Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.
Sign up free Scan another repo

shortbird/pathweaver_2.0

https://github.com/shortbird/pathweaver_2.0 · scanned 2026-06-16 00:12 UTC (2 months, 2 weeks ago)

1001 raw signals (0 security + 1001 graph)

File as issue Image
UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 2 months, 2 weeks ago · v1 · 850 actionable findings from 1 signal source. 151 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON
Combined
65.6
/100
Security checks
66
0 findings
System graph
66
100.0% cov · 850 findings
Critical
5
click to filter
Agents
10
0 votes
Crowd
0
reported
Severity distribution — click a segment to filter
Active filters: excluding tests × Reset all
Severity: Critical 5 High 429 Medium 65 Low 148 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 0 System graph 850 Crowd 0 Layer: Software 19 Frontend 158 Security 456 Cicd 2 Quality 165 Api 50
Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.
Scan summary Repository scanned at 65.6/100 with 100.0% coverage. It contains 13863 nodes across 30 cross-layer flows, written primarily in mixed languages. Engine surfaced 1001 findings — concentrated in security (462), quality (295), frontend (158). Risk profile is high: 11 critical, 429 high, 179 medium. Recommended next step: open the security layer findings first — that's where the highest-impact wins live.

Showing 643 of 850 actionable findings. 1001 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical System graph security Secrets conf 1.00 Possible secret in backend/scripts/seed_demo_family.py
Detected pattern matching password_literal. Rotate the credential and move to a secret manager.
backend/scripts/seed_demo_family.py:47
critical System graph security Secrets conf 1.00 2 occurrences Possible secret in frontend-v2/app/(app)/(tabs)/family.tsx
Detected pattern matching password_literal. Rotate the credential and move to a secret manager.
lines 414, 434
frontend-v2/app/(app)/(tabs)/family.tsx:414, 434 (2 hits)
critical System graph security Secrets conf 1.00 2 occurrences Possible secret in frontend-v2/app/(auth)/register.tsx
Detected pattern matching password_literal. Rotate the credential and move to a secret manager.
lines 139, 140
frontend-v2/app/(auth)/register.tsx:139, 140 (2 hits)
critical System graph security Secrets conf 1.00 3 occurrences Possible secret in frontend-v2/app/invite/[code].tsx
Detected pattern matching password_literal. Rotate the credential and move to a secret manager.
lines 115, 116, 117
frontend-v2/app/invite/[code].tsx:115, 116, 117 (3 hits)
critical System graph security Secrets conf 1.00 3 occurrences Possible secret in frontend/src/pages/AcceptInvitationPage.jsx
Detected pattern matching password_literal. Rotate the credential and move to a secret manager.
lines 169, 171, 176
frontend/src/pages/AcceptInvitationPage.jsx:169, 171, 176 (3 hits)
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: .claude/settings.local.json
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
.claude/settings.local.json:9 SecretsClaude instruction
high System graph security Agent instructions conf 1.00 Agent instruction/config may expose a secret: CLAUDE.md
Agent-facing files are routinely pasted into LLM/tool contexts. Move literal tokens, keys, and passwords into a secret manager or document them as placeholders only.
CLAUDE.md:431 SecretsClaude instruction
high System graph security auth conf 1.00 Flask mutation route `accept_approach` without `@login_required` — backend/routes/quest_ai.py:471
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/quest_ai.py:471 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `accept_family_quest_idea` without `@login_required` — backend/routes/parent/family_quest_ai.py:128
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/parent/family_quest_ai.py:128 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `accept_invitation` without `@login_required` — backend/routes/admin/user_invitations.py:891
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/user_invitations.py:891 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `accept_observer_invitation` without `@login_required` — backend/routes/observer/acceptance.py:115
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/observer/acceptance.py:115 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `accept_task_immediate` without `@login_required` — backend/routes/quest_personalization.py:561
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/quest_personalization.py:561 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `accept_tos` without `@login_required` — backend/routes/auth/google_oauth.py:375
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/auth/google_oauth.py:375 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `activate_task` without `@login_required` — backend/routes/curriculum/tasks.py:219
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/curriculum/tasks.py:219 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `add_class_advisor` without `@login_required` — backend/routes/classes/advisors.py:78
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/classes/advisors.py:78 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `add_class_quest` without `@login_required` — backend/routes/classes/quests.py:85
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/classes/quests.py:85 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `add_credit_evidence` without `@login_required` — backend/routes/oea.py:516
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/oea.py:516 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `add_dependent_login` without `@login_required` — backend/routes/dependents.py:512
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/dependents.py:512 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `add_manual_tasks_batch` without `@login_required` — backend/routes/quest_personalization.py:389
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/quest_personalization.py:389 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `add_member` without `@login_required` — backend/routes/group_messages.py:219
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/group_messages.py:219 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `add_observer_link` without `@login_required` — backend/routes/admin/user_management.py:1175
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/user_management.py:1175 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `add_planned_credit` without `@login_required` — backend/routes/admin/transcript_generator.py:220
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/transcript_generator.py:220 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `add_project` without `@login_required` — backend/routes/admin/curriculum_generate/project.py:60
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/curriculum_generate/project.py:60 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `add_quest_to_course` without `@login_required` — backend/routes/courses/quests.py:81
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/courses/quests.py:81 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `add_sample_task_to_user_quest` without `@login_required` — backend/routes/quest_types.py:28
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/quest_types.py:28 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `add_student_credit` without `@login_required` — backend/routes/oea.py:283
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/oea.py:283 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `add_users_to_organization` without `@login_required` — backend/routes/admin/organization_management.py:453
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/organization_management.py:453 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `adjust_balance` without `@login_required` — backend/routes/treehouse.py:387
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/treehouse.py:387 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `admin_create_link` without `@login_required` — backend/routes/parent_linking/admin.py:45
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/parent_linking/admin.py:45 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `admin_delete_link` without `@login_required` — backend/routes/parent_linking/admin.py:116
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/parent_linking/admin.py:116 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `admin_reset_password` without `@login_required` — backend/routes/admin/user_management.py:333
