {"text": "Unused endpoint: ANY /api/auth/password/reset-confirm/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/auth/password/reset-confirm/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-da7cc5a656a0d622", "name": "Unused endpoint: ANY /api/auth/avatar/", "shortDescription": {"text": "Unused endpoint: ANY /api/auth/avatar/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/auth/avatar/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-eb3e44ec641d3b4c", "name": "Unused endpoint: ANY /api/auth/email/request-change/", "shortDescription": {"text": "Unused endpoint: ANY /api/auth/email/request-change/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/auth/email/request-change/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-702b00ed0467aa14", "name": "Unused endpoint: ANY /api/auth/email/confirm-change/", "shortDescription": {"text": "Unused endpoint: ANY /api/auth/email/confirm-change/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/auth/email/confirm-change/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-19ca78368f523217", "name": "Unused endpoint: ANY /api/seller/apply/", "shortDescription": {"text": "Unused endpoint: ANY /api/seller/apply/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/seller/apply/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-901a7d8fc77bacfe", "name": "Unused endpoint: ANY /api/seller/status/", "shortDescription": {"text": "Unused endpoint: ANY /api/seller/status/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/seller/status/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8e8141f581e46f02", "name": "Unused endpoint: ANY /api/seller/dashboard/", "shortDescription": {"text": "Unused endpoint: ANY /api/seller/dashboard/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/seller/dashboard/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6e123de7d638ccc3", "name": "Unused endpoint: ANY /api/listings/", "shortDescription": {"text": "Unused endpoint: ANY /api/listings/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/listings/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-78873108c2165740", "name": "Unused endpoint: ANY /api/listings/mine/", "shortDescription": {"text": "Unused endpoint: ANY /api/listings/mine/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/listings/mine/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-d2c4092f33e58b40", "name": "Unused endpoint: ANY /api/listings/<int:pk>/restock/", "shortDescription": {"text": "Unused endpoint: ANY /api/listings/<int:pk>/restock/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/listings/<int:pk>/restock/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-94cf46cab9f95176", "name": "Unused endpoint: ANY /api/listings/<int:pk>/stock/", "shortDescription": {"text": "Unused endpoint: ANY /api/listings/<int:pk>/stock/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/listings/<int:pk>/stock/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7c2cf56cfc6ae9d9", "name": "Unused endpoint: ANY /api/listings/<int:pk>/", "shortDescription": {"text": "Unused endpoint: ANY /api/listings/<int:pk>/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/listings/<int:pk>/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-18b18d881ac99b9a", "name": "Unused endpoint: ANY /api/chat/", "shortDescription": {"text": "Unused endpoint: ANY /api/chat/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/chat/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9a822d93955bc7ff", "name": "Unused endpoint: ANY /api/chat/start/", "shortDescription": {"text": "Unused endpoint: ANY /api/chat/start/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/chat/start/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-87e3ced1431e35cc", "name": "Unused endpoint: ANY /api/chat/unread/", "shortDescription": {"text": "Unused endpoint: ANY /api/chat/unread/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/chat/unread/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a334543868d7230a", "name": "Unused endpoint: ANY /api/chat/inbox/ws-ticket/", "shortDescription": {"text": "Unused endpoint: ANY /api/chat/inbox/ws-ticket/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/chat/inbox/ws-ticket/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-3d2befa5babb06ce", "name": "Unused endpoint: ANY /api/chat/<int:pk>/", "shortDescription": {"text": "Unused endpoint: ANY /api/chat/<int:pk>/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/chat/<int:pk>/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-962b9cca747a2e48", "name": "Unused endpoint: ANY /api/chat/<int:pk>/ws-ticket/", "shortDescription": {"text": "Unused endpoint: ANY /api/chat/<int:pk>/ws-ticket/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/chat/<int:pk>/ws-ticket/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-480204757f08c625", "name": "Unused endpoint: ANY /api/chat/<int:pk>/send/", "shortDescription": {"text": "Unused endpoint: ANY /api/chat/<int:pk>/send/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/chat/<int:pk>/send/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-a6a1a087268c9f06", "name": "Unused endpoint: ANY /api/chat/<int:pk>/send-image/", "shortDescription": {"text": "Unused endpoint: ANY /api/chat/<int:pk>/send-image/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/chat/<int:pk>/send-image/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9256961f51f78088", "name": "Unused