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/user_management.py:333 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `admin_verify_email` without `@login_required` — backend/routes/admin/user_management.py:401
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/user_management.py:401 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `ai_alt_text` without `@login_required` — backend/routes/showcase.py:195
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/showcase.py:195 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `ai_captions` without `@login_required` — backend/routes/showcase.py:177
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/showcase.py:177 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `ai_cleanup_quest` without `@login_required` — backend/routes/admin/quest_management/crud.py:445
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/quest_management/crud.py:445 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `ai_quote_pull` without `@login_required` — backend/routes/showcase.py:213
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/showcase.py:213 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `analyze_manual_task` without `@login_required` — backend/routes/quest_personalization.py:338
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/quest_personalization.py:338 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `apple_oauth_callback` without `@login_required` — backend/routes/auth/apple_oauth.py:36
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/auth/apple_oauth.py:36 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `apply_changes` without `@login_required` — backend/routes/admin/course_refine.py:247
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/course_refine.py:247 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `approve_and_generate` without `@login_required` — backend/routes/admin/plan_mode.py:340
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/plan_mode.py:340 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `approve_class_review` without `@login_required` — backend/routes/admin/class_reviews.py:194
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/class_reviews.py:194 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `approve_connection_request` without `@login_required` — backend/routes/admin/parent_connections.py:69
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/parent_connections.py:69 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `approve_connection_request` without `@login_required` — backend/routes/parent_linking/requests.py:239
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/parent_linking/requests.py:239 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `approve_credit` without `@login_required` — backend/routes/credit_dashboard/superadmin_actions.py:30
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/credit_dashboard/superadmin_actions.py:30 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `approve_evidence_report` without `@login_required` — backend/routes/evidence_reports.py:315
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/evidence_reports.py:315 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `approve_flagged_task` without `@login_required` — backend/routes/admin/task_flags.py:80
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/task_flags.py:80 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `approve_parental_consent` without `@login_required` — backend/routes/parental_consent/admin_review.py:113
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/parental_consent/admin_review.py:113 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `approve_structure` without `@login_required` — backend/routes/admin/curriculum_upload.py:919
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/curriculum_upload.py:919 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `approve_task` without `@login_required` — backend/routes/admin/task_approval.py:78
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/task_approval.py:78 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `archive_class` without `@login_required` — backend/routes/classes/crud.py:226
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/classes/crud.py:226 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `assign_advisor_role` without `@login_required` — backend/routes/admin/user_management.py:925
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/user_management.py:925 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `assign_child_moment_to_topic` without `@login_required` — backend/routes/parent/learning_moments.py:633
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/parent/learning_moments.py:633 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `assign_org_student_to_advisor` without `@login_required` — backend/routes/admin/org_connections.py:168
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/org_connections.py:168 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `assign_student_to_advisor` without `@login_required` — backend/routes/admin/advisor_management.py:190
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/advisor_management.py:190 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `assign_user_to_organization` without `@login_required` — backend/routes/admin/user_management.py:626
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/user_management.py:626 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `award_credit` without `@login_required` — backend/routes/admin/poe.py:295
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/poe.py:295 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `backfill_all_tasks` without `@login_required` — backend/routes/admin/subject_backfill.py:56
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/subject_backfill.py:56 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `backfill_quest_topics` without `@login_required` — backend/routes/quest/listing.py:410
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/quest/listing.py:410 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `backfill_single_task` without `@login_required` — backend/routes/admin/subject_backfill.py:22
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/subject_backfill.py:22 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `batch_copy_tasks` without `@login_required` — backend/routes/admin/student_task_management.py:254
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/student_task_management.py:254 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `batch_reconcile` without `@login_required` — backend/routes/admin/xp_reconciliation.py:346
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/xp_reconciliation.py:346 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `block_user` without `@login_required` — backend/routes/moderation.py:81
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/moderation.py:81 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `broadcast_notification` without `@login_required` — backend/routes/notifications.py:331
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/notifications.py:331 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `bulk_delete_quests` without `@login_required` — backend/routes/admin/quest_management/crud.py:208
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/quest_management/crud.py:208 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `bulk_delete_users` without `@login_required` — backend/routes/admin/user_management.py:299
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/user_management.py:299 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `bulk_enroll_users` without `@login_required` — backend/routes/admin/course_enrollments.py:111
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/course_enrollments.py:111 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `bulk_generate_images` without `@login_required` — backend/routes/admin/quest_management/images.py:201
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/quest_management/images.py:201 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `bulk_generate` without `@login_required` — backend/routes/admin/curriculum_generate/bulk.py:60
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/curriculum_generate/bulk.py:60 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `bulk_import_users` without `@login_required` — backend/routes/admin/bulk_import.py:136
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/bulk_import.py:136 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `bulk_remove_users_from_organization` without `@login_required` — backend/routes/admin/organization_management.py:579