endpoint: ANY /api/chat/messages/<int:pk>/image/", "shortDescription": {"text": "Unused endpoint: ANY /api/chat/messages/<int:pk>/image/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/chat/messages/<int:pk>/image/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cb9516251750ed1a", "name": "Unused endpoint: ANY /api/heartbeat/", "shortDescription": {"text": "Unused endpoint: ANY /api/heartbeat/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/heartbeat/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-8c16d1c1de315977", "name": "Unused endpoint: ANY /api/wallet/", "shortDescription": {"text": "Unused endpoint: ANY /api/wallet/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/wallet/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-64f632a5e942f032", "name": "Unused endpoint: ANY /api/wallet/transactions/", "shortDescription": {"text": "Unused endpoint: ANY /api/wallet/transactions/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/wallet/transactions/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-9fd9a6069effbf2d", "name": "Unused endpoint: ANY /api/wallet/held-orders/", "shortDescription": {"text": "Unused endpoint: ANY /api/wallet/held-orders/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/wallet/held-orders/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-518836d622b28ac7", "name": "Unused endpoint: ANY /api/wallet/top-up/", "shortDescription": {"text": "Unused endpoint: ANY /api/wallet/top-up/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/wallet/top-up/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-1793acdb7b8d27c9", "name": "Unused endpoint: ANY /api/wallet/top-up/<int:pk>/proof/", "shortDescription": {"text": "Unused endpoint: ANY /api/wallet/top-up/<int:pk>/proof/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/wallet/top-up/<int:pk>/proof/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-7df672763c65b5cb", "name": "Unused endpoint: ANY /api/wallet/withdraw/", "shortDescription": {"text": "Unused endpoint: ANY /api/wallet/withdraw/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/wallet/withdraw/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-cf6bd9d30401f527", "name": "Unused endpoint: ANY /api/wallet/withdraw/<int:pk>/receipt/", "shortDescription": {"text": "Unused endpoint: ANY /api/wallet/withdraw/<int:pk>/receipt/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/wallet/withdraw/<int:pk>/receipt/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-84ae7fabd29369b6", "name": "Unused endpoint: ANY /api/payments/jazzcash/top-up/", "shortDescription": {"text": "Unused endpoint: ANY /api/payments/jazzcash/top-up/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/payments/jazzcash/top-up/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}, {"id": "scanner-6c1d92fd31d403ce", "name": "Unused endpoint: ANY /api/payments/jazzcash/buy/", "shortDescription": {"text": "Unused endpoint: ANY /api/payments/jazzcash/buy/"}, "fullDescription": {"text": "`backend/core/urls.py` declares `ANY /api/payments/jazzcash/buy/` but no frontend code we scanned calls it. This is fine if the endpoint serves external clients (mobile app, third-party, server-side webhooks). Otherwise it's dead code \u2014 consider removing or documenting who consumes it."}, "properties": {"scanner": "scanner-primary", "layer": "api", "severity": "low", "confidence": 1.0}}]}}, "automationDetails": {"id": "repobility/19399"}, "properties": {"repository": "ShanuX69420/GAMESBAZAARV6", "repoUrl": "https://github.com/ShanuX69420/GAMESBAZAARV6", "branch": "main"}, "results": [{"ruleId": "scanner-96e9cc52aa3023b1", "level": "note", "message": {"text": "Possibly dead Python function: option_label"}, "properties": {"repobilityId": "2de065868110ff7c", "scanner": "scanner-primary", "fingerprint": "96e9cc52aa3023b1", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/seed_data.py:605"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-308451448d2e4c8f", "level": "note", "message": {"text": "Possibly dead Python function: refund_mwallet_payment"}, "properties": {"repobilityId": "a6e89273e9892191", "scanner": "scanner-primary", "fingerprint": "308451448d2e4c8f", "layer": "software", "severity": "low", "confidence": 1.0, "tags": ["dead-code"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/core/jazzcash.py:212"}, "region": {"startLine": 1}}}]}, {"ruleId": "scanner-e18142a425b1a0ec", "level": "warning", "message": {"text": "`dangerouslySetInnerHTML` used in a React component \u2014 frontend/components/JsonLd.js:12"}, "properties": {"repobilityId": "9b2ac1f1c8d9e358", "scanner": "scanner-primary", "fingerprint": "e18142a425b1a0ec", "layer": "frontend", "severity": "medium", "confidence": 1.0, "tags": ["frontend-quality", "fq.dangerous-html"]}}, {"ruleId": "scanner-bed0996920c45fb4", "level": "warning", "message": {"text": "Insecure pattern 'dangerous_innerhtml' in frontend/components/JsonLd.js:12"}, "properties": {"repobilityId": "a6b1bd647680ca4f", "scanner": "scanner-primary", "fingerprint": "bed0996920c45fb4", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["owasp", "dangerous_innerhtml"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "frontend/components/JsonLd.js"}, "region": {"startLine": 12}}}]}, {"ruleId": "scanner-d47c8ba1b3fc9dd5", "level": "error", "message": {"text": "Possible secret in backend/seed_data.py"}, "properties": {"repobilityId": "eeb3142f4621e993", "scanner": "scanner-primary", "fingerprint": "d47c8ba1b3fc9dd5", "layer": "security", "severity": "critical", "confidence": 1.0, "tags": ["secrets"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/seed_data.py"}, "region": {"startLine": 40}}}]}, {"ruleId": "scanner-4601e3ad3bb28677", "level": "warning", "message": {"text": "No CI/CD pipelines detected"}, "properties": {"repobilityId": "c3ee439bce2bc51e", "scanner": "scanner-primary", "fingerprint": "4601e3ad3bb28677", "layer": "cicd", "severity": "medium", "confidence": 1.0, "tags": ["coverage"]}}, {"ruleId": "scanner-422329f5384e96c0", "level": "note", "message": {"text": "Very large file: frontend/app/games/[slug]/[categorySlug]/GameCategoryClient.js (1280 lines)"}, "properties": {"repobilityId": "41a4788fa33c2bde", "scanner": "scanner-primary", "fingerprint": "422329f5384e96c0", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-4982c2d8a95c5d1f", "level": "note", "message": {"text": "Very large file: backend/core/serializers.py (1668 lines)"}, "properties": {"repobilityId": "e48f223df4133e96", "scanner": "scanner-primary", "fingerprint": "4982c2d8a95c5d1f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-713324b6b2bd6a22", "level": "note", "message": {"text": "Very large file: backend/core/views.py (4599 lines)"}, "properties": {"repobilityId": "c4e254aeb2ff96b1", "scanner": "scanner-primary", "fingerprint": "713324b6b2bd6a22", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-981741a5a6b795f9", "level": "note", "message": {"text": "Very large file: backend/core/services.py (1594 lines)"}, "properties": {"repobilityId": "2c21c8ece6101676", "scanner": "scanner-primary", "fingerprint": "981741a5a6b795f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ee4b6c023fc85b15", "level": "note", "message": {"text": "Very large file: backend/core/tests.py (9942 lines)"}, "properties": {"repobilityId": "b5c1db6977af93c1", "scanner": "scanner-primary", "fingerprint": "ee4b6c023fc85b15", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-b6cb038b727b58a9", "level": "note", "message": {"text": "Very large file: backend/core/models.py (1325 lines)"}, "properties": {"repobilityId": "713ac2667be977eb", "scanner": "scanner-primary", "fingerprint": "b6cb038b727b58a9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["complexity"]}}, {"ruleId": "scanner-ea3b5e389d8c9c0f", "level": "note", "message": {"text": "Low test-to-source ratio"}, "properties": {"repobilityId": "ef7b2552cc00a375", "scanner": "scanner-primary", "fingerprint": "ea3b5e389d8c9c0f", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["tests"]}}, {"ruleId": "scanner-141b30a41e03817b", "level": "note", "message": {"text": "No license file detected"}, "properties": {"repobilityId": "45c832d8a7cc7c51", "scanner": "scanner-primary", "fingerprint": "141b30a41e03817b", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["license", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-3ab5d313dda8e5f9", "level": "note", "message": {"text": "Debug logging residue appears in source files"}, "properties": {"repobilityId": "a1b872d308860cab", "scanner": "scanner-primary", "fingerprint": "3ab5d313dda8e5f9", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["debug", "cleanup", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-72b2a6250083a784", "level": "warning", "message": {"text": "Placeholder or mock-heavy implementation detected"}, "properties": {"repobilityId": "5252b3159b25bee8", "scanner": "scanner-primary", "fingerprint": "72b2a6250083a784", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "incomplete", "generated-repo-pattern"]}}, {"ruleId": "scanner-2d0c7b7ab8f8aacf", "level": "warning", "message": {"text": "Critical user flow still appears backed by mock or placeholder data"}, "properties": {"repobilityId": "154c8d0aa46523e7", "scanner": "scanner-primary", "fingerprint": "2d0c7b7ab8f8aacf", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["placeholder", "mock-data", "critical-flow", "generated-repo-pattern"]}}, {"ruleId": "scanner-b9088664ace7f748", "level": "note", "message": {"text": "Composite production-readiness gap"}, "properties": {"repobilityId": "39f094a1f811e066", "scanner": "scanner-primary", "fingerprint": "b9088664ace7f748", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["production-readiness", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-749d4bc1bd66df5f", "level": "warning", "message": {"text": "Agent instructions exist but release-hardening basics are missing"}, "properties": {"repobilityId": "1ca8e0064f47518a", "scanner": "scanner-primary", "fingerprint": "749d4bc1bd66df5f", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["agent-instructions", "repo-hardening", "generated-repo-pattern"]}}, {"ruleId": "scanner-ea8f3013f588db25", "level": "note", "message": {"text": "Shallow git history limits provenance confidence"}, "properties": {"repobilityId": "768b018019a58287", "scanner": "scanner-primary", "fingerprint": "ea8f3013f588db25", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-8424db9c75e04ba4", "level": "none", "message": {"text": "Very short observed git history"}, "properties": {"repobilityId": "645290f07f729666", "scanner": "scanner-primary", "fingerprint": "8424db9c75e04ba4", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["provenance", "git-history", "generated-repo-pattern"]}}, {"ruleId": "scanner-a223d65791dcfdbb", "level": "none", "message": {"text": "Commented-code