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/organization_management.py:579 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `bulk_unenroll_users` without `@login_required` — backend/routes/admin/course_enrollments.py:364
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/course_enrollments.py:364 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `bulk_update_quests` without `@login_required` — backend/routes/admin/quest_management/crud.py:252
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/quest_management/crud.py:252 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `calculate_credits` without `@login_required` — backend/routes/credits.py:256
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/credits.py:256 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `cancel_account_deletion` without `@login_required` — backend/routes/account_deletion.py:116
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/account_deletion.py:116 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `cancel_invitation` without `@login_required` — backend/routes/admin/user_invitations.py:663
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/user_invitations.py:663 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `cancel_job` without `@login_required` — backend/routes/admin/curriculum_generate/jobs.py:303
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/curriculum_generate/jobs.py:303 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `cancel_observer_invitation` without `@login_required` — backend/routes/observer/student_invitations.py:115
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/observer/student_invitations.py:115 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `cancel_session` without `@login_required` — backend/routes/admin/course_refine.py:430
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/course_refine.py:430 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `check_email_exists` without `@login_required` — backend/routes/admin/user_invitations.py:842
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/user_invitations.py:842 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `class_task_suggestions` without `@login_required` — backend/routes/quest/classes.py:30
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/quest/classes.py:30 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `clone_quest_to_optio` without `@login_required` — backend/routes/admin/quest_management/tools.py:100
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/quest_management/tools.py:100 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `complete_task_with_evidence` without `@login_required` — backend/routes/evidence_documents.py:1457
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/evidence_documents.py:1457 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `complete_task` without `@login_required` — backend/routes/tasks/completion.py:29
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/tasks/completion.py:29 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `confirm_imscc_import` without `@login_required` — backend/routes/admin/course_import.py:119
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/course_import.py:119 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `course_sync_webhook` without `@login_required` — backend/routes/spark_integration/webhooks.py:54
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/spark_integration/webhooks.py:54 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_and_add_class_quest` without `@login_required` — backend/routes/classes/quests.py:395
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/classes/quests.py:395 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_announcement` without `@login_required` — backend/routes/announcements.py:29
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/announcements.py:29 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_bug_report` without `@login_required` — backend/routes/bug_reports.py:99
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/bug_reports.py:99 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_child_learning_moment` without `@login_required` — backend/routes/parent/learning_moments.py:22
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/parent/learning_moments.py:22 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_child_topic` without `@login_required` — backend/routes/parent/learning_moments.py:447
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/parent/learning_moments.py:447 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_class_group` without `@login_required` — backend/routes/classes/messaging.py:29
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/classes/messaging.py:29 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_class` without `@login_required` — backend/routes/classes/crud.py:70
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/classes/crud.py:70 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_client` without `@login_required` — backend/routes/auth/oauth.py:432
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/auth/oauth.py:432 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_course_quest` without `@login_required` — backend/routes/admin/course_quest_management.py:37
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/course_quest_management.py:37 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_course` without `@login_required` — backend/routes/courses/crud.py:167
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/courses/crud.py:167 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_course` without `@login_required` — backend/routes/courses/crud.py:168
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/courses/crud.py:168 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_curriculum_tasks` without `@login_required` — backend/routes/curriculum/tasks.py:390
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/curriculum/tasks.py:390 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_dependent` without `@login_required` — backend/routes/dependents.py:121
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/dependents.py:121 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_evidence_report` without `@login_required` — backend/routes/evidence_reports.py:39
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/evidence_reports.py:39 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_family_quest` without `@login_required` — backend/routes/family_quests.py:50
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/family_quests.py:50 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_group` without `@login_required` — backend/routes/group_messages.py:30
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/group_messages.py:30 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_invitation` without `@login_required` — backend/routes/admin/user_invitations.py:315
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/user_invitations.py:315 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_invite` without `@login_required` — backend/routes/courses/invites.py:31
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/courses/invites.py:31 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_kiosk_device` without `@login_required` — backend/routes/treehouse.py:543
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/treehouse.py:543 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_lesson` without `@login_required` — backend/routes/curriculum/lessons.py:48
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/curriculum/lessons.py:48 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_manual_link` without `@login_required` — backend/routes/admin/parent_connections.py:237
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/parent_connections.py:237 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_org_manual_parent_link` without `@login_required` — backend/routes/admin/org_connections.py:670
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/org_connections.py:670 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_organization` without `@login_required` — backend/routes/admin/organization_management.py:88
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/organization_management.py:88 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_parent_invitation` without `@login_required` — backend/routes/admin/user_invitations.py:98