block (5 lines) in frontend/components/Analytics.js:10"}, "properties": {"repobilityId": "34ae8fa05a8eb688", "scanner": "scanner-primary", "fingerprint": "a223d65791dcfdbb", "layer": "quality", "severity": "info", "confidence": 1.0, "tags": ["integrity", "commented-code", "dead-code"]}}, {"ruleId": "scanner-b1dadd78ce41e9d7", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app/sitemap.js:20"}, "properties": {"repobilityId": "18fdbe74910ac06b", "scanner": "scanner-primary", "fingerprint": "b1dadd78ce41e9d7", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-bc104d1d1028fb2d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app/games/[slug]/[categorySlug]/page.js:20"}, "properties": {"repobilityId": "b81ec35a27ca41eb", "scanner": "scanner-primary", "fingerprint": "bc104d1d1028fb2d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-09789390165b011d", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app/games/[slug]/[categorySlug]/GameCategoryClient.js:158"}, "properties": {"repobilityId": "73c5e10fa252cdbc", "scanner": "scanner-primary", "fingerprint": "09789390165b011d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-2c2fb1703ad3357c", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/app/games/[slug]/[categorySlug]/layout.js:11"}, "properties": {"repobilityId": "4875a6778506e2f2", "scanner": "scanner-primary", "fingerprint": "2c2fb1703ad3357c", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ce6e36f835239bfe", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/lib/auth.js:34"}, "properties": {"repobilityId": "8c8c9d50579702df", "scanner": "scanner-primary", "fingerprint": "ce6e36f835239bfe", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-d5fa578abf86a5f0", "level": "warning", "message": {"text": "`fetch()` without try/.catch or AbortSignal \u2014 frontend/lib/api.js:41"}, "properties": {"repobilityId": "f4a04b20ede3c46c", "scanner": "scanner-primary", "fingerprint": "d5fa578abf86a5f0", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-940d5040285dbec5", "level": "note", "message": {"text": "Legacy-named symbol `list_objects_v2` in deploy/backup_db.py:46"}, "properties": {"repobilityId": "1af30b4f0e2d2bef", "scanner": "scanner-primary", "fingerprint": "940d5040285dbec5", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "legacy-marker", "dead-code"]}}, {"ruleId": "scanner-30cdd436ba5f879d", "level": "warning", "message": {"text": "Network/subprocess call without timeout or try/except \u2014 deploy/backup_db.py:27"}, "properties": {"repobilityId": "4430d23eaa9dac94", "scanner": "scanner-primary", "fingerprint": "30cdd436ba5f879d", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "fragile-runtime", "robustness"]}}, {"ruleId": "scanner-ffa886e0862584dc", "level": "warning", "message": {"text": "Likely N+1 query: `for order in \u2026` triggers a query per row \u2014 backend/core/views.py:2646"}, "properties": {"repobilityId": "0cff8440b0787c9b", "scanner": "scanner-primary", "fingerprint": "ffa886e0862584dc", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/core/views.py"}, "region": {"startLine": 2646}}}]}, {"ruleId": "scanner-0a1bd3f709832fb5", "level": "warning", "message": {"text": "Likely N+1 query: `for gc in \u2026` triggers a query per row \u2014 backend/core/views.py:4160"}, "properties": {"repobilityId": "a099c71171123ebf", "scanner": "scanner-primary", "fingerprint": "0a1bd3f709832fb5", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/core/views.py"}, "region": {"startLine": 4160}}}]}, {"ruleId": "scanner-e94984c708bf6ec3", "level": "warning", "message": {"text": "Likely N+1 query: `for user in \u2026` triggers a query per row \u2014 backend/core/tests.py:4933"}, "properties": {"repobilityId": "71579c421d961657", "scanner": "scanner-primary", "fingerprint": "e94984c708bf6ec3", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/core/tests.py"}, "region": {"startLine": 4933}}}]}, {"ruleId": "scanner-379465faf6cf7a43", "level": "warning", "message": {"text": "Likely N+1 query: `for sibling in \u2026` triggers a query per row \u2014 backend/core/models.py:199"}, "properties": {"repobilityId": "4d22bb6e390676e1", "scanner": "scanner-primary", "fingerprint": "379465faf6cf7a43", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/core/models.py"}, "region": {"startLine": 199}}}]}, {"ruleId": "scanner-9f19447e4c6f103b", "level": "warning", "message": {"text": "Likely N+1 query: `for gcf in \u2026` triggers a query per row \u2014 backend/core/management/commands/copy_category_filters.py:46"}, "properties": {"repobilityId": "d23436d5087bf1a0", "scanner": "scanner-primary", "fingerprint": "9f19447e4c6f103b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/core/management/commands/copy_category_filters.py"}, "region": {"startLine": 46}}}]}, {"ruleId": "scanner-ec91c668f79d8425", "level": "warning", "message": {"text": "Likely N+1 query: `for target in \u2026` triggers a query per row \u2014 backend/core/management/commands/copy_category_filters.py:68"}, "properties": {"repobilityId": "631b342afb782655", "scanner": "scanner-primary", "fingerprint": "ec91c668f79d8425", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/core/management/commands/copy_category_filters.py"}, "region": {"startLine": 68}}}]}, {"ruleId": "scanner-6c472e326d71d147", "level": "warning", "message": {"text": "Likely N+1 query: `for gcf in \u2026` triggers