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/user_invitations.py:98 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_quest_v3_clean` without `@login_required` — backend/routes/admin/quest_management/crud.py:70
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/quest_management/crud.py:70 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_quest_v3_clean` without `@login_required` — backend/routes/admin/quest_management/crud.py:71
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/quest_management/crud.py:71 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_registration` without `@login_required` — backend/routes/admin/lti_registrations.py:57
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/lti_registrations.py:57 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_share_token` without `@login_required` — backend/routes/observer/sharing.py:76
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/observer/sharing.py:76 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_showcase` without `@login_required` — backend/routes/treehouse.py:430
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/treehouse.py:430 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_signal` without `@login_required` — backend/routes/treehouse.py:200
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/treehouse.py:200 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_student_learning_moment` without `@login_required` — backend/routes/advisor/learning_moments.py:19
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/advisor/learning_moments.py:19 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_student_task` without `@login_required` — backend/routes/admin/student_task_management.py:53
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/student_task_management.py:53 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_task_for_dependent` without `@login_required` — backend/routes/family_quests.py:292
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/family_quests.py:292 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_user_quest` without `@login_required` — backend/routes/quest/enrollment.py:481
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/quest/enrollment.py:481 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `create_username_student` without `@login_required` — backend/routes/admin/organization_management.py:860
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/organization_management.py:860 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `deactivate_expo_token` without `@login_required` — backend/routes/push_subscriptions.py:241
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/push_subscriptions.py:241 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `deep_link_submit` without `@login_required` — backend/routes/lti/deep_linking.py:120
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/lti/deep_linking.py:120 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_all_notifications` without `@login_required` — backend/routes/notifications.py:172
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/notifications.py:172 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_all_steps` without `@login_required` — backend/routes/task_steps.py:186
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/task_steps.py:186 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_all_transfer_credits` without `@login_required` — backend/routes/admin/transfer_credits.py:408
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/transfer_credits.py:408 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_attachment` without `@login_required` — backend/routes/curriculum/attachments.py:231
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/curriculum/attachments.py:231 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_block_file` without `@login_required` — backend/routes/evidence_documents.py:1279
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/evidence_documents.py:1279 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_child_learning_moment` without `@login_required` — backend/routes/parent/learning_moments.py:848
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/parent/learning_moments.py:848 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_course_task` without `@login_required` — backend/routes/admin/course_quest_management.py:499
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/course_quest_management.py:499 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_course` without `@login_required` — backend/routes/courses/crud.py:714
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/courses/crud.py:714 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_credit_evidence` without `@login_required` — backend/routes/oea.py:572
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/oea.py:572 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_dependent` without `@login_required` — backend/routes/dependents.py:393
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/dependents.py:393 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_draft` without `@login_required` — backend/routes/admin/curriculum_generate/finalize.py:94
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/curriculum_generate/finalize.py:94 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_evidence_block` without `@login_required` — backend/routes/evidence_documents.py:1384
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/evidence_documents.py:1384 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_evidence_report` without `@login_required` — backend/routes/evidence_reports.py:227
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/evidence_reports.py:227 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_flagged_task` without `@login_required` — backend/routes/admin/task_flags.py:114
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/task_flags.py:114 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_group` without `@login_required` — backend/routes/group_messages.py:191
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/group_messages.py:191 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_helper_evidence_block` without `@login_required` — backend/routes/helper_evidence.py:448
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/helper_evidence.py:448 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_lesson_progress` without `@login_required` — backend/routes/curriculum/progress.py:133
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/curriculum/progress.py:133 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_lesson` without `@login_required` — backend/routes/curriculum/lessons.py:223
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/curriculum/lessons.py:223 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_notification` without `@login_required` — backend/routes/notifications.py:145
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/notifications.py:145 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_observer_comment` without `@login_required` — backend/routes/observer/comments.py:196
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/observer/comments.py:196 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_planned_credit` without `@login_required` — backend/routes/admin/transcript_generator.py:305
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/transcript_generator.py:305 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_project` without `@login_required` — backend/routes/admin/curriculum_generate/project.py:195
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/curriculum_generate/project.py:195 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_quest` without `@login_required` — backend/routes/admin/quest_management/crud.py:503
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/quest_management/crud.py:503 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_registration` without `@login_required` — backend/routes/admin/lti_registrations.py:112
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/lti_registrations.py:112 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_single_transfer_credit` without `@login_required` — backend/routes/admin/transfer_credits.py:380
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/transfer_credits.py:380 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_storage_urls` without `@login_required` — backend/routes/evidence_documents.py:1345
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/evidence_documents.py:1345 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_student_credit` without `@login_required` — backend/routes/oea.py:427
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/oea.py:427 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_student_learning_moment` without `@login_required` — backend/routes/advisor/learning_moments.py:443
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/advisor/learning_moments.py:443 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_student_task` without `@login_required` — backend/routes/admin/student_task_management.py:588
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/student_task_management.py:588 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_task` without `@login_required` — backend/routes/admin/task_approval.py:178
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/task_approval.py:178 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_template_task` without `@login_required` — backend/routes/admin/course_quest_management.py:719
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/course_quest_management.py:719 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_upload` without `@login_required` — backend/routes/admin/curriculum_upload.py:1187
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/curriculum_upload.py:1187 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_user_account_permanent` without `@login_required` — backend/routes/account_deletion.py:422
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/account_deletion.py:422 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_user_account` without `@login_required` — backend/routes/admin_core.py:381
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin_core.py:381 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `delete_user` without `@login_required` — backend/routes/admin/user_management.py:267
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/user_management.py:267 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `deny_evidence_report` without `@login_required` — backend/routes/evidence_reports.py:347
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/evidence_reports.py:347 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `diagnose_curriculum` without `@login_required` — backend/routes/admin/curriculum_upload.py:1319
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/curriculum_upload.py:1319 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `disconnect_link` without `@login_required` — backend/routes/admin/parent_connections.py:205
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/parent_connections.py:205 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `disconnect_org_parent_link` without `@login_required` — backend/routes/admin/org_connections.py:627
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/org_connections.py:627 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `drill_down_step` without `@login_required` — backend/routes/task_steps.py:74
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/task_steps.py:74 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `drop_task` without `@login_required` — backend/routes/tasks/crud.py:257
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/tasks/crud.py:257 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `edit_task` without `@login_required` — backend/routes/quest_personalization.py:294
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/quest_personalization.py:294 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `end_course` without `@login_required` — backend/routes/courses/enrollment.py:273
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/courses/enrollment.py:273 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `end_quest` without `@login_required` — backend/routes/quest/completion.py:422
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/quest/completion.py:422 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `enhance_content` without `@login_required` — backend/routes/curriculum_enhance.py:20
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/curriculum_enhance.py:20 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `enhance_quest_description` without `@login_required` — backend/routes/quest_ai.py:130
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/quest_ai.py:130 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `enhance_student_quest_idea` without `@login_required` — backend/routes/quest_ai.py:296
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/quest_ai.py:296 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `enroll_children_in_family_quest` without `@login_required` — backend/routes/family_quests.py:186
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/family_quests.py:186 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `enroll_in_course` without `@login_required` — backend/routes/courses/enrollment.py:29
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/courses/enrollment.py:29 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `enroll_in_poe` without `@login_required` — backend/routes/poe.py:83
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/poe.py:83 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `enroll_in_quest` without `@login_required` — backend/routes/quest/enrollment.py:24
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/quest/enrollment.py:24 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `enroll_students` without `@login_required` — backend/routes/classes/students.py:95
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/classes/students.py:95 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `ensure_credit_quest` without `@login_required` — backend/routes/oea.py:453
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/oea.py:453 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `exchange_auth_code` without `@login_required` — backend/routes/lti/token.py:38
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/lti/token.py:38 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `exchange_auth_code` without `@login_required` — backend/routes/spark_integration/sso.py:196
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/spark_integration/sso.py:196 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `family_invite_email` without `@login_required` — backend/routes/observer/family.py:153
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/observer/family.py:153 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `family_invite` without `@login_required` — backend/routes/observer/family.py:29
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/observer/family.py:29 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `finalize_block_signed_upload` without `@login_required` — backend/routes/evidence_documents.py:609
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/evidence_documents.py:609 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `finalize_course` without `@login_required` — backend/routes/admin/curriculum_generate/finalize.py:60
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/curriculum_generate/finalize.py:60 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `finalize_moment_block_signed_upload` without `@login_required` — backend/routes/parent/learning_moments.py:1178
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/parent/learning_moments.py:1178 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `finalize_moment_signed_upload` without `@login_required` — backend/routes/advisor/learning_moments.py:240
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/advisor/learning_moments.py:240 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `finalize_moment_signed_upload` without `@login_required` — backend/routes/parent/learning_moments.py:264
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/parent/learning_moments.py:264 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `finalize_signed_upload` without `@login_required` — backend/routes/uploads.py:196
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/uploads.py:196 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `finalize_task_signed_upload` without `@login_required` — backend/routes/evidence_documents.py:479
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/evidence_documents.py:479 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `finalize_task` without `@login_required` — backend/routes/tasks/completion.py:354
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/tasks/completion.py:354 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `finalize_tasks` without `@login_required` — backend/routes/quest_personalization.py:508