a query per row \u2014 backend/core/management/commands/copy_category_filters.py:74"}, "properties": {"repobilityId": "75854b7486f8627c", "scanner": "scanner-primary", "fingerprint": "6c472e326d71d147", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/core/management/commands/copy_category_filters.py"}, "region": {"startLine": 74}}}]}, {"ruleId": "scanner-53c0e0f1354a45f2", "level": "warning", "message": {"text": "Likely N+1 query: `for gc in \u2026` triggers a query per row \u2014 backend/core/management/commands/export_catalog.py:32"}, "properties": {"repobilityId": "3c9050d0358006c4", "scanner": "scanner-primary", "fingerprint": "53c0e0f1354a45f2", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/core/management/commands/export_catalog.py"}, "region": {"startLine": 32}}}]}, {"ruleId": "scanner-9f66e2ac92d46c2b", "level": "warning", "message": {"text": "Likely N+1 query: `for gcf in \u2026` triggers a query per row \u2014 backend/core/migrations/0052_gamecategoryfilter_visible_when_options_m2m.py:7"}, "properties": {"repobilityId": "ec80b79d27c57e02", "scanner": "scanner-primary", "fingerprint": "9f66e2ac92d46c2b", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/core/migrations/0052_gamecategoryfilter_visible_when_options_m2m.py"}, "region": {"startLine": 7}}}]}, {"ruleId": "scanner-dbc197cca13c60ab", "level": "warning", "message": {"text": "Likely N+1 query: `for gcf in \u2026` triggers a query per row \u2014 backend/core/migrations/0052_gamecategoryfilter_visible_when_options_m2m.py:13"}, "properties": {"repobilityId": "a018758a306c8f3e", "scanner": "scanner-primary", "fingerprint": "dbc197cca13c60ab", "layer": "quality", "severity": "medium", "confidence": 1.0, "tags": ["integrity", "n-plus-one", "performance"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/core/migrations/0052_gamecategoryfilter_visible_when_options_m2m.py"}, "region": {"startLine": 13}}}]}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "6895a1cd014b0b7e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "917d6336faa4ba51", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "8391634d21dc2c7d", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-fe1d9311d6aee734", "level": "note", "message": {"text": "Near-duplicate function bodies in 12 places"}, "properties": {"repobilityId": "b92e2701f06c9177", "scanner": "scanner-primary", "fingerprint": "fe1d9311d6aee734", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "776b52124dc62e41", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "d12a9ee28f0a911f", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "0b7a1f3e3478cb10", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "fd62c1186539d809", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "9959a3138ef3815a", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-76e04eba8bce3620", "level": "note", "message": {"text": "Near-duplicate function bodies in 30 places"}, "properties": {"repobilityId": "6ad4f5d14e885ad6", "scanner": "scanner-primary", "fingerprint": "76e04eba8bce3620", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "e9f767eab4ef43b3", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "ef5fbe7bdecef140", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "46da5f66203c7076", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-6718a631ead09376", "level": "note", "message": {"text": "Near-duplicate function bodies in 38 places"}, "properties": {"repobilityId": "030c92ec3126ad27", "scanner": "scanner-primary", "fingerprint": "6718a631ead09376", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-49c98f7cedd9c977", "level": "note", "message": {"text": "Near-duplicate function bodies in 4 places"}, "properties": {"repobilityId": "67599f4d744bb402", "scanner": "scanner-primary", "fingerprint": "49c98f7cedd9c977", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "2967406dd31c02bf", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "266ccb4a3cabe463", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-02525d39071dd2c7", "level": "note", "message": {"text": "Near-duplicate function bodies in 5 places"}, "properties": {"repobilityId": "1069f74dd8f049fa", "scanner": "scanner-primary", "fingerprint": "02525d39071dd2c7", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-2c04133e54348533", "level": "note", "message": {"text": "Near-duplicate function bodies in 2 places"}, "properties": {"repobilityId": "429f3fa7dee08c9e", "scanner": "scanner-primary", "fingerprint": "2c04133e54348533", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-be46ea126aa5d8dc", "level": "note", "message": {"text": "Near-duplicate function bodies in 3 places"}, "properties": {"repobilityId": "cc7792abf98f317e", "scanner": "scanner-primary", "fingerprint": "be46ea126aa5d8dc", "layer": "quality", "severity": "low", "confidence": 1.0, "tags": ["integrity", "duplicate", "dry"]}}, {"ruleId": "scanner-78cc082bf431d0eb", "level": "warning", "message": {"text": "Django view `request_origin_cache_scope` may be unauthenticated \u2014 backend/core/views.py:149"}, "properties": {"repobilityId": "53d0701fe276c6de", "scanner": "scanner-primary", "fingerprint": "78cc082bf431d0eb", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/core/views.py"}, "region": {"startLine": 149}}}]}, {"ruleId": "scanner-369a94c1b1467222", "level": "warning", "message": {"text": "Django view `game_list_cache_key` may be unauthenticated \u2014 