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/quest_personalization.py:508 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `fix_course_quest_enrollments` without `@login_required` — backend/routes/admin/quest_management/tools.py:198
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/quest_management/tools.py:198 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `fix_images` without `@login_required` — backend/routes/admin/curriculum_generate/bulk.py:203
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/curriculum_generate/bulk.py:203 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `forgot_password` without `@login_required` — backend/routes/auth/password.py:165
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/auth/password.py:165 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `generate_acting_as_token` without `@login_required` — backend/routes/dependents.py:828
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/dependents.py:828 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `generate_ai_tasks` without `@login_required` — backend/routes/curriculum/tasks.py:48
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/curriculum/tasks.py:48 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `generate_course_cover_image` without `@login_required` — backend/routes/courses/crud.py:521
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/courses/crud.py:521 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `generate_course` without `@login_required` — backend/routes/admin/curriculum_upload.py:704
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/curriculum_upload.py:704 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `generate_family_quest_ideas` without `@login_required` — backend/routes/parent/family_quest_ai.py:30
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/parent/family_quest_ai.py:30 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `generate_invitation_link` without `@login_required` — backend/routes/admin/user_invitations.py:574
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/user_invitations.py:574 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `generate_lesson_content_all` without `@login_required` — backend/routes/admin/curriculum_generate/lessons.py:136
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/curriculum_generate/lessons.py:136 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `generate_lesson_content_single` without `@login_required` — backend/routes/admin/curriculum_generate/lessons.py:182
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/curriculum_generate/lessons.py:182 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `generate_lessons_for_project` without `@login_required` — backend/routes/admin/curriculum_generate/lessons.py:101
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/curriculum_generate/lessons.py:101 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `generate_lessons` without `@login_required` — backend/routes/admin/curriculum_generate/lessons.py:60
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/curriculum_generate/lessons.py:60 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `generate_observer_invite_link` without `@login_required` — backend/routes/observer/student_invitations.py:23
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/observer/student_invitations.py:23 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `generate_outline` without `@login_required` — backend/routes/admin/curriculum_generate/outline.py:65
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/curriculum_generate/outline.py:65 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `generate_prompt_update` without `@login_required` — backend/routes/admin/course_refine.py:306
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/course_refine.py:306 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `generate_quest_from_topic` without `@login_required` — backend/routes/quest_ai.py:36
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/quest_ai.py:36 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `generate_showcase_fields` without `@login_required` — backend/routes/courses/crud.py:440
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/courses/crud.py:440 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `generate_steps` without `@login_required` — backend/routes/task_steps.py:20
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/task_steps.py:20 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `generate_tasks_for_lesson` without `@login_required` — backend/routes/admin/curriculum_generate/tasks.py:101
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/curriculum_generate/tasks.py:101 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `generate_tasks` without `@login_required` — backend/routes/admin/curriculum_generate/tasks.py:60
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/curriculum_generate/tasks.py:60 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `generate_tasks` without `@login_required` — backend/routes/demo.py:191
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/demo.py:191 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `generate_tasks` without `@login_required` — backend/routes/quest_personalization.py:120
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/quest_personalization.py:120 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `google_oauth_callback` without `@login_required` — backend/routes/auth/google_oauth.py:110
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/auth/google_oauth.py:110 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `grant_course_access` without `@login_required` — backend/routes/admin/organization_management.py:299
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/organization_management.py:299 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `grant_quest_access` without `@login_required` — backend/routes/admin/organization_management.py:206
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/organization_management.py:206 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `grow_this` without `@login_required` — backend/routes/credit_dashboard/superadmin_actions.py:176
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/credit_dashboard/superadmin_actions.py:176 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `helper_signed_upload_finalize` without `@login_required` — backend/routes/helper_evidence.py:722
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/helper_evidence.py:722 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `helper_signed_upload_init` without `@login_required` — backend/routes/helper_evidence.py:661
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/helper_evidence.py:661 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `init_block_signed_upload` without `@login_required` — backend/routes/evidence_documents.py:545
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/evidence_documents.py:545 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `init_moment_block_signed_upload` without `@login_required` — backend/routes/parent/learning_moments.py:1127
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/parent/learning_moments.py:1127 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `init_moment_signed_upload` without `@login_required` — backend/routes/advisor/learning_moments.py:201
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/advisor/learning_moments.py:201 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `init_moment_signed_upload` without `@login_required` — backend/routes/parent/learning_moments.py:225
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/parent/learning_moments.py:225 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `init_task_signed_upload` without `@login_required` — backend/routes/evidence_documents.py:425
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/evidence_documents.py:425 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `join_showcase` without `@login_required` — backend/routes/treehouse.py:496
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/treehouse.py:496 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `kiosk_login` without `@login_required` — backend/routes/treehouse.py:594
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/treehouse.py:594 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `kiosk_roster` without `@login_required` — backend/routes/treehouse.py:564
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/treehouse.py:564 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `leave_group` without `@login_required` — backend/routes/group_messages.py:283
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/group_messages.py:283 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `link_participant` without `@login_required` — backend/routes/admin/poe.py:152
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/poe.py:152 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `link_task_to_lesson` without `@login_required` — backend/routes/curriculum/tasks.py:317
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/curriculum/tasks.py:317 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `login` without `@login_required` — backend/routes/auth/login/core.py:180
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/auth/login/core.py:180 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `logout` without `@login_required` — backend/routes/auth/login/core.py:722
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/auth/login/core.py:722 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `lti_launch` without `@login_required` — backend/routes/lti/launch.py:151
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/lti/launch.py:151 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `mark_all_as_read` without `@login_required` — backend/routes/notifications.py:119
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/notifications.py:119 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `mark_as_read` without `@login_required` — backend/routes/group_messages.py:395
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/group_messages.py:395 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `mark_as_read` without `@login_required` — backend/routes/notifications.py:92
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/notifications.py:92 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `mark_kickoff_attended` without `@login_required` — backend/routes/courses/kickoff.py:81
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/courses/kickoff.py:81 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `mark_message_as_read` without `@login_required` — backend/routes/direct_messages.py:216
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/direct_messages.py:216 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `mark_pins` without `@login_required` — backend/routes/treehouse.py:349
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/treehouse.py:349 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `mark_tutorial_completed` without `@login_required` — backend/routes/auth/session.py:58
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/auth/session.py:58 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `merge_tasks` without `@login_required` — backend/routes/credit_dashboard/merge.py:21
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/credit_dashboard/merge.py:21 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `move_lesson_to_project` without `@login_required` — backend/routes/curriculum/lessons.py:256
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/curriculum/lessons.py:256 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `oidc_login_init` without `@login_required` — backend/routes/lti/launch.py:60
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/lti/launch.py:60 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `org_approve_credit` without `@login_required` — backend/routes/credit_dashboard/org_admin_actions.py:64
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/credit_dashboard/org_admin_actions.py:64 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `org_grow_this` without `@login_required` — backend/routes/credit_dashboard/org_admin_actions.py:303
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/credit_dashboard/org_admin_actions.py:303 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `org_login` without `@login_required` — backend/routes/auth/login/core.py:451
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/auth/login/core.py:451 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `parent_self_revoke` without `@login_required` — backend/routes/showcase.py:281
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/showcase.py:281 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `parent_send_observer_invitation` without `@login_required` — backend/routes/observer/parent_management.py:23
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/observer/parent_management.py:23 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `patch_post` without `@login_required` — backend/routes/showcase.py:148
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/showcase.py:148 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `patch_status` without `@login_required` — backend/routes/showcase.py:102
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/showcase.py:102 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `poll_canvas_grades` without `@login_required` — backend/routes/admin/lti_registrations.py:125
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/lti_registrations.py:125 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `post_credit_message` without `@login_required` — backend/routes/credit_messages.py:103
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/credit_messages.py:103 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `post_observer_comment` without `@login_required` — backend/routes/observer/comments.py:79
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/observer/comments.py:79 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `preview_imscc_import` without `@login_required` — backend/routes/admin/course_import.py:28
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/course_import.py:28 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `process_answers` without `@login_required` — backend/routes/admin/course_refine.py:154
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/course_refine.py:154 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `process_next_job` without `@login_required` — backend/routes/admin/curriculum_generate/jobs.py:363
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/curriculum_generate/jobs.py:363 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `process_uploaded_file` without `@login_required` — backend/routes/uploads.py:329
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/uploads.py:329 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `promote_dependent` without `@login_required` — backend/routes/dependents.py:435
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/dependents.py:435 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `promote_observer_to_parent` without `@login_required` — backend/routes/parent_linking/requests.py:350
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/parent_linking/requests.py:350 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `publish_course` without `@login_required` — backend/routes/courses/publishing.py:28
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/courses/publishing.py:28 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `queue_generation` without `@login_required` — backend/routes/admin/curriculum_generate/jobs.py:60
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/curriculum_generate/jobs.py:60 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `reconcile_user_xp` without `@login_required` — backend/routes/admin/xp_reconciliation.py:183
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/xp_reconciliation.py:183 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `record_feed_views` without `@login_required` — backend/routes/observer/social.py:24
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/observer/social.py:24 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `record_post` without `@login_required` — backend/routes/showcase.py:121
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/showcase.py:121 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `refine_family_quest_idea` without `@login_required` — backend/routes/parent/family_quest_ai.py:89
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/parent/family_quest_ai.py:89 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `refine_outline` without `@login_required` — backend/routes/admin/plan_mode.py:136
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/plan_mode.py:136 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `refine_tasks` without `@login_required` — backend/routes/quest_personalization.py:248