backend/core/views.py:153"}, "properties": {"repobilityId": "8c3760bac063bb32", "scanner": "scanner-primary", "fingerprint": "369a94c1b1467222", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/core/views.py"}, "region": {"startLine": 153}}}]}, {"ruleId": "scanner-52a2455fc956a267", "level": "warning", "message": {"text": "Django view `has_valid_private_media_ticket` may be unauthenticated \u2014 backend/core/views.py:192"}, "properties": {"repobilityId": "dd8db080df6b3b44", "scanner": "scanner-primary", "fingerprint": "52a2455fc956a267", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/core/views.py"}, "region": {"startLine": 192}}}]}, {"ruleId": "scanner-461bceb7b9e5fc2e", "level": "warning", "message": {"text": "Django view `get_pagination_params` may be unauthenticated \u2014 backend/core/views.py:288"}, "properties": {"repobilityId": "275a73b250527048", "scanner": "scanner-primary", "fingerprint": "461bceb7b9e5fc2e", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/core/views.py"}, "region": {"startLine": 288}}}]}, {"ruleId": "scanner-be2d2528da2aa6e3", "level": "warning", "message": {"text": "Django view `get_before_id` may be unauthenticated \u2014 backend/core/views.py:315"}, "properties": {"repobilityId": "e690af93c8c88e6e", "scanner": "scanner-primary", "fingerprint": "be2d2528da2aa6e3", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "owasp", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/core/views.py"}, "region": {"startLine": 315}}}]}, {"ruleId": "scanner-303d143032b4cfe8", "level": "warning", "message": {"text": "Django CBV `RefreshTokenView` lacks `LoginRequiredMixin` \u2014 backend/core/views.py:964"}, "properties": {"repobilityId": "2acde72e2f51a3bf", "scanner": "scanner-primary", "fingerprint": "303d143032b4cfe8", "layer": "security", "severity": "medium", "confidence": 1.0, "tags": ["auth", "auth.django.unauth_view"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/core/views.py"}, "region": {"startLine": 964}}}]}, {"ruleId": "scanner-77ed1a58e38aeee0", "level": "error", "message": {"text": "DRF view `ListingDetailView` declares no `permission_classes` \u2014 backend/core/views.py:1874"}, "properties": {"repobilityId": "2161d230ce968fe1", "scanner": "scanner-primary", "fingerprint": "77ed1a58e38aeee0", "layer": "security", "severity": "high", "confidence": 1.0, "tags": ["auth", "owasp", "auth.drf.no_permission_classes"]}, "locations": [{"physicalLocation": {"artifactLocation": {"uri": "backend/core/views.py"}, "region": {"startLine": 1874}}}]}, {"ruleId": "scanner-7309bf2446873ccc", "level": "note", "message": {"text": "Unused endpoint: ANY /admin/"}, "properties": {"repobilityId": "a2eb5808b021ebbb", "scanner": "scanner-primary", "fingerprint": "7309bf2446873ccc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ce0a9b4397331ef4", "level": "note", "message": {"text": "Unused endpoint: ANY /api/"}, "properties": {"repobilityId": "5efa5e6dc8df37bc", "scanner": "scanner-primary", "fingerprint": "ce0a9b4397331ef4", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a7ab6f136f143890", "level": "note", "message": {"text": "Unused endpoint: ANY /^media/(?P<path>.*)$"}, "properties": {"repobilityId": "f92152508ae8da79", "scanner": "scanner-primary", "fingerprint": "a7ab6f136f143890", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-35e9e406f6f4537e", "level": "note", "message": {"text": "Unused endpoint: ANY /api/home/popular/"}, "properties": {"repobilityId": "60843c45c587e24e", "scanner": "scanner-primary", "fingerprint": "35e9e406f6f4537e", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-540c1859b66bd00a", "level": "note", "message": {"text": "Unused endpoint: ANY /api/games/"}, "properties": {"repobilityId": "39d1bc249dab9569", "scanner": "scanner-primary", "fingerprint": "540c1859b66bd00a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8ab130762c8660b5", "level": "note", "message": {"text": "Unused endpoint: ANY /api/games/<slug:slug>/"}, "properties": {"repobilityId": "e8718d4dcd99919c", "scanner": "scanner-primary", "fingerprint": "8ab130762c8660b5", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-babe4fffd2129ba8", "level": "note", "message": {"text": "Unused endpoint: ANY /api/games/<slug:game_slug>/<slug:category_slug>/"}, "properties": {"repobilityId": "c52776dbe318a098", "scanner": "scanner-primary", "fingerprint": "babe4fffd2129ba8", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-2b9ab53458f72d57", "level": "note", "message": {"text": "Unused endpoint: ANY /api/auth/register/"}, "properties": {"repobilityId": "8d46935bb4c907f8", "scanner": "scanner-primary", "fingerprint": "2b9ab53458f72d57", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8548e6d2f5846242", "level": "note", "message": {"text": "Unused endpoint: ANY /api/auth/verify-email/"}, "properties": {"repobilityId": "0dcb5358120d0402", "scanner": "scanner-primary", "fingerprint": "8548e6d2f5846242", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-5d9aa3d6c8390e4f", "level": "note", "message": {"text": "Unused endpoint: ANY /api/auth/resend-verification/"}, "properties": {"repobilityId": "3f5818fe188c90c9", "scanner": "scanner-primary", "fingerprint": "5d9aa3d6c8390e4f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-36cdb7f9351bcef6", "level": "note", "message": {"text": "Unused endpoint: ANY /api/auth/login/"}, "properties": {"repobilityId": "9468fa4f6c40939a", "scanner": "scanner-primary", "fingerprint": "36cdb7f9351bcef6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-11ee291d2e100a5f", "level": "note", "message": {"text": "Unused endpoint: ANY /api/auth/refresh/"}, "properties": {"repobilityId": "7b43b26bc097724e", "scanner": "scanner-primary", "fingerprint": "11ee291d2e100a5f", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-e0f4083d667c135a", "level": "note", "message": {"text": "Unused endpoint: ANY /api/auth/logout/"}, "properties": {"repobilityId": "0f77c3c6df30ec12", "scanner": "scanner-primary", "fingerprint": "e0f4083d667c135a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-69f11e4f376a4fc2", "level": "note", "message": {"text": "Unused endpoint: ANY /api/auth/me/"}, "properties": {"repobilityId": "04bde5cb957fa29f", "scanner": "scanner-primary", "fingerprint": "69f11e4f376a4fc2", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6ee9a66cbe83716c", "level": "note", "message": {"text": "Unused endpoint: ANY /api/auth/google/"}, "properties": {"repobilityId": "16e298295effa5e0", "scanner": "scanner-primary", "fingerprint": "6ee9a66cbe83716c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-c074f38c28eabcce", "level": "note", "message": {"text": "Unused endpoint: ANY /api/auth/profile/"}, "properties": {"repobilityId": "6b9515a938e09fd4", "scanner": "scanner-primary", "fingerprint": "c074f38c28eabcce", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-65daacbfab797f3a", "level": "note", "message": {"text": "Unused endpoint: ANY /api/auth/complete-profile/"}, "properties": {"repobilityId": "e2b1ad68fc3c13c3", "scanner": "scanner-primary", "fingerprint": "65daacbfab797f3a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7eb648e1aa704a2b", "level": "note", "message": {"text": "Unused endpoint: ANY /api/auth/password/"}, "properties": {"repobilityId": "4fbd923e5e72a8b7", "scanner": "scanner-primary", "fingerprint": "7eb648e1aa704a2b", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-ad0d411a7a33fe37", "level": "note", "message": {"text": "Unused endpoint: ANY /api/auth/password/reset-request/"}, "properties": {"repobilityId": "d80d541f06e90576", "scanner": "scanner-primary", "fingerprint": "ad0d411a7a33fe37", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3a5b8dd0e4899042", "level": "note", "message": {"text": "Unused endpoint: ANY /api/auth/password/reset-confirm/"}, "properties": {"repobilityId": "954b3bfd966122b9", "scanner": "scanner-primary", "fingerprint": "3a5b8dd0e4899042", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-da7cc5a656a0d622", "level": "note", "message": {"text": "Unused endpoint: ANY /api/auth/avatar/"}, "properties": {"repobilityId": "57f5e6472bf65d13", "scanner": "scanner-primary", "fingerprint": "da7cc5a656a0d622", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-eb3e44ec641d3b4c", "level": "note", "message": {"text": "Unused endpoint: ANY /api/auth/email/request-change/"}, "properties": {"repobilityId": "ad1b0b01743706d9", "scanner": "scanner-primary", "fingerprint": "eb3e44ec641d3b4c", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-702b00ed0467aa14", "level": "note", "message": {"text": "Unused endpoint: ANY /api/auth/email/confirm-change/"}, "properties": {"repobilityId": "d1c27fa475656ab3", "scanner": "scanner-primary", "fingerprint": "702b00ed0467aa14", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-19ca78368f523217", "level": "note", "message": {"text": "Unused endpoint: ANY /api/seller/apply/"}, "properties": {"repobilityId": "55d31cbd2d4accba", "scanner": "scanner-primary", "fingerprint": "19ca78368f523217", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-901a7d8fc77bacfe", "level": "note", "message": {"text": "Unused endpoint: ANY /api/seller/status/"}, "properties": {"repobilityId": "4eed7f0591f24fb3", "scanner": "scanner-primary", "fingerprint": "901a7d8fc77bacfe", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8e8141f581e46f02", "level": "note", "message": {"text": "Unused endpoint: ANY /api/seller/dashboard/"}, "properties": {"repobilityId": "dfea91813e5427da", "scanner": "scanner-primary", "fingerprint": "8e8141f581e46f02", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6e123de7d638ccc3", "level": "note", "message": {"text": "Unused endpoint: ANY /api/listings/"}, "properties": {"repobilityId": "64333068437839a8", "scanner": "scanner-primary", "fingerprint": "6e123de7d638ccc3", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-78873108c2165740", "level": "note", "message": {"text": "Unused endpoint: ANY /api/listings/mine/"}, "properties": {"repobilityId": "5e25555607d1e35b", "scanner": "scanner-primary", "fingerprint": "78873108c2165740", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-d2c4092f33e58b40", "level": "note", "message": {"text": "Unused endpoint: ANY /api/listings/<int:pk>/restock/"}, "properties": {"repobilityId": "27a47c3c0f69e7cf", "scanner": "scanner-primary", "fingerprint": "d2c4092f33e58b40", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-94cf46cab9f95176", "level": "note", "message": {"text": "Unused endpoint: ANY /api/listings/<int:pk>/stock/"}, "properties": {"repobilityId": "fb03ebb5dff042a5", "scanner": "scanner-primary", "fingerprint": "94cf46cab9f95176", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7c2cf56cfc6ae9d9", "level": "note", "message": {"text": "Unused endpoint: ANY /api/listings/<int:pk>/"}, "properties": {"repobilityId": "c4f3b5d7abd6459c", "scanner": "scanner-primary", "fingerprint": "7c2cf56cfc6ae9d9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-18b18d881ac99b9a", "level": "note", "message": {"text": "Unused endpoint: ANY /api/chat/"}, "properties": {"repobilityId": "a4aa71b2e4a49dfb", "scanner": "scanner-primary", "fingerprint": "18b18d881ac99b9a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9a822d93955bc7ff", "level": "note", "message": {"text": "Unused endpoint: ANY /api/chat/start/"}, "properties": {"repobilityId": "52cfb60436fa2c2f", "scanner": "scanner-primary", "fingerprint": "9a822d93955bc7ff", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-87e3ced1431e35cc", "level": "note", "message": {"text": "Unused endpoint: ANY /api/chat/unread/"}, "properties": {"repobilityId": "7569464392817835", "scanner": "scanner-primary", "fingerprint": "87e3ced1431e35cc", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a334543868d7230a", "level": "note", "message": {"text": "Unused endpoint: ANY /api/chat/inbox/ws-ticket/"}, "properties": {"repobilityId": "da18a32f7f3fafe7", "scanner": "scanner-primary", "fingerprint": "a334543868d7230a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-3d2befa5babb06ce", "level": "note", "message": {"text": "Unused endpoint: ANY /api/chat/<int:pk>/"}, "properties": {"repobilityId": "24b839f2b14e9ac9", "scanner": "scanner-primary", "fingerprint": "3d2befa5babb06ce", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-962b9cca747a2e48", "level": "note", "message": {"text": "Unused endpoint: ANY /api/chat/<int:pk>/ws-ticket/"}, "properties": {"repobilityId": "aa5df027fab1a401", "scanner": "scanner-primary", "fingerprint": "962b9cca747a2e48", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-480204757f08c625", "level": "note", "message": {"text": "Unused endpoint: ANY /api/chat/<int:pk>/send/"}, "properties": {"repobilityId": "8d146afad9a037ed", "scanner": "scanner-primary", "fingerprint": "480204757f08c625", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-a6a1a087268c9f06", "level": "note", "message": {"text": "Unused endpoint: ANY /api/chat/<int:pk>/send-image/"}, "properties": {"repobilityId": "12ade83f73dca6a9", "scanner": "scanner-primary", "fingerprint": "a6a1a087268c9f06", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9256961f51f78088", "level": "note", "message": {"text": "Unused endpoint: ANY /api/chat/messages/<int:pk>/image/"}, "properties": {"repobilityId": "3619a199cf791e7e", "scanner": "scanner-primary", "fingerprint": "9256961f51f78088", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cb9516251750ed1a", "level": "note", "message": {"text": "Unused endpoint: ANY /api/heartbeat/"}, "properties": {"repobilityId": "3aaab2de700af72e", "scanner": "scanner-primary", "fingerprint": "cb9516251750ed1a", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-8c16d1c1de315977", "level": "note", "message": {"text": "Unused endpoint: ANY /api/wallet/"}, "properties": {"repobilityId": "668069ae8d87812c", "scanner": "scanner-primary", "fingerprint": "8c16d1c1de315977", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-64f632a5e942f032", "level": "note", "message": {"text": "Unused endpoint: ANY /api/wallet/transactions/"}, "properties": {"repobilityId": "ce521dfdc957d96f", "scanner": "scanner-primary", "fingerprint": "64f632a5e942f032", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-9fd9a6069effbf2d", "level": "note", "message": {"text": "Unused endpoint: ANY /api/wallet/held-orders/"}, "properties": {"repobilityId": "d11b03e67377948a", "scanner": "scanner-primary", "fingerprint": "9fd9a6069effbf2d", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-518836d622b28ac7", "level": "note", "message": {"text": "Unused endpoint: ANY /api/wallet/top-up/"}, "properties": {"repobilityId": "6f4e0dd64f7f1e65", "scanner": "scanner-primary", "fingerprint": "518836d622b28ac7", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-1793acdb7b8d27c9", "level": "note", "message": {"text": "Unused endpoint: ANY /api/wallet/top-up/<int:pk>/proof/"}, "properties": {"repobilityId": "ab10291105dedea1", "scanner": "scanner-primary", "fingerprint": "1793acdb7b8d27c9", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-7df672763c65b5cb", "level": "note", "message": {"text": "Unused endpoint: ANY /api/wallet/withdraw/"}, "properties": {"repobilityId": "22b6c7a8c3d84c98", "scanner": "scanner-primary", "fingerprint": "7df672763c65b5cb", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-cf6bd9d30401f527", "level": "note", "message": {"text": "Unused endpoint: ANY /api/wallet/withdraw/<int:pk>/receipt/"}, "properties": {"repobilityId": "d2b6b957962d0294", "scanner": "scanner-primary", "fingerprint": "cf6bd9d30401f527", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-84ae7fabd29369b6", "level": "note", "message": {"text": "Unused endpoint: ANY /api/payments/jazzcash/top-up/"}, "properties": {"repobilityId": "97273757807f6925", "scanner": "scanner-primary", "fingerprint": "84ae7fabd29369b6", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}, {"ruleId": "scanner-6c1d92fd31d403ce", "level": "note", "message": {"text": "Unused endpoint: ANY /api/payments/jazzcash/buy/"}, "properties": {"repobilityId": "201ae8286ffd27a0", "scanner": "scanner-primary", "fingerprint": "6c1d92fd31d403ce", "layer": "api", "severity": "low", "confidence": 1.0, "tags": ["wiring", "unused-endpoint"]}}]}]}