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/quest_personalization.py:248 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `refresh_quest_image` without `@login_required` — backend/routes/admin/quest_management/images.py:140
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/quest_management/images.py:140 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `refresh_token` without `@login_required` — backend/routes/auth/login/tokens.py:36
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/auth/login/tokens.py:36 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `regenerate_lesson` without `@login_required` — backend/routes/admin/curriculum_generate/lessons.py:224
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/curriculum_generate/lessons.py:224 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `regenerate_outline` without `@login_required` — backend/routes/admin/curriculum_generate/outline.py:235
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/curriculum_generate/outline.py:235 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `regenerate_task_distribution` without `@login_required` — backend/routes/admin/subject_backfill.py:332
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/subject_backfill.py:332 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `regenerate_tasks` without `@login_required` — backend/routes/admin/curriculum_generate/tasks.py:157
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/curriculum_generate/tasks.py:157 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `register_expo_token` without `@login_required` — backend/routes/push_subscriptions.py:196
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/push_subscriptions.py:196 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `register` without `@login_required` — backend/routes/auth/registration.py:111
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/auth/registration.py:111 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `reject_class_review` without `@login_required` — backend/routes/admin/class_reviews.py:226
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/class_reviews.py:226 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `reject_connection_request` without `@login_required` — backend/routes/admin/parent_connections.py:124
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/parent_connections.py:124 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `reject_connection_request` without `@login_required` — backend/routes/parent_linking/requests.py:293
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/parent_linking/requests.py:293 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `reject_parental_consent` without `@login_required` — backend/routes/parental_consent/admin_review.py:194
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/parental_consent/admin_review.py:194 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `reject_task` without `@login_required` — backend/routes/admin/task_approval.py:117
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/task_approval.py:117 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `remove_class_advisor` without `@login_required` — backend/routes/classes/advisors.py:151
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/classes/advisors.py:151 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `remove_class_quest` without `@login_required` — backend/routes/classes/quests.py:183
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/classes/quests.py:183 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `remove_family_observer` without `@login_required` — backend/routes/observer/family.py:557
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/observer/family.py:557 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `remove_member` without `@login_required` — backend/routes/group_messages.py:256
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/group_messages.py:256 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `remove_observer_for_student` without `@login_required` — backend/routes/observer/parent_management.py:272
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/observer/parent_management.py:272 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `remove_observer_link` without `@login_required` — backend/routes/admin/user_management.py:1217
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/user_management.py:1217 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `remove_observer` without `@login_required` — backend/routes/observer/student_invitations.py:338
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/observer/student_invitations.py:338 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `remove_quest_from_course` without `@login_required` — backend/routes/courses/quests.py:158
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/courses/quests.py:158 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `remove_user_from_organization` without `@login_required` — backend/routes/admin/organization_management.py:519
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/organization_management.py:519 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `rename_attachment` without `@login_required` — backend/routes/curriculum/attachments.py:181
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/curriculum/attachments.py:181 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `reopen_quest` without `@login_required` — backend/routes/quest/completion.py:645
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/quest/completion.py:645 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `reorder_class_quests` without `@login_required` — backend/routes/classes/quests.py:346
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/classes/quests.py:346 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `reorder_course_quests` without `@login_required` — backend/routes/courses/quests.py:421
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/courses/quests.py:421 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `reorder_lessons` without `@login_required` — backend/routes/curriculum/lessons.py:329
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/curriculum/lessons.py:329 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `reorder_quest_tasks` without `@login_required` — backend/routes/quest/completion.py:707
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/quest/completion.py:707 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `reorder_student_tasks` without `@login_required` — backend/routes/admin/student_task_management.py:658
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/student_task_management.py:658 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `report_content` without `@login_required` — backend/routes/moderation.py:24
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/moderation.py:24 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `request_account_deletion` without `@login_required` — backend/routes/account_deletion.py:36
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/account_deletion.py:36 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `request_diploma_credit` without `@login_required` — backend/routes/tasks/credit.py:53
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/tasks/credit.py:53 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `request_signed_upload_url` without `@login_required` — backend/routes/uploads.py:258
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/uploads.py:258 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `request_upload_session` without `@login_required` — backend/routes/uploads.py:151
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/uploads.py:151 securityAuth flask unauth route
high System graph security auth conf 1.00 Flask mutation route `resend_invitation` without `@login_required` — backend/routes/admin/user_invitations.py:473
Flask route declares POST/PUT/DELETE/PATCH methods without an auth decorator. Add `@login_required` (Flask-Login) or equivalent.
backend/routes/admin/user_invitations.py:473 securityAuth flask unauth route

Showing first 300 of 643. Refine filters or use the findings page for deep search.

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.
For AI agents + API integrations
Email me when this repo regresses
Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.
API access

This page is publicly accessible at: https://repobility.com/scan/27deb9ef-87bb-4cc9-ab0c-8bc3f24a9421/

To check status programmatically (no auth required): 

curl -s https://repobility.com/api/v1/public/scan/27deb9ef-87bb-4cc9-ab0c-8bc3f24a